Re: [keycloak-user] Using Keycloak with Microsoft Azure Active Directory

Hi, I try to summarize, what we did: 1.    Download https://nexus.microsoftonline-p.com/federationmetadata/saml20/federationm... and import as client in your realm. 2.    Edit Client   a.    Settings: Disable Client Signature Required and set Signature Algorithm to “RSA_SHA1”   b.    Mapper: Name: IDPEmail, Mapper Type: User Property, Property: email, SAML Attribute Name: IDPEmail 3.    Currently we use local user database   a.    Add user   b.    Attributes: add/change key “saml.persistent.name.id.for.urn:federation:MicrosoftOnline” to “$foo” <- $foo must be the value of the ImmutableId attribute of the user synchronized to Azure AD. On Azure site we followed the instruction on the website: https://docs.microsoft.com/en-us/azure/active-directory/connect/active-di... With Powershell we changed the authentication domain to be federated: $cer=" " <- get the public key certificate from keycloak https://keycloak-host.tld /auth/realms/Azure/protocol/saml/descriptor, see X509Certificate $uri="https://keycloak-host.tld/auth/realms/Azure/protocol/saml" $issuer_uri="https://keycloak-host.tld /auth/realms/Azure" $dom="<your-authentication-domain.tld>" Set-MsolDomainAuthentication -DomainName $dom  -Authentication Federated -ActiveLogOnUri $uri -SigningCertificate $cer -PassiveLogOnUri $uri -IssuerUri $issuer_uri -LogOffUri $uri -PreferredAuthenticationProtocol SAMLP You can verify the settings via: Get-MsolDomainFederationSettings -DomainName "<your-authentication-domain.tld>" If you want to change the settings, you have to set the domain back to managed first: Set-MsolDomainAuthentication -DomainName "<your-authentication-domain.tld>" -Authentication Managed The federation change of the domain might take up to 72 hours until properly applied. Hope this helps Cheers Jonas On 31.08.17 14:15, songokudbz wrote: