[keycloak-user] SAML IdP and ADFS trust

Hi all, I'm configuring a SAML Identity Provider in Keycloak to allow single sign on with a customer ADFS server. I'm following this guide: http://blog.keycloak.org/2017/03/how-to-setup-ms-ad-fs-30-as-brokered.html I'm working in a development environment with a test ADFS server using a self-signed Service Communications certificate (I had to install and configure this myself so I could have gone wrong here). Keycloak is running on an AWS instance behind a load balancer, incoming https is handled by that. I've configured the Relying Party Trust on ADFS and the FederationMetadata.xml in the Keycloak identity provider. During testing I deployed a Keycloak image without a truststore or Service Communications certificate, but the redirect still works. When I click the SSO button from the Keycloak login page I am redirected to the ADFS login page, though from my understanding the outbound https request to the ADFS endpoint should fail, since Keycloak doesn't trust the ADFS server. Shouldn't the first redirect fail if there's no truststore or SSL certificate? I'm a novice at this so there's almost certainly a gap in my understanding, but I've searched through all the documentation I can find and can't make sense of it. Can anyone help? Thanks, Ben -- *Ben Redahan | Software Engineer* *Phone **+353 1 539 8744 <%2B353%201%20539%208744>* *TRIMBLE RAILWAY ASSET SOLUTIONS | NEXALA* *www.trimble.com/rail-assets* <http://www.trimble.com/rail-assets>*| * *www.nexala.com* <http://www.nexala.com/>* | **www.trimble.com/rail* <http://www.trimble.com/rail> *Newsletter Sign Up* <http://infogeospatial.trimble.com/rail-asset-newsletter-signup.html>* | **Request Demo* <http://infogeospatial.trimble.com/rail-asset-newsletter-signup.html>* | **LinkedIn <https://www.linkedin.com/company/trimble-railway-solutions>*