4:03 p.m.
Hi,
I am trying to setup Keycloak SAML with a third party IdP.
________________________________
Setup:
Keycloak-Server Version
4.8.3.Final
Wildfly Version
10.1.0.Final
Wildfly Adapter Version
keycloak-saml-wildfly-adapter-dist-4.8.3.Final
________________________________
I have followed these instructions:
IDP Initiated Login
IDP Initiated Login is a feature that allows you to set up an endpoint on the Keycloak
server that will log you into a specific application/client. In the Settings tab for your
client, you need to specify the IDP Initiated SSO URL Name. This is a simple string with
no whitespace in it. After this you can reference your client at the following URL:
root/auth/realms/{realm}/protocol/saml/clients/{url-name}
The IDP initiated login implementation prefers POST over REDIRECT binding (check saml
bindings<https://www.keycloak.org/docs/latest/server_admin/index.html#... for
more information). Therefore the final binding and SP URL are selected in the following
way:
1. If the specific Assertion Consumer Service POST Binding URL is defined (inside Fine
Grain SAML Endpoint Configuration section of the client settings) POST binding is used
through that URL.
2. If the general Master SAML Processing URL is specified then POST binding is used
again throught this general URL.
3. As the last resort, if the Assertion Consumer Service Redirect Binding URL is
configured (inside Fine Grain SAML Endpoint Configuration) REDIRECT binding is used with
this URL.
If your client requires a special relay state, you can also configure this on the Settings
tab in the IDP Initiated SSO Relay State field. Alternatively, browsers can specify the
relay state in a RelayState query parameter, i.e.
root/auth/realms/{realm}/protocol/saml/clients/{url-name}?RelayState=thestate.
When using identity
brokering<https://www.keycloak.org/docs/latest/server_admin/index.html...;,
it is possible to set up an IDP Initiated Login for a client from an external IDP. The
actual client is set up for IDP Initiated Login at broker IDP as described above. The
external IDP has to set up the client for application IDP Initiated Login that will point
to a special URL pointing to the broker and representing IDP Initiated Login endpoint for
a selected client at the brokering IDP. This means that in client settings at the external
IDP:
* IDP Initiated SSO URL Name is set to a name that will be published as IDP Initiated
Login initial point,
* Assertion Consumer Service POST Binding URL in the Fine Grain SAML Endpoint
Configuration section has to be set to the following URL:
broker-root/auth/realms/{broker-realm}/broker/{idp-name}/endpoint/clients/{client-id},
where:
* broker-root is base broker URL
* broker-realm is name of the realm at broker where external IDP is declared
* idp-name is name of the external IDP at broker
* client-id is the value of IDP Initiated SSO URL Name attribute of the SAML client
defined at broker. It is this client, which will be made available for IDP Initiated Login
from the external IDP.
Please note that you can import basic client settings from the brokering IDP into client
settings of the external IDP - just use SP
Descriptor<https://www.keycloak.org/docs/latest/server_admin/index.htm...
available from the settings of the identity provider in the brokering IDP, and add
clients/client-id to the endpoint URL.
________________________________
Configuration Issues
There are following cases that I can't get my head around:
* If I leave Assertion Consumer Service POST Binding URL in the Fine Grain SAML
Endpoint Configuration blank, the IdP initiated login works, but the sp-initiated login
does not work (no matter if I directly browse to myapp/context url or to
https://host/auth/realms/myrealm/protocol/saml/clients/myapp
* If I put
broker-root/auth/realms/{broker-realm}/broker/{idp-name}/endpoint/clients/{client-id} in
Assertion Consumer Service POST Binding URL, an IdP initiated login results in
invalidFederatedIdentityActionMessage:
ERROR [org.keycloak.broker.saml.SAMLEndpoint] (default task-300) validation failed:
org.keycloak.common.VerificationException: Invalid signature on document
at
org.keycloak.protocol.saml.SamlProtocolUtils.verifyDocumentSignatureSamlProtocolUtils.java:83)
at
org.keycloak.broker.saml.SAMLEndpoint$PostBinding.verifySignature(SAMLEndpoint.java:557)
at
org.keycloak.broker.saml.SAMLEndpoint$Binding.handleSamlResponse(SAMLEndpoint.java:495)
at org.keycloak.broker.saml.SAMLEndpoint$Binding.execute(SAMLEndpoint.java:244)
at org.keycloak.broker.saml.SAMLEndpoint.postBinding(SAMLEndpoint.java:1 82)
This is metadata in the external IdP:
<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata"
entityID="https://mybroker/auth/realms/MYREALM">
<SPSSODescriptor AuthnRequestsSigned="true"
WantAssertionsSigned="true"
protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol
urn:oasis:names:tc:SAML:1.1:protocol
http://schemas.xmlsoap.org/ws/2003/07/secext">
<NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</NameIDFormat>
<KeyDescriptor use="signing">
<dsig:KeyInfo
xmlns:dsig="http://www.w3.org/2000/09/xmldsig#<http://www.w3.org/...
<dsig:KeyName>*****</dsig:KeyName>
<dsig:X509Data>
<dsig:X509Certificate>*****</dsig:X509Certificate>
</dsig:X509Data>
</dsig:KeyInfo>
</KeyDescriptor>
<KeyDescriptor use="encryption">
<dsig:KeyInfo
xmlns:dsig="http://www.w3.org/2000/09/xmldsig#<http://www.w3.org/...
<dsig:KeyName>*****</dsig:KeyName>
<dsig:X509Data>
<dsig:X509Certificate>*****</dsig:X509Certificate>
</dsig:X509Data>
</dsig:KeyInfo>
</KeyDescriptor>
<SingleLogoutService
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
Location="https://mybroker/auth/realms/MYREALM/broker/myidp/endpoint"/<https://mybroker/auth/realms/MYREALM/broker/myidp/endpoint>>
<AssertionConsumerService
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
Location="https://mybroker/auth/realms/MYREALM/broker/myidp/endpoint/clients/myapp"
index="1" isDefault="true" />
</SPSSODescriptor>
</EntityDescriptor>
________________________________
Questions:
* If you set up Idp Initiated login, should the SP initiated login work aswell?
* If yes, where does the AssertionConsumerServiceURL in the AuthnRequest come from?
(shouldn't it reference the same url:
https://mybroker/auth/realms/MYREALM/broker/myidp/endpoint/clients/myapp (because it
doesn't)
* Does the logout URL have to reference the client SSO id aswell?
* Is there more Information concerning FINE GRAIN SAML ENDPOINT CONFIGURATION?
Best regards and thank you in advance,
[Logo]
Manuel Waltschek BSc.
+43 660 86655 47<tel:+436608665547>
manuel.waltschek@prisma-solutions.at<mailto:manuel.waltschek@prisma-solutions.at>
https://www.prisma-solutions.com
PRISMA solutions EDV-Dienstleistungen GmbH
Klostergasse 18, 2340 Mödling, Austria
Firmenbuch: FN 239449 g, Landesgericht Wiener Neustadt
