Hi, in fact it is the second option: Keycloak as IdP for sales-post-enc SP ( both on the same wildfly/keycloak instance) with OpenAM as brokered idP : - I deployed sales-post-enc with mvn clean package wildfly:deploy option, - I entered the admin console and inside the saml-demo realm, I imported the OpenAm IDPSSODescriptor - On the tab Export (from Menu Identity Providers) I took the SPSSODescriptor - Section under the Download Button and imported keycloak as remote SP on the OpenAm - Login Site. What I found strange is that there is no KeyDescriptor for encryption, only for signing. ( Also there is no KeyDescriptor for enrycption in the SPSSODescriptor for Clients when Enrypt Assertions is enabled and there are EncrptionKey and SigningKey available)

The 500 HTTP-Error occurs on OpenAM site when Encryption is enabled on the IDP and before the SAML Response is generated. If Encryption is disabled on OpenAM, the SAML Responses are generated correctly without Errors.

Cheers On Wed, Apr 19, 2017 at 9:17 AM, Hynek Mlnarik <hmlnarik(a)redhat.com <mailto:hmlnarik@redhat.com>> wrote: On Tue, Apr 18, 2017 at 3:04 PM, Metehan Selvi <mselvi78(a)gmail.com <mailto:mselvi78@gmail.com>> wrote: > Hi there, > I configured OpenAM as IDP and Keycloak as SP together. > I use the sales-post-enc - example App. Do you mean using Keycloak adapters as SP and OpenAM as IdP, or OpenAM as brokered IdP while using Keycloak as IdP for sales-post-enc SP? > SAML-AuthnRequests and SAML-Repsonses are working. > ( Encryption disabled) > > When I enable Encrpytion in OpenAM and in the app, the SAML Repsonses > cannot be encrypted in OpenAM as it throws Exceptions with Http 500 > Responses. Is it OpenAM or Keycloak returning HTTP 500 error? If Keycloak, can you share details of the exception? > How do I get out from the Problem ? > > When I want to export the SPSSODescriptor form Keycloak for the OpenAM IDP, > it contains only the KeyDescriptor for Signing. Normally it should be also > possible to export the KeyDescriptor for encryption. Is this maybe the > failure? > > Other ideas to get rid of the problem.. ?! > > Cheers > Metehan Selvi > _______________________________________________ > keycloak-user mailing list > keycloak-user(a)lists.jboss.org <mailto:keycloak-user@lists.jboss.org> > https://lists.jboss.org/mailman/listinfo/keycloak-user <https://lists.jboss.org/mailman/listinfo/keycloak-user> -- --Hynek