Re: [keycloak-user] converting OIDC token to SAML

Out of curiosity, so the 3rd party is already using Keycloak as SAML IdP ? On Thu, Apr 18, 2019 at 1:32 AM Bruce Wings <testoauth55(a)gmail.com&gt; wrote: > Answer to my previous question: > > Only step needed after adding SAML provider is to turn on Stored Tokens > Readable and Stored Tokens switches. The reason I was getting above > error was because for already imported user, this role will not get set. > Only for newly imported users(users imported after turning on switches, it > will get set) > > But this is a very handy solution from keycloak to extract SAML tokens. > > On Thu, Apr 18, 2019 at 9:48 AM Bruce Wings <testoauth55(a)gmail.com&gt; > wrote: > >> Thanks Pedro, >> >> I guess, then an alternative and a very good solution that keycloak >> provides is to integrate the same SAML provider(which is being used by 3rd >> party app) with Keycloak and extract the SAML token from it and pass on >> this token to 3rd party app. >> >> I followed the official doc: https://www.keycloak.org/ >> docs/4.5/server_admin/index.html#retrieving-external-idp-tokens >> >> After configuring the SAML provider, I turned on the Stored Tokens >> Readable and Stored Tokens switches, however I am still receiving >> >> *"errorMessage": "Client [myApp] not authorized to retrieve tokens from >> identity provider [saml1]."* >> >> In the doc there is 1 more configuration - "This access token will need >> to have the broker client-level role read-token set" but I do not know >> where to set this particular option. Any idea? >> >> >> On Wed, Apr 17, 2019 at 5:30 PM Pedro Igor Silva <psilva(a)redhat.com&gt; >> wrote: >> >>> If you want to exchange access/id tokens for saml assertions, the token >>> exchange does not support SAML. >>> >>> On Wed, Apr 17, 2019 at 4:48 AM Bruce Wings <testoauth55(a)gmail.com&gt; >>> wrote: >>> >>>> I have successfully integrated few of my apps with keycloak (with OIDC >>>> tokens). However there is a 3rd party app which works on SAML tokens. >>>> I am >>>> wondering is it possible to use my existing keycloak system to send >>>> SAML >>>> tokens to this third party app? >>>> i.e. I want to use keycloak as IDP and SP and generate SAML tokens and >>>> send >>>> it to this 3rd party app. Is this scenario even possible? >>>> _______________________________________________ >>>> keycloak-user mailing list >>>> keycloak-user(a)lists.jboss.org >>>> https://lists.jboss.org/mailman/listinfo/keycloak-user >>>> >>>