Re: [keycloak-user] Testing SAML Identity Brokering

Hi Craig, On Thu, 2018-10-11 at 15:36 -0500, Craig Setera wrote: In the brokering scenario, your webapp should remain the client of the saml-demo realm, and this realm itself should become a client of another realm. This is how brokering actually works. Let's assume there are realms "foo" and "bar", and the former should broker to the latter. The exact steps are: 1. Go to "foo" realm -> Identity Providers -> add SAML 2.0 provider; 2. Scroll down to "Import from URL", enter the following: http://<your-keycloak-host>:<port>/auth/realms/bar/protocol/saml/descriptor (replace "bar" with the actual name of your second realm) 3. Go to Export tab, save EntityDescriptor XML; 4. Go to "bar" realm -> Clients, create one, import the XML from the previous step, provide some meaningful name; 5. Create some users in "bar". After that, try accessing your SAML client. You'll be presented with the Keycloak login screen where you'll be able to either authenticate against "saml-demo", or to choose another realm. Some notes: - you can avoid first login screen and redirect automatically to the second realm, using custom authentication flow with IDP redirector + flow override at the client level; - upon the first brokered login, the user will be presented with the Update account details screen. If you want to bypass that, you can enable identity auto-linking. It's out of the box in KC 4.5.0, thx to excellent work by Ryan Slominski: https://issues.jboss.org/browse/KEYCLOAK-7270 For KC <4.5.0, you can use this: https://github.com/ohioit/keycloak-link-idp-with-user Good luck! Dmitry Telegin CTO, Acutus s.r.o. Keycloak Consulting and Training Pod lipami street 339/52, 130 00 Prague 3, Czech Republic +42 (022) 888-30-71 E-mail: info(a)acutus.pro