Hi, I like to use Salesforce as Identity Provider, the metadata provided by salesforce can be imported. But I need to specify the Service Provider in salesforce, I have to fill in a couple of fields, but two of them I don’t understand (and are mandatory). Does someone have any clue 1. entity id , remark of salesforce : get this value from your serviceprovider 2. ACS URL, remark of slaesforce : The assertion consumer service. Get this value from your service provider. I have tried a lot of values but every-time I click the saml button on my app, it redirects to salesforce but I get a page with the error : Error: Unable to resolve request into a Service Provider Henk _______________________________________________ keycloak-user mailing list keycloak-user(a)lists.jboss.org https://lists.jboss.org/mailman/listinfo/keycloak-user

If you get any errors about the entityid, try the below http://localhost:8080/auth/realms/ <http://localhost:8080/auth/realms/%7Byour-realm>{your-realm <http://localhost:8080/auth/realms/%7Byour-realm>} Marek/Dev team - Despite spending a good amount of time on KC, even I find it difficult to make things work as the end points are not documented. Is that something that can be done before you go for the next release? Thanks, Raghu ------------------------------------------------------------------------ *From:* Marek Posolda <mposolda(a)redhat.com&gt; *To:* Henk Laracker <Henk.Laracker(a)planonsoftware.com>; &quot;keycloak-user(a)lists.jboss.org&quot; <keycloak-user(a)lists.jboss.org&gt; *Sent:* Thursday, April 30, 2015 4:49 AM *Subject:* Re: [keycloak-user] IDP SAMLV2.0 with Salesforce Not sure at 100%, but I think that for both values you can just use URI when you want Salesforce to redirect after authentication. So something like (replace stuff in braces with values for your environment): http://localhost:8080/auth/realms/{your-realm}/broker/{your-identity-prov... For some hints, you can see picketlink documentation for Salesforce integration here https://docs.jboss.org/author/display/PLINK/Picketlink+as+SP,+Salesforce+... . I assume many steps are similar for Keycloak like for Picketlink. Marek On 30.4.2015 08:45, Henk Laracker wrote: Hi, I like to use Salesforce as Identity Provider, the metadata provided by salesforce can be imported. But I need to specify the Service Provider in salesforce, I have to fill in a couple of fields, but two of them I don’t understand (and are mandatory). Does someone have any clue 1. entity id , remark of salesforce : get this value from your serviceprovider 2. ACS URL, remark of slaesforce : The assertion consumer service. Get this value from your service provider. I have tried a lot of values but every-time I click the saml button on my app, it redirects to salesforce but I get a page with the error : Error: Unable to resolve request into a Service Provider Henk _______________________________________________ keycloak-user mailing list keycloak-user(a)lists.jboss.org <mailto:keycloak-user@lists.jboss.org> https://lists.jboss.org/mailman/listinfo/keycloak-user _______________________________________________ keycloak-user mailing list keycloak-user(a)lists.jboss.org <mailto:keycloak-user@lists.jboss.org> https://lists.jboss.org/mailman/listinfo/keycloak-user

You want to chain keycloak server to Salesforce? If you create a SAMLv2 IdentityProvider in keycloak that points to Salesforce, you;ll see after you create it, an Export button. Click that. That will create an entity descriptor with all the information you need. On 4/30/2015 2:45 AM, Henk Laracker wrote: > Hi, > > I like to use Salesforce as Identity Provider, the metadata provided by > salesforce can be imported. > But I need to specify the Service Provider in salesforce, I have to fill > in a couple of fields, but two of them I don¹t understand (and are > mandatory). Does someone have any clue > > 1. entity id , remark of salesforce : get this value from your > serviceprovider > 2. ACS URL, remark of slaesforce : The assertion consumer service. Get > this value from your service provider. > > I have tried a lot of values but every-time I click the saml button on > my app, it redirects to salesforce but I get a page with the error : > Error: Unable to resolve request into a Service Provider > > Henk > > > _______________________________________________ > keycloak-user mailing list > keycloak-user(a)lists.jboss.org > https://lists.jboss.org/mailman/listinfo/keycloak-user > -- Bill Burke JBoss, a division of Red Hat http://bill.burkecentral.com _______________________________________________ keycloak-user mailing list keycloak-user(a)lists.jboss.org https://lists.jboss.org/mailman/listinfo/keycloak-user

i have no idea. Basically this error is stating that the login response saml document has no assertions within it. If there are no assertions, then there has been no identity data sent. I'm looking now, but can you send me a link on how to set up Salesforce as an IDP? Is one able to set up a free account and such? On 4/30/2015 9:25 AM, Henk Laracker wrote: > Hi Bill, > > I don¹t know why I missed that, thanks! Salesforce respons know with the > correct login page. After logging in in Salesforce, I¹m redirected to > keycloak again with a internal error: > > Caused by: org.keycloak.broker.provider.IdentityBrokerException: Could not > process response from SAML identity provider. > at > org.keycloak.broker.saml.SAMLEndpoint$Binding.handleLoginResponse(SAMLEndpo > int.java:299) > at > org.keycloak.broker.saml.SAMLEndpoint$Binding.handleSamlResponse(SAMLEndpoi > nt.java:343) > at > org.keycloak.broker.saml.SAMLEndpoint$Binding.execute(SAMLEndpoint.java:169 > ) > at > org.keycloak.broker.saml.SAMLEndpoint.postBinding(SAMLEndpoint.java:117) > at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) > [rt.jar:1.8.0_45] > at > sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:6 > 2) [rt.jar:1.8.0_45] > at > sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImp > l.java:43) [rt.jar:1.8.0_45] > at java.lang.reflect.Method.invoke(Method.java:497) [rt.jar:1.8.0_45] > at > org.jboss.resteasy.core.MethodInjectorImpl.invoke(MethodInjectorImpl.java:1 > 37) [resteasy-jaxrs-3.0.10.Final.jar:] > at > org.jboss.resteasy.core.ResourceMethodInvoker.invokeOnTarget(ResourceMethod > Invoker.java:296) [resteasy-jaxrs-3.0.10.Final.jar:] > at > org.jboss.resteasy.core.ResourceMethodInvoker.invoke(ResourceMethodInvoker. > java:250) [resteasy-jaxrs-3.0.10.Final.jar:] > at > org.jboss.resteasy.core.ResourceLocatorInvoker.invokeOnTargetObject(Resourc > eLocatorInvoker.java:140) [resteasy-jaxrs-3.0.10.Final.jar:] > at > org.jboss.resteasy.core.ResourceLocatorInvoker.invoke(ResourceLocatorInvoke > r.java:109) [resteasy-jaxrs-3.0.10.Final.jar:] > at > org.jboss.resteasy.core.ResourceLocatorInvoker.invokeOnTargetObject(Resourc > eLocatorInvoker.java:135) [resteasy-jaxrs-3.0.10.Final.jar:] > at > org.jboss.resteasy.core.ResourceLocatorInvoker.invoke(ResourceLocatorInvoke > r.java:103) [resteasy-jaxrs-3.0.10.Final.jar:] > at > org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher. > java:356) [resteasy-jaxrs-3.0.10.Final.jar:] > ... 39 more > Caused by: org.keycloak.broker.provider.IdentityBrokerException: No > assertion from response. > at > org.keycloak.broker.saml.SAMLEndpoint$Binding.getAssertion(SAMLEndpoint.jav > a:309) > at > org.keycloak.broker.saml.SAMLEndpoint$Binding.handleLoginResponse(SAMLEndpo > int.java:264) > ... 54 more > > Any idea? > > Henk > > > > > On 30/04/15 14:31, "Bill Burke" <bburke(a)redhat.com&gt; wrote: > >> You want to chain keycloak server to Salesforce? >> >> If you create a SAMLv2 IdentityProvider in keycloak that points to >> Salesforce, you;ll see after you create it, an Export button. Click >> that. That will create an entity descriptor with all the information >> you need. >> >> On 4/30/2015 2:45 AM, Henk Laracker wrote: >>> Hi, >>> >>> I like to use Salesforce as Identity Provider, the metadata provided by >>> salesforce can be imported. >>> But I need to specify the Service Provider in salesforce, I have to fill >>> in a couple of fields, but two of them I don¹t understand (and are >>> mandatory). Does someone have any clue >>> >>> 1. entity id , remark of salesforce : get this value from your >>> serviceprovider >>> 2. ACS URL, remark of slaesforce : The assertion consumer service. Get >>> this value from your service provider. >>> >>> I have tried a lot of values but every-time I click the saml button on >>> my app, it redirects to salesforce but I get a page with the error : >>> Error: Unable to resolve request into a Service Provider >>> >>> Henk >>> >>> >>> _______________________________________________ >>> keycloak-user mailing list >>> keycloak-user(a)lists.jboss.org >>> https://lists.jboss.org/mailman/listinfo/keycloak-user >>> >> >> -- >> Bill Burke >> JBoss, a division of Red Hat >> http://bill.burkecentral.com >> _______________________________________________ >> keycloak-user mailing list >> keycloak-user(a)lists.jboss.org >> https://lists.jboss.org/mailman/listinfo/keycloak-user >

Ok, I was able to get this to work. The problem was I had to set a "profile" for the connected app on Salesforce. I added a "System Adminstrator" profile to the Connected App and it worked. I'm not sure how to upload a app certificate yet. Not sure what format Salesforce is looking for. On 4/30/2015 11:39 AM, Bill Burke wrote: > I set up a salesforce example and looked at the login response SAML > document. Looks like no assertion data is being sent back at all by > salesforce. > > On 4/30/2015 9:43 AM, Bill Burke wrote: >> i have no idea. Basically this error is stating that the login >>response >> saml document has no assertions within it. If there are no assertions, >> then there has been no identity data sent. >> >> I'm looking now, but can you send me a link on how to set up Salesforce >> as an IDP? Is one able to set up a free account and such? >> >> On 4/30/2015 9:25 AM, Henk Laracker wrote: >>> Hi Bill, >>> >>> I don¹t know why I missed that, thanks! Salesforce respons know with >>>the >>> correct login page. After logging in in Salesforce, I¹m redirected to >>> keycloak again with a internal error: >>> >>> Caused by: org.keycloak.broker.provider.IdentityBrokerException: >>>Could not >>> process response from SAML identity provider. >>> at >>> >>>org.keycloak.broker.saml.SAMLEndpoint$Binding.handleLoginResponse(SAMLE >>>ndpo >>> int.java:299) >>> at >>> >>>org.keycloak.broker.saml.SAMLEndpoint$Binding.handleSamlResponse(SAMLEn >>>dpoi >>> nt.java:343) >>> at >>> >>>org.keycloak.broker.saml.SAMLEndpoint$Binding.execute(SAMLEndpoint.java >>>:169 >>> ) >>> at >>> >>>org.keycloak.broker.saml.SAMLEndpoint.postBinding(SAMLEndpoint.java:117 >>>) >>> at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) >>> [rt.jar:1.8.0_45] >>> at >>> >>>sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.ja >>>va:6 >>> 2) [rt.jar:1.8.0_45] >>> at >>> >>>sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccesso >>>rImp >>> l.java:43) [rt.jar:1.8.0_45] >>> at java.lang.reflect.Method.invoke(Method.java:497) [rt.jar:1.8.0_45] >>> at >>> >>>org.jboss.resteasy.core.MethodInjectorImpl.invoke(MethodInjectorImpl.ja >>>va:1 >>> 37) [resteasy-jaxrs-3.0.10.Final.jar:] >>> at >>> >>>org.jboss.resteasy.core.ResourceMethodInvoker.invokeOnTarget(ResourceMe >>>thod >>> Invoker.java:296) [resteasy-jaxrs-3.0.10.Final.jar:] >>> at >>> >>>org.jboss.resteasy.core.ResourceMethodInvoker.invoke(ResourceMethodInvo >>>ker. >>> java:250) [resteasy-jaxrs-3.0.10.Final.jar:] >>> at >>> >>>org.jboss.resteasy.core.ResourceLocatorInvoker.invokeOnTargetObject(Res >>>ourc >>> eLocatorInvoker.java:140) [resteasy-jaxrs-3.0.10.Final.jar:] >>> at >>> >>>org.jboss.resteasy.core.ResourceLocatorInvoker.invoke(ResourceLocatorIn >>>voke >>> r.java:109) [resteasy-jaxrs-3.0.10.Final.jar:] >>> at >>> >>>org.jboss.resteasy.core.ResourceLocatorInvoker.invokeOnTargetObject(Res >>>ourc >>> eLocatorInvoker.java:135) [resteasy-jaxrs-3.0.10.Final.jar:] >>> at >>> >>>org.jboss.resteasy.core.ResourceLocatorInvoker.invoke(ResourceLocatorIn >>>voke >>> r.java:103) [resteasy-jaxrs-3.0.10.Final.jar:] >>> at >>> >>>org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatc >>>her. >>> java:356) [resteasy-jaxrs-3.0.10.Final.jar:] >>> ... 39 more >>> Caused by: org.keycloak.broker.provider.IdentityBrokerException: No >>> assertion from response. >>> at >>> >>>org.keycloak.broker.saml.SAMLEndpoint$Binding.getAssertion(SAMLEndpoint >>>.jav >>> a:309) >>> at >>> >>>org.keycloak.broker.saml.SAMLEndpoint$Binding.handleLoginResponse(SAMLE >>>ndpo >>> int.java:264) >>> ... 54 more >>> >>> Any idea? >>> >>> Henk >>> >>> >>> >>> >>> On 30/04/15 14:31, "Bill Burke" <bburke(a)redhat.com&gt; wrote: >>> >>>> You want to chain keycloak server to Salesforce? >>>> >>>> If you create a SAMLv2 IdentityProvider in keycloak that points to >>>> Salesforce, you;ll see after you create it, an Export button. Click >>>> that. That will create an entity descriptor with all the information >>>> you need. >>>> >>>> On 4/30/2015 2:45 AM, Henk Laracker wrote: >>>>> Hi, >>>>> >>>>> I like to use Salesforce as Identity Provider, the metadata >>>>>provided by >>>>> salesforce can be imported. >>>>> But I need to specify the Service Provider in salesforce, I have to >>>>>fill >>>>> in a couple of fields, but two of them I don¹t understand (and are >>>>> mandatory). Does someone have any clue >>>>> >>>>> 1. entity id , remark of salesforce : get this value from your >>>>> serviceprovider >>>>> 2. ACS URL, remark of slaesforce : The assertion consumer >>>>>service. Get >>>>> this value from your service provider. >>>>> >>>>> I have tried a lot of values but every-time I click the saml button >>>>>on >>>>> my app, it redirects to salesforce but I get a page with the error : >>>>> Error: Unable to resolve request into a Service Provider >>>>> >>>>> Henk >>>>> >>>>> >>>>> _______________________________________________ >>>>> keycloak-user mailing list >>>>> keycloak-user(a)lists.jboss.org >>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user >>>>> >>>> >>>> -- >>>> Bill Burke >>>> JBoss, a division of Red Hat >>>> http://bill.burkecentral.com >>>> _______________________________________________ >>>> keycloak-user mailing list >>>> keycloak-user(a)lists.jboss.org >>>> https://lists.jboss.org/mailman/listinfo/keycloak-user >>> >> > -- Bill Burke JBoss, a division of Red Hat http://bill.burkecentral.com _______________________________________________ keycloak-user mailing list keycloak-user(a)lists.jboss.org https://lists.jboss.org/mailman/listinfo/keycloak-user

Hi Bill, Thank you this worked out! I user is created with my name saml.henk.laracker(a)p***n.nl , do you have any idee why the “saml” prefix is added? Henk On 30/04/15 18:44, "Bill Burke" <bburke(a)redhat.com&gt; wrote: > Ok, I was able to get this to work.  The problem was I had to set a > "profile" for the connected app on Salesforce.  I added a "System > Adminstrator" profile to the Connected App and it worked. > > I'm not sure how to upload a app certificate yet.  Not sure what format > Salesforce is looking for. > > On 4/30/2015 11:39 AM, Bill Burke wrote: >> I set up a salesforce example and looked at the login response SAML >> document.  Looks like no assertion data is being sent back at all by >> salesforce. >> >> On 4/30/2015 9:43 AM, Bill Burke wrote: >>> i have no idea.  Basically this error is stating that the login >>> response >>> saml document has no assertions within it.  If there are no assertions, >>> then there has been no identity data sent. >>> >>> I'm looking now, but can you send me a link on how to set up Salesforce >>> as an IDP?  Is one able to set up a free account and such? >>> >>> On 4/30/2015 9:25 AM, Henk Laracker wrote: >>>> Hi Bill, >>>> >>>> I don¹t know why I missed that, thanks! Salesforce respons know with >>>> the >>>> correct login page. After logging in in Salesforce, I¹m redirected to >>>> keycloak again with a internal error: >>>> >>>> Caused by: org.keycloak.broker.provider.IdentityBrokerException: >>>> Could not >>>> process response from SAML identity provider. >>>>     at >>>> >>>> org.keycloak.broker.saml.SAMLEndpoint$Binding.handleLoginResponse(SAMLE >>>> ndpo >>>> int.java:299) >>>>     at >>>> >>>> org.keycloak.broker.saml.SAMLEndpoint$Binding.handleSamlResponse(SAMLEn >>>> dpoi >>>> nt.java:343) >>>>     at >>>> >>>> org.keycloak.broker.saml.SAMLEndpoint$Binding.execute(SAMLEndpoint.java >>>> :169 >>>> ) >>>>     at >>>> >>>> org.keycloak.broker.saml.SAMLEndpoint.postBinding(SAMLEndpoint.java:117 >>>> ) >>>>     at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) >>>> [rt.jar:1.8.0_45] >>>>     at >>>> >>>> sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.ja >>>> va:6 >>>> 2) [rt.jar:1.8.0_45] >>>>     at >>>> >>>> sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccesso >>>> rImp >>>> l.java:43) [rt.jar:1.8.0_45] >>>>     at java.lang.reflect.Method.invoke(Method.java:497) [rt.jar:1.8.0_45] >>>>     at >>>> >>>> org.jboss.resteasy.core.MethodInjectorImpl.invoke(MethodInjectorImpl.ja >>>> va:1 >>>> 37) [resteasy-jaxrs-3.0.10.Final.jar:] >>>>     at >>>> >>>> org.jboss.resteasy.core.ResourceMethodInvoker.invokeOnTarget(ResourceMe >>>> thod >>>> Invoker.java:296) [resteasy-jaxrs-3.0.10.Final.jar:] >>>>     at >>>> >>>> org.jboss.resteasy.core.ResourceMethodInvoker.invoke(ResourceMethodInvo >>>> ker. >>>> java:250) [resteasy-jaxrs-3.0.10.Final.jar:] >>>>     at >>>> >>>> org.jboss.resteasy.core.ResourceLocatorInvoker.invokeOnTargetObject(Res >>>> ourc >>>> eLocatorInvoker.java:140) [resteasy-jaxrs-3.0.10.Final.jar:] >>>>     at >>>> >>>> org.jboss.resteasy.core.ResourceLocatorInvoker.invoke(ResourceLocatorIn >>>> voke >>>> r.java:109) [resteasy-jaxrs-3.0.10.Final.jar:] >>>>     at >>>> >>>> org.jboss.resteasy.core.ResourceLocatorInvoker.invokeOnTargetObject(Res >>>> ourc >>>> eLocatorInvoker.java:135) [resteasy-jaxrs-3.0.10.Final.jar:] >>>>     at >>>> >>>> org.jboss.resteasy.core.ResourceLocatorInvoker.invoke(ResourceLocatorIn >>>> voke >>>> r.java:103) [resteasy-jaxrs-3.0.10.Final.jar:] >>>>     at >>>> >>>> org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatc >>>> her. >>>> java:356) [resteasy-jaxrs-3.0.10.Final.jar:] >>>>     ... 39 more >>>> Caused by: org.keycloak.broker.provider.IdentityBrokerException: No >>>> assertion from response. >>>>     at >>>> >>>> org.keycloak.broker.saml.SAMLEndpoint$Binding.getAssertion(SAMLEndpoint >>>> .jav >>>> a:309) >>>>     at >>>> >>>> org.keycloak.broker.saml.SAMLEndpoint$Binding.handleLoginResponse(SAMLE >>>> ndpo >>>> int.java:264) >>>>     ... 54 more >>>> >>>> Any idea? >>>> >>>> Henk >>>> >>>> >>>> >>>> >>>> On 30/04/15 14:31, "Bill Burke" <bburke(a)redhat.com&gt; wrote: >>>> >>>>> You want to chain keycloak server to Salesforce? >>>>> >>>>> If you create a SAMLv2 IdentityProvider in keycloak that points to >>>>> Salesforce, you;ll see after you create it, an Export button.  Click >>>>> that.  That will create an entity descriptor with all the information >>>>> you need. >>>>> >>>>> On 4/30/2015 2:45 AM, Henk Laracker wrote: >>>>>> Hi, >>>>>> >>>>>> I like to use Salesforce as Identity Provider, the metadata >>>>>> provided by >>>>>> salesforce can be imported. >>>>>> But I need to specify the Service Provider in salesforce, I have to >>>>>> fill >>>>>> in a couple of fields, but two of them I don¹t understand (and are >>>>>> mandatory). Does someone have any clue >>>>>> >>>>>>      1. entity id , remark of salesforce : get this value from your >>>>>>        serviceprovider >>>>>>      2. ACS URL, remark of slaesforce : The assertion consumer >>>>>> service. Get >>>>>>        this value from your service provider. >>>>>> >>>>>> I have tried a lot of values but every-time I click the saml button >>>>>> on >>>>>> my app, it redirects to salesforce but I get a page with the error : >>>>>> Error: Unable to resolve request into a Service Provider >>>>>> >>>>>> Henk >>>>>> >>>>>> >>>>>> _______________________________________________ >>>>>> keycloak-user mailing list >>>>>> keycloak-user(a)lists.jboss.org >>>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user >>>>>> >>>>> >>>>> -- >>>>> Bill Burke >>>>> JBoss, a division of Red Hat >>>>> http://bill.burkecentral.com

>>>>> _______________________________________________ >>>>> keycloak-user mailing list >>>>> keycloak-user(a)lists.jboss.org >>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user >>>> >>> >> > > -- > Bill Burke > JBoss, a division of Red Hat > http://bill.burkecentral.com > _______________________________________________ > keycloak-user mailing list > keycloak-user(a)lists.jboss.org > https://lists.jboss.org/mailman/listinfo/keycloak-user

You can map the SAML/OIDC assertion/token that is sent to your applications however you want. On 4/30/2015 9:23 PM, Raghu Prabhala wrote: > Bill - That would be an issue for us as we cannot manipulate the values > (especially username) sent by an external IDP which is the authoritative > source of user information. We will have to figure out another way, > perhaps, an internal KC user attribute that can be made unique to > prevent name clashes. > > Thanks, > Raghu > ------------------------------------------------------------------------ > *From:* Bill Burke <bburke(a)redhat.com&gt; > *To:* Henk Laracker <Henk.Laracker(a)planonsoftware.com>; > &quot;keycloak-user(a)lists.jboss.org&quot; <keycloak-user(a)lists.jboss.org&gt; > *Sent:* Thursday, April 30, 2015 7:26 PM > *Subject:* Re: [keycloak-user] IDP SAMLV2.0 with Salesforce > > Right now, the username is prefixed with the broker name. THis is to > avoid name clashes if you are brokering multiple IDPS (i.e. multiple > social providers). > > On 4/30/2015 2:51 PM, Henk Laracker wrote: > > Hi Bill, > > > > Thank you this worked out! I user is created with my name > > saml.henk.laracker@p <mailto:saml.henk.laracker@p>***n.nl , do you > have any idee why the “saml” prefix > > is added? > > > > > > Henk > > > > On 30/04/15 18:44, "Bill Burke" <bburke(a)redhat.com > <mailto:bburke@redhat.com>> wrote: > > > >> Ok, I was able to get this to work. The problem was I had to set a > >> "profile" for the connected app on Salesforce. I added a "System > >> Adminstrator" profile to the Connected App and it worked. > >> > >> I'm not sure how to upload a app certificate yet. Not sure what format > >> Salesforce is looking for. > >> > >> On 4/30/2015 11:39 AM, Bill Burke wrote: > >>> I set up a salesforce example and looked at the login response SAML > >>> document. Looks like no assertion data is being sent back at all by > >>> salesforce. > >>> > >>> On 4/30/2015 9:43 AM, Bill Burke wrote: > >>>> i have no idea. Basically this error is stating that the login > >>>> response > >>>> saml document has no assertions within it. If there are no > assertions, > >>>> then there has been no identity data sent. > >>>> > >>>> I'm looking now, but can you send me a link on how to set up > Salesforce > >>>> as an IDP? Is one able to set up a free account and such? > >>>> > >>>> On 4/30/2015 9:25 AM, Henk Laracker wrote: > >>>>> Hi Bill, > >>>>> > >>>>> I don¹t know why I missed that, thanks! Salesforce respons know with > >>>>> the > >>>>> correct login page. After logging in in Salesforce, I¹m redirected to > >>>>> keycloak again with a internal error: > >>>>> > >>>>> Caused by: org.keycloak.broker.provider.IdentityBrokerException: > >>>>> Could not > >>>>> process response from SAML identity provider. > >>>>> at > >>>>> > >>>>> > org.keycloak.broker.saml.SAMLEndpoint$Binding.handleLoginResponse(SAMLE > >>>>> ndpo > >>>>> int.java:299) > >>>>> at > >>>>> > >>>>> > org.keycloak.broker.saml.SAMLEndpoint$Binding.handleSamlResponse(SAMLEn > >>>>> dpoi > >>>>> nt.java:343) > >>>>> at > >>>>> > >>>>> > org.keycloak.broker.saml.SAMLEndpoint$Binding.execute(SAMLEndpoint.java > >>>>> :169 > >>>>> ) > >>>>> at > >>>>> > >>>>> > org.keycloak.broker.saml.SAMLEndpoint.postBinding(SAMLEndpoint.java:117 > >>>>> ) > >>>>> at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) > >>>>> [rt.jar:1.8.0_45] > >>>>> at > >>>>> > >>>>> > sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.ja > >>>>> va:6 > >>>>> 2) [rt.jar:1.8.0_45] > >>>>> at > >>>>> > >>>>> > sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccesso > >>>>> rImp > >>>>> l.java:43) [rt.jar:1.8.0_45] > >>>>> at java.lang.reflect.Method.invoke(Method.java:497) > [rt.jar:1.8.0_45] > >>>>> at > >>>>> > >>>>> > org.jboss.resteasy.core.MethodInjectorImpl.invoke(MethodInjectorImpl.ja > >>>>> va:1 > >>>>> 37) [resteasy-jaxrs-3.0.10.Final.jar:] > >>>>> at > >>>>> > >>>>> > org.jboss.resteasy.core.ResourceMethodInvoker.invokeOnTarget(ResourceMe > >>>>> thod > >>>>> Invoker.java:296) [resteasy-jaxrs-3.0.10.Final.jar:] > >>>>> at > >>>>> > >>>>> > org.jboss.resteasy.core.ResourceMethodInvoker.invoke(ResourceMethodInvo > >>>>> ker. > >>>>> java:250) [resteasy-jaxrs-3.0.10.Final.jar:] > >>>>> at > >>>>> > >>>>> > org.jboss.resteasy.core.ResourceLocatorInvoker.invokeOnTargetObject(Res > >>>>> ourc > >>>>> eLocatorInvoker.java:140) [resteasy-jaxrs-3.0.10.Final.jar:] > >>>>> at > >>>>> > >>>>> > org.jboss.resteasy.core.ResourceLocatorInvoker.invoke(ResourceLocatorIn > >>>>> voke > >>>>> r.java:109) [resteasy-jaxrs-3.0.10.Final.jar:] > >>>>> at > >>>>> > >>>>> > org.jboss.resteasy.core.ResourceLocatorInvoker.invokeOnTargetObject(Res > >>>>> ourc > >>>>> eLocatorInvoker.java:135) [resteasy-jaxrs-3.0.10.Final.jar:] > >>>>> at > >>>>> > >>>>> > org.jboss.resteasy.core.ResourceLocatorInvoker.invoke(ResourceLocatorIn > >>>>> voke > >>>>> r.java:103) [resteasy-jaxrs-3.0.10.Final.jar:] > >>>>> at > >>>>> > >>>>> > org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatc > >>>>> her. > >>>>> java:356) [resteasy-jaxrs-3.0.10.Final.jar:] > >>>>> ... 39 more > >>>>> Caused by: org.keycloak.broker.provider.IdentityBrokerException: No > >>>>> assertion from response. > >>>>> at > >>>>> > >>>>> > org.keycloak.broker.saml.SAMLEndpoint$Binding.getAssertion(SAMLEndpoint > >>>>> .jav > >>>>> a:309) > >>>>> at > >>>>> > >>>>> > org.keycloak.broker.saml.SAMLEndpoint$Binding.handleLoginResponse(SAMLE > >>>>> ndpo > >>>>> int.java:264) > >>>>> ... 54 more > >>>>> > >>>>> Any idea? > >>>>> > >>>>> Henk > >>>>> > >>>>> > >>>>> > >>>>> > >>>>> On 30/04/15 14:31, "Bill Burke" <bburke(a)redhat.com > <mailto:bburke@redhat.com>> wrote: > >>>>> > >>>>>> You want to chain keycloak server to Salesforce? > >>>>>> > >>>>>> If you create a SAMLv2 IdentityProvider in keycloak that points to > >>>>>> Salesforce, you;ll see after you create it, an Export button. Click > >>>>>> that. That will create an entity descriptor with all the > information > >>>>>> you need. > >>>>>> > >>>>>> On 4/30/2015 2:45 AM, Henk Laracker wrote: > >>>>>>> Hi, > >>>>>>> > >>>>>>> I like to use Salesforce as Identity Provider, the metadata > >>>>>>> provided by > >>>>>>> salesforce can be imported. > >>>>>>> But I need to specify the Service Provider in salesforce, I have to > >>>>>>> fill > >>>>>>> in a couple of fields, but two of them I don¹t understand (and are > >>>>>>> mandatory). Does someone have any clue > >>>>>>> > >>>>>>> 1. entity id , remark of salesforce : get this value from your > >>>>>>> serviceprovider > >>>>>>> 2. ACS URL, remark of slaesforce : The assertion consumer > >>>>>>> service. Get > >>>>>>> this value from your service provider. > >>>>>>> > >>>>>>> I have tried a lot of values but every-time I click the saml button > >>>>>>> on > >>>>>>> my app, it redirects to salesforce but I get a page with the > error : > >>>>>>> Error: Unable to resolve request into a Service Provider > >>>>>>> > >>>>>>> Henk > >>>>>>> > >>>>>>> > >>>>>>> _______________________________________________ > >>>>>>> keycloak-user mailing list > >>>>>>> keycloak-user(a)lists.jboss.org > <mailto:keycloak-user@lists.jboss.org> > >>>>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user > >>>>>>> > >>>>>> > >>>>>> -- > >>>>>> Bill Burke > >>>>>> JBoss, a division of Red Hat > >>>>>> http://bill.burkecentral.com <http://bill.burkecentral.com/> > > > > >>>>>> _______________________________________________ > >>>>>> keycloak-user mailing list > >>>>>> keycloak-user(a)lists.jboss.org <mailto:keycloak-user@lists.jboss.org> > >>>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user > >>>>> > >>>> > >>> > >> > >> -- > >> Bill Burke > >> JBoss, a division of Red Hat > >> http://bill.burkecentral.com <http://bill.burkecentral.com/> > >> _______________________________________________ > >> keycloak-user mailing list > >> keycloak-user(a)lists.jboss.org <mailto:keycloak-user@lists.jboss.org> > >> https://lists.jboss.org/mailman/listinfo/keycloak-user > > > > -- > Bill Burke > JBoss, a division of Red Hat > http://bill.burkecentral.com <http://bill.burkecentral.com/> > _______________________________________________ > keycloak-user mailing list > keycloak-user(a)lists.jboss.org <mailto:keycloak-user@lists.jboss.org> > https://lists.jboss.org/mailman/listinfo/keycloak-user > >

I set up a salesforce example and looked at the login response SAML document. Looks like no assertion data is being sent back at all by salesforce. On 4/30/2015 9:43 AM, Bill Burke wrote: > i have no idea. Basically this error is stating that the login response > saml document has no assertions within it. If there are no assertions, > then there has been no identity data sent. > > I'm looking now, but can you send me a link on how to set up Salesforce > as an IDP? Is one able to set up a free account and such? > > On 4/30/2015 9:25 AM, Henk Laracker wrote: >> Hi Bill, >> >> I don¹t know why I missed that, thanks! Salesforce respons know with the >> correct login page. After logging in in Salesforce, I¹m redirected to >> keycloak again with a internal error: >> >> Caused by: org.keycloak.broker.provider.IdentityBrokerException: Could not >> process response from SAML identity provider. >> at >> org.keycloak.broker.saml.SAMLEndpoint$Binding.handleLoginResponse(SAMLEndpo >> int.java:299) >> at >> org.keycloak.broker.saml.SAMLEndpoint$Binding.handleSamlResponse(SAMLEndpoi >> nt.java:343) >> at >> org.keycloak.broker.saml.SAMLEndpoint$Binding.execute(SAMLEndpoint.java:169 >> ) >> at >> org.keycloak.broker.saml.SAMLEndpoint.postBinding(SAMLEndpoint.java:117) >> at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) >> [rt.jar:1.8.0_45] >> at >> sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:6 >> 2) [rt.jar:1.8.0_45] >> at >> sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImp >> l.java:43) [rt.jar:1.8.0_45] >> at java.lang.reflect.Method.invoke(Method.java:497) [rt.jar:1.8.0_45] >> at >> org.jboss.resteasy.core.MethodInjectorImpl.invoke(MethodInjectorImpl.java:1 >> 37) [resteasy-jaxrs-3.0.10.Final.jar:] >> at >> org.jboss.resteasy.core.ResourceMethodInvoker.invokeOnTarget(ResourceMethod >> Invoker.java:296) [resteasy-jaxrs-3.0.10.Final.jar:] >> at >> org.jboss.resteasy.core.ResourceMethodInvoker.invoke(ResourceMethodInvoker. >> java:250) [resteasy-jaxrs-3.0.10.Final.jar:] >> at >> org.jboss.resteasy.core.ResourceLocatorInvoker.invokeOnTargetObject(Resourc >> eLocatorInvoker.java:140) [resteasy-jaxrs-3.0.10.Final.jar:] >> at >> org.jboss.resteasy.core.ResourceLocatorInvoker.invoke(ResourceLocatorInvoke >> r.java:109) [resteasy-jaxrs-3.0.10.Final.jar:] >> at >> org.jboss.resteasy.core.ResourceLocatorInvoker.invokeOnTargetObject(Resourc >> eLocatorInvoker.java:135) [resteasy-jaxrs-3.0.10.Final.jar:] >> at >> org.jboss.resteasy.core.ResourceLocatorInvoker.invoke(ResourceLocatorInvoke >> r.java:103) [resteasy-jaxrs-3.0.10.Final.jar:] >> at >> org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher. >> java:356) [resteasy-jaxrs-3.0.10.Final.jar:] >> ... 39 more >> Caused by: org.keycloak.broker.provider.IdentityBrokerException: No >> assertion from response. >> at >> org.keycloak.broker.saml.SAMLEndpoint$Binding.getAssertion(SAMLEndpoint.jav >> a:309) >> at >> org.keycloak.broker.saml.SAMLEndpoint$Binding.handleLoginResponse(SAMLEndpo >> int.java:264) >> ... 54 more >> >> Any idea? >> >> Henk >> >> >> >> >> On 30/04/15 14:31, "Bill Burke" <bburke(a)redhat.com&gt; wrote: >> >>> You want to chain keycloak server to Salesforce? >>> >>> If you create a SAMLv2 IdentityProvider in keycloak that points to >>> Salesforce, you;ll see after you create it, an Export button. Click >>> that. That will create an entity descriptor with all the information >>> you need. >>> >>> On 4/30/2015 2:45 AM, Henk Laracker wrote: >>>> Hi, >>>> >>>> I like to use Salesforce as Identity Provider, the metadata provided by >>>> salesforce can be imported. >>>> But I need to specify the Service Provider in salesforce, I have to fill >>>> in a couple of fields, but two of them I don¹t understand (and are >>>> mandatory). Does someone have any clue >>>> >>>> 1. entity id , remark of salesforce : get this value from your >>>> serviceprovider >>>> 2. ACS URL, remark of slaesforce : The assertion consumer service. Get >>>> this value from your service provider. >>>> >>>> I have tried a lot of values but every-time I click the saml button on >>>> my app, it redirects to salesforce but I get a page with the error : >>>> Error: Unable to resolve request into a Service Provider >>>> >>>> Henk >>>> >>>> >>>> _______________________________________________ >>>> keycloak-user mailing list >>>> keycloak-user(a)lists.jboss.org >>>> https://lists.jboss.org/mailman/listinfo/keycloak-user >>>> >>> -- >>> Bill Burke >>> JBoss, a division of Red Hat >>> http://bill.burkecentral.com >>> _______________________________________________ >>> keycloak-user mailing list >>> keycloak-user(a)lists.jboss.org >>> https://lists.jboss.org/mailman/listinfo/keycloak-user

Hey, do you know if Salesforce as an SP works if the IDP is localhost? Or did you have to test that outside a firewall? On 5/4/2015 3:03 AM, Marek Posolda wrote: > As far as I remember, it could be the certificate in CRT format exported > from keystore file via "keytool -export" . At least that's what worked > for me couple of years back when I did integration of Salesforce with > Picketlink: > https://docs.jboss.org/author/display/PLINK/Picketlink+as+IDP,+Salesforce... > > > > Marek > > On 30.4.2015 17:39, Bill Burke wrote: >> I set up a salesforce example and looked at the login response SAML >> document. Looks like no assertion data is being sent back at all by >> salesforce. >> >> On 4/30/2015 9:43 AM, Bill Burke wrote: >>> i have no idea. Basically this error is stating that the login >>> response >>> saml document has no assertions within it. If there are no >>> assertions, >>> then there has been no identity data sent. >>> >>> I'm looking now, but can you send me a link on how to set up >>> Salesforce >>> as an IDP? Is one able to set up a free account and such? >>> >>> On 4/30/2015 9:25 AM, Henk Laracker wrote: >>>> Hi Bill, >>>> >>>> I don¹t know why I missed that, thanks! Salesforce respons know with >>>> the >>>> correct login page. After logging in in Salesforce, I¹m redirected to >>>> keycloak again with a internal error: >>>> >>>> Caused by: org.keycloak.broker.provider.IdentityBrokerException: >>>> Could not >>>> process response from SAML identity provider. >>>> at >>>> org.keycloak.broker.saml.SAMLEndpoint$Binding.handleLoginResponse(SAMLEndpo >>>> >>>> >>>> int.java:299) >>>> at >>>> org.keycloak.broker.saml.SAMLEndpoint$Binding.handleSamlResponse(SAMLEndpoi >>>> >>>> >>>> nt.java:343) >>>> at >>>> org.keycloak.broker.saml.SAMLEndpoint$Binding.execute(SAMLEndpoint.java:169 >>>> >>>> >>>> ) >>>> at >>>> org.keycloak.broker.saml.SAMLEndpoint.postBinding(SAMLEndpoint.java:117) >>>> >>>> >>>> at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) >>>> [rt.jar:1.8.0_45] >>>> at >>>> sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:6 >>>> >>>> >>>> 2) [rt.jar:1.8.0_45] >>>> at >>>> sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImp >>>> >>>> >>>> l.java:43) [rt.jar:1.8.0_45] >>>> at java.lang.reflect.Method.invoke(Method.java:497) >>>> [rt.jar:1.8.0_45] >>>> at >>>> org.jboss.resteasy.core.MethodInjectorImpl.invoke(MethodInjectorImpl.java:1 >>>> >>>> >>>> 37) [resteasy-jaxrs-3.0.10.Final.jar:] >>>> at >>>> org.jboss.resteasy.core.ResourceMethodInvoker.invokeOnTarget(ResourceMethod >>>> >>>> >>>> Invoker.java:296) [resteasy-jaxrs-3.0.10.Final.jar:] >>>> at >>>> org.jboss.resteasy.core.ResourceMethodInvoker.invoke(ResourceMethodInvoker. >>>> >>>> >>>> java:250) [resteasy-jaxrs-3.0.10.Final.jar:] >>>> at >>>> org.jboss.resteasy.core.ResourceLocatorInvoker.invokeOnTargetObject(Resourc >>>> >>>> >>>> eLocatorInvoker.java:140) [resteasy-jaxrs-3.0.10.Final.jar:] >>>> at >>>> org.jboss.resteasy.core.ResourceLocatorInvoker.invoke(ResourceLocatorInvoke >>>> >>>> >>>> r.java:109) [resteasy-jaxrs-3.0.10.Final.jar:] >>>> at >>>> org.jboss.resteasy.core.ResourceLocatorInvoker.invokeOnTargetObject(Resourc >>>> >>>> >>>> eLocatorInvoker.java:135) [resteasy-jaxrs-3.0.10.Final.jar:] >>>> at >>>> org.jboss.resteasy.core.ResourceLocatorInvoker.invoke(ResourceLocatorInvoke >>>> >>>> >>>> r.java:103) [resteasy-jaxrs-3.0.10.Final.jar:] >>>> at >>>> org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher. >>>> >>>> >>>> java:356) [resteasy-jaxrs-3.0.10.Final.jar:] >>>> ... 39 more >>>> Caused by: org.keycloak.broker.provider.IdentityBrokerException: No >>>> assertion from response. >>>> at >>>> org.keycloak.broker.saml.SAMLEndpoint$Binding.getAssertion(SAMLEndpoint.jav >>>> >>>> >>>> a:309) >>>> at >>>> org.keycloak.broker.saml.SAMLEndpoint$Binding.handleLoginResponse(SAMLEndpo >>>> >>>> >>>> int.java:264) >>>> ... 54 more >>>> >>>> Any idea? >>>> >>>> Henk >>>> >>>> >>>> >>>> >>>> On 30/04/15 14:31, "Bill Burke" <bburke(a)redhat.com&gt; wrote: >>>> >>>>> You want to chain keycloak server to Salesforce? >>>>> >>>>> If you create a SAMLv2 IdentityProvider in keycloak that points to >>>>> Salesforce, you;ll see after you create it, an Export button. Click >>>>> that. That will create an entity descriptor with all the >>>>> information >>>>> you need. >>>>> >>>>> On 4/30/2015 2:45 AM, Henk Laracker wrote: >>>>>> Hi, >>>>>> >>>>>> I like to use Salesforce as Identity Provider, the metadata >>>>>> provided by >>>>>> salesforce can be imported. >>>>>> But I need to specify the Service Provider in salesforce, I have >>>>>> to fill >>>>>> in a couple of fields, but two of them I don¹t understand (and are >>>>>> mandatory). Does someone have any clue >>>>>> >>>>>> 1. entity id , remark of salesforce : get this value from your >>>>>> serviceprovider >>>>>> 2. ACS URL, remark of slaesforce : The assertion consumer >>>>>> service. Get >>>>>> this value from your service provider. >>>>>> >>>>>> I have tried a lot of values but every-time I click the saml >>>>>> button on >>>>>> my app, it redirects to salesforce but I get a page with the >>>>>> error : >>>>>> Error: Unable to resolve request into a Service Provider >>>>>> >>>>>> Henk >>>>>> >>>>>> >>>>>> _______________________________________________ >>>>>> keycloak-user mailing list >>>>>> keycloak-user(a)lists.jboss.org >>>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user >>>>>> >>>>> -- >>>>> Bill Burke >>>>> JBoss, a division of Red Hat >>>>> http://bill.burkecentral.com >>>>> _______________________________________________ >>>>> keycloak-user mailing list >>>>> keycloak-user(a)lists.jboss.org >>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user >

I'll add a username mapper. On 5/1/2015 8:48 AM, Bill Burke wrote: > You can map the SAML/OIDC assertion/token that is sent to your > applications however you want. > > On 4/30/2015 9:23 PM, Raghu Prabhala wrote: >> Bill - That would be an issue for us as we cannot manipulate the values >> (especially username) sent by an external IDP which is the >>authoritative >> source of user information. We will have to figure out another way, >> perhaps, an internal KC user attribute that can be made unique to >> prevent name clashes. >> >> Thanks, >> Raghu >> >>------------------------------------------------------------------------ >> *From:* Bill Burke <bburke(a)redhat.com&gt; >> *To:* Henk Laracker <Henk.Laracker(a)planonsoftware.com>; >> &quot;keycloak-user(a)lists.jboss.org&quot; <keycloak-user(a)lists.jboss.org&gt; >> *Sent:* Thursday, April 30, 2015 7:26 PM >> *Subject:* Re: [keycloak-user] IDP SAMLV2.0 with Salesforce >> >> Right now, the username is prefixed with the broker name. THis is to >> avoid name clashes if you are brokering multiple IDPS (i.e. multiple >> social providers). >> >> On 4/30/2015 2:51 PM, Henk Laracker wrote: >> > Hi Bill, >> > >> > Thank you this worked out! I user is created with my name >> > saml.henk.laracker@p <mailto:saml.henk.laracker@p>***n.nl , do you >> have any idee why the “saml” prefix >> > is added? >> > >> > >> > Henk >> > >> > On 30/04/15 18:44, "Bill Burke" <bburke(a)redhat.com >> <mailto:bburke@redhat.com>> wrote: >> > >> >> Ok, I was able to get this to work. The problem was I had to set >>a >> >> "profile" for the connected app on Salesforce. I added a "System >> >> Adminstrator" profile to the Connected App and it worked. >> >> >> >> I'm not sure how to upload a app certificate yet. Not sure what >>format >> >> Salesforce is looking for. >> >> >> >> On 4/30/2015 11:39 AM, Bill Burke wrote: >> >>> I set up a salesforce example and looked at the login response >>SAML >> >>> document. Looks like no assertion data is being sent back at >>all by >> >>> salesforce. >> >>> >> >>> On 4/30/2015 9:43 AM, Bill Burke wrote: >> >>>> i have no idea. Basically this error is stating that the login >> >>>> response >> >>>> saml document has no assertions within it. If there are no >> assertions, >> >>>> then there has been no identity data sent. >> >>>> >> >>>> I'm looking now, but can you send me a link on how to set up >> Salesforce >> >>>> as an IDP? Is one able to set up a free account and such? >> >>>> >> >>>> On 4/30/2015 9:25 AM, Henk Laracker wrote: >> >>>>> Hi Bill, >> >>>>> >> >>>>> I don¹t know why I missed that, thanks! Salesforce respons >>know with >> >>>>> the >> >>>>> correct login page. After logging in in Salesforce, I¹m >>redirected to >> >>>>> keycloak again with a internal error: >> >>>>> >> >>>>> Caused by: >>org.keycloak.broker.provider.IdentityBrokerException: >> >>>>> Could not >> >>>>> process response from SAML identity provider. >> >>>>> at >> >>>>> >> >>>>> >> org.keycloak.broker.saml.SAMLEndpoint$Binding.handleLoginResponse(SAMLE >> >>>>> ndpo >> >>>>> int.java:299) >> >>>>> at >> >>>>> >> >>>>> >> org.keycloak.broker.saml.SAMLEndpoint$Binding.handleSamlResponse(SAMLEn >> >>>>> dpoi >> >>>>> nt.java:343) >> >>>>> at >> >>>>> >> >>>>> >> org.keycloak.broker.saml.SAMLEndpoint$Binding.execute(SAMLEndpoint.java >> >>>>> :169 >> >>>>> ) >> >>>>> at >> >>>>> >> >>>>> >> org.keycloak.broker.saml.SAMLEndpoint.postBinding(SAMLEndpoint.java:117 >> >>>>> ) >> >>>>> at sun.reflect.NativeMethodAccessorImpl.invoke0(Native >>Method) >> >>>>> [rt.jar:1.8.0_45] >> >>>>> at >> >>>>> >> >>>>> >> sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.ja >> >>>>> va:6 >> >>>>> 2) [rt.jar:1.8.0_45] >> >>>>> at >> >>>>> >> >>>>> >> sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccesso >> >>>>> rImp >> >>>>> l.java:43) [rt.jar:1.8.0_45] >> >>>>> at java.lang.reflect.Method.invoke(Method.java:497) >> [rt.jar:1.8.0_45] >> >>>>> at >> >>>>> >> >>>>> >> org.jboss.resteasy.core.MethodInjectorImpl.invoke(MethodInjectorImpl.ja >> >>>>> va:1 >> >>>>> 37) [resteasy-jaxrs-3.0.10.Final.jar:] >> >>>>> at >> >>>>> >> >>>>> >> org.jboss.resteasy.core.ResourceMethodInvoker.invokeOnTarget(ResourceMe >> >>>>> thod >> >>>>> Invoker.java:296) [resteasy-jaxrs-3.0.10.Final.jar:] >> >>>>> at >> >>>>> >> >>>>> >> org.jboss.resteasy.core.ResourceMethodInvoker.invoke(ResourceMethodInvo >> >>>>> ker. >> >>>>> java:250) [resteasy-jaxrs-3.0.10.Final.jar:] >> >>>>> at >> >>>>> >> >>>>> >> org.jboss.resteasy.core.ResourceLocatorInvoker.invokeOnTargetObject(Res >> >>>>> ourc >> >>>>> eLocatorInvoker.java:140) [resteasy-jaxrs-3.0.10.Final.jar:] >> >>>>> at >> >>>>> >> >>>>> >> org.jboss.resteasy.core.ResourceLocatorInvoker.invoke(ResourceLocatorIn >> >>>>> voke >> >>>>> r.java:109) [resteasy-jaxrs-3.0.10.Final.jar:] >> >>>>> at >> >>>>> >> >>>>> >> org.jboss.resteasy.core.ResourceLocatorInvoker.invokeOnTargetObject(Res >> >>>>> ourc >> >>>>> eLocatorInvoker.java:135) [resteasy-jaxrs-3.0.10.Final.jar:] >> >>>>> at >> >>>>> >> >>>>> >> org.jboss.resteasy.core.ResourceLocatorInvoker.invoke(ResourceLocatorIn >> >>>>> voke >> >>>>> r.java:103) [resteasy-jaxrs-3.0.10.Final.jar:] >> >>>>> at >> >>>>> >> >>>>> >> org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatc >> >>>>> her. >> >>>>> java:356) [resteasy-jaxrs-3.0.10.Final.jar:] >> >>>>> ... 39 more >> >>>>> Caused by: >>org.keycloak.broker.provider.IdentityBrokerException: No >> >>>>> assertion from response. >> >>>>> at >> >>>>> >> >>>>> >> org.keycloak.broker.saml.SAMLEndpoint$Binding.getAssertion(SAMLEndpoint >> >>>>> .jav >> >>>>> a:309) >> >>>>> at >> >>>>> >> >>>>> >> org.keycloak.broker.saml.SAMLEndpoint$Binding.handleLoginResponse(SAMLE >> >>>>> ndpo >> >>>>> int.java:264) >> >>>>> ... 54 more >> >>>>> >> >>>>> Any idea? >> >>>>> >> >>>>> Henk >> >>>>> >> >>>>> >> >>>>> >> >>>>> >> >>>>> On 30/04/15 14:31, "Bill Burke" <bburke(a)redhat.com >> <mailto:bburke@redhat.com>> wrote: >> >>>>> >> >>>>>> You want to chain keycloak server to Salesforce? >> >>>>>> >> >>>>>> If you create a SAMLv2 IdentityProvider in keycloak that >>points to >> >>>>>> Salesforce, you;ll see after you create it, an Export button. >> Click >> >>>>>> that. That will create an entity descriptor with all the >> information >> >>>>>> you need. >> >>>>>> >> >>>>>> On 4/30/2015 2:45 AM, Henk Laracker wrote: >> >>>>>>> Hi, >> >>>>>>> >> >>>>>>> I like to use Salesforce as Identity Provider, the metadata >> >>>>>>> provided by >> >>>>>>> salesforce can be imported. >> >>>>>>> But I need to specify the Service Provider in salesforce, I >>have to >> >>>>>>> fill >> >>>>>>> in a couple of fields, but two of them I don¹t understand >>(and are >> >>>>>>> mandatory). Does someone have any clue >> >>>>>>> >> >>>>>>> 1. entity id , remark of salesforce : get this value >>from your >> >>>>>>> serviceprovider >> >>>>>>> 2. ACS URL, remark of slaesforce : The assertion >>consumer >> >>>>>>> service. Get >> >>>>>>> this value from your service provider. >> >>>>>>> >> >>>>>>> I have tried a lot of values but every-time I click the saml >>button >> >>>>>>> on >> >>>>>>> my app, it redirects to salesforce but I get a page with the >> error : >> >>>>>>> Error: Unable to resolve request into a Service Provider >> >>>>>>> >> >>>>>>> Henk >> >>>>>>> >> >>>>>>> >> >>>>>>> _______________________________________________ >> >>>>>>> keycloak-user mailing list >> >>>>>>> keycloak-user(a)lists.jboss.org >> <mailto:keycloak-user@lists.jboss.org> >> >>>>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user >> >>>>>>> >> >>>>>> >> >>>>>> -- >> >>>>>> Bill Burke >> >>>>>> JBoss, a division of Red Hat >> >>>>>> http://bill.burkecentral.com <http://bill.burkecentral.com/> >> >> >> >> >>>>>> _______________________________________________ >> >>>>>> keycloak-user mailing list >> >>>>>> keycloak-user(a)lists.jboss.org >><mailto:keycloak-user@lists.jboss.org> >> >>>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user >> >>>>> >> >>>> >> >>> >> >> >> >> -- >> >> Bill Burke >> >> JBoss, a division of Red Hat >> >> http://bill.burkecentral.com <http://bill.burkecentral.com/> >> >> _______________________________________________ >> >> keycloak-user mailing list >> >> keycloak-user(a)lists.jboss.org >><mailto:keycloak-user@lists.jboss.org> >> >> https://lists.jboss.org/mailman/listinfo/keycloak-user >> > >> >> -- >> Bill Burke >> JBoss, a division of Red Hat >> http://bill.burkecentral.com <http://bill.burkecentral.com/> >> _______________________________________________ >> keycloak-user mailing list >> keycloak-user(a)lists.jboss.org <mailto:keycloak-user@lists.jboss.org> >> https://lists.jboss.org/mailman/listinfo/keycloak-user >> >> > -- Bill Burke JBoss, a division of Red Hat http://bill.burkecentral.com _______________________________________________ keycloak-user mailing list keycloak-user(a)lists.jboss.org https://lists.jboss.org/mailman/listinfo/keycloak-user

Its in master, will be in next release. On 6/1/2015 3:06 PM, Henk Laracker wrote: > Hi Bill, > > Can you please help me out how I have to make a mapping so that I can > remove the prefix. > > Met vriendelijke groet / Yours sincerely / Mit freundlichen Grüßen / >Très > cordialement, > > Henk Laracker > > > > > On 01/05/15 14:52, "Bill Burke" <bburke(a)redhat.com&gt; wrote: > >> I'll add a username mapper. >> >> On 5/1/2015 8:48 AM, Bill Burke wrote: >>> You can map the SAML/OIDC assertion/token that is sent to your >>> applications however you want. >>> >>> On 4/30/2015 9:23 PM, Raghu Prabhala wrote: >>>> Bill - That would be an issue for us as we cannot manipulate the >>>>values >>>> (especially username) sent by an external IDP which is the >>>> authoritative >>>> source of user information. We will have to figure out another way, >>>> perhaps, an internal KC user attribute that can be made unique to >>>> prevent name clashes. >>>> >>>> Thanks, >>>> Raghu >>>> >>>> >>>>---------------------------------------------------------------------- >>>>-- >>>> *From:* Bill Burke <bburke(a)redhat.com&gt; >>>> *To:* Henk Laracker <Henk.Laracker(a)planonsoftware.com>; >>>> &quot;keycloak-user(a)lists.jboss.org&quot; <keycloak-user(a)lists.jboss.org&gt; >>>> *Sent:* Thursday, April 30, 2015 7:26 PM >>>> *Subject:* Re: [keycloak-user] IDP SAMLV2.0 with Salesforce >>>> >>>> Right now, the username is prefixed with the broker name. THis is to >>>> avoid name clashes if you are brokering multiple IDPS (i.e. multiple >>>> social providers). >>>> >>>> On 4/30/2015 2:51 PM, Henk Laracker wrote: >>>> > Hi Bill, >>>> > >>>> > Thank you this worked out! I user is created with my name >>>> > saml.henk.laracker@p <mailto:saml.henk.laracker@p>***n.nl , do >>>>you >>>> have any idee why the “saml” prefix >>>> > is added? >>>> > >>>> > >>>> > Henk >>>> > >>>> > On 30/04/15 18:44, "Bill Burke" <bburke(a)redhat.com >>>> <mailto:bburke@redhat.com>> wrote: >>>> > >>>> >> Ok, I was able to get this to work. The problem was I had to >>>>set >>>> a >>>> >> "profile" for the connected app on Salesforce. I added a >>>>"System >>>> >> Adminstrator" profile to the Connected App and it worked. >>>> >> >>>> >> I'm not sure how to upload a app certificate yet. Not sure >>>>what >>>> format >>>> >> Salesforce is looking for. >>>> >> >>>> >> On 4/30/2015 11:39 AM, Bill Burke wrote: >>>> >>> I set up a salesforce example and looked at the login response >>>> SAML >>>> >>> document. Looks like no assertion data is being sent back at >>>> all by >>>> >>> salesforce. >>>> >>> >>>> >>> On 4/30/2015 9:43 AM, Bill Burke wrote: >>>> >>>> i have no idea. Basically this error is stating that the >>>>login >>>> >>>> response >>>> >>>> saml document has no assertions within it. If there are no >>>> assertions, >>>> >>>> then there has been no identity data sent. >>>> >>>> >>>> >>>> I'm looking now, but can you send me a link on how to set up >>>> Salesforce >>>> >>>> as an IDP? Is one able to set up a free account and such? >>>> >>>> >>>> >>>> On 4/30/2015 9:25 AM, Henk Laracker wrote: >>>> >>>>> Hi Bill, >>>> >>>>> >>>> >>>>> I don¹t know why I missed that, thanks! Salesforce respons >>>> know with >>>> >>>>> the >>>> >>>>> correct login page. After logging in in Salesforce, I¹m >>>> redirected to >>>> >>>>> keycloak again with a internal error: >>>> >>>>> >>>> >>>>> Caused by: >>>> org.keycloak.broker.provider.IdentityBrokerException: >>>> >>>>> Could not >>>> >>>>> process response from SAML identity provider. >>>> >>>>> at >>>> >>>>> >>>> >>>>> >>>> >>>>org.keycloak.broker.saml.SAMLEndpoint$Binding.handleLoginResponse(SAML >>>>E >>>> >>>>> ndpo >>>> >>>>> int.java:299) >>>> >>>>> at >>>> >>>>> >>>> >>>>> >>>> >>>>org.keycloak.broker.saml.SAMLEndpoint$Binding.handleSamlResponse(SAMLE >>>>n >>>> >>>>> dpoi >>>> >>>>> nt.java:343) >>>> >>>>> at >>>> >>>>> >>>> >>>>> >>>> >>>>org.keycloak.broker.saml.SAMLEndpoint$Binding.execute(SAMLEndpoint.jav >>>>a >>>> >>>>> :169 >>>> >>>>> ) >>>> >>>>> at >>>> >>>>> >>>> >>>>> >>>> >>>>org.keycloak.broker.saml.SAMLEndpoint.postBinding(SAMLEndpoint.java:11 >>>>7 >>>> >>>>> ) >>>> >>>>> at sun.reflect.NativeMethodAccessorImpl.invoke0(Native >>>> Method) >>>> >>>>> [rt.jar:1.8.0_45] >>>> >>>>> at >>>> >>>>> >>>> >>>>> >>>> >>>>sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.j >>>>a >>>> >>>>> va:6 >>>> >>>>> 2) [rt.jar:1.8.0_45] >>>> >>>>> at >>>> >>>>> >>>> >>>>> >>>> >>>>sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccess >>>>o >>>> >>>>> rImp >>>> >>>>> l.java:43) [rt.jar:1.8.0_45] >>>> >>>>> at java.lang.reflect.Method.invoke(Method.java:497) >>>> [rt.jar:1.8.0_45] >>>> >>>>> at >>>> >>>>> >>>> >>>>> >>>> >>>>org.jboss.resteasy.core.MethodInjectorImpl.invoke(MethodInjectorImpl.j >>>>a >>>> >>>>> va:1 >>>> >>>>> 37) [resteasy-jaxrs-3.0.10.Final.jar:] >>>> >>>>> at >>>> >>>>> >>>> >>>>> >>>> >>>>org.jboss.resteasy.core.ResourceMethodInvoker.invokeOnTarget(ResourceM >>>>e >>>> >>>>> thod >>>> >>>>> Invoker.java:296) [resteasy-jaxrs-3.0.10.Final.jar:] >>>> >>>>> at >>>> >>>>> >>>> >>>>> >>>> >>>>org.jboss.resteasy.core.ResourceMethodInvoker.invoke(ResourceMethodInv >>>>o >>>> >>>>> ker. >>>> >>>>> java:250) [resteasy-jaxrs-3.0.10.Final.jar:] >>>> >>>>> at >>>> >>>>> >>>> >>>>> >>>> >>>>org.jboss.resteasy.core.ResourceLocatorInvoker.invokeOnTargetObject(Re >>>>s >>>> >>>>> ourc >>>> >>>>> eLocatorInvoker.java:140) [resteasy-jaxrs-3.0.10.Final.jar:] >>>> >>>>> at >>>> >>>>> >>>> >>>>> >>>> >>>>org.jboss.resteasy.core.ResourceLocatorInvoker.invoke(ResourceLocatorI >>>>n >>>> >>>>> voke >>>> >>>>> r.java:109) [resteasy-jaxrs-3.0.10.Final.jar:] >>>> >>>>> at >>>> >>>>> >>>> >>>>> >>>> >>>>org.jboss.resteasy.core.ResourceLocatorInvoker.invokeOnTargetObject(Re >>>>s >>>> >>>>> ourc >>>> >>>>> eLocatorInvoker.java:135) [resteasy-jaxrs-3.0.10.Final.jar:] >>>> >>>>> at >>>> >>>>> >>>> >>>>> >>>> >>>>org.jboss.resteasy.core.ResourceLocatorInvoker.invoke(ResourceLocatorI >>>>n >>>> >>>>> voke >>>> >>>>> r.java:103) [resteasy-jaxrs-3.0.10.Final.jar:] >>>> >>>>> at >>>> >>>>> >>>> >>>>> >>>> >>>>org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispat >>>>c >>>> >>>>> her. >>>> >>>>> java:356) [resteasy-jaxrs-3.0.10.Final.jar:] >>>> >>>>> ... 39 more >>>> >>>>> Caused by: >>>> org.keycloak.broker.provider.IdentityBrokerException: No >>>> >>>>> assertion from response. >>>> >>>>> at >>>> >>>>> >>>> >>>>> >>>> >>>>org.keycloak.broker.saml.SAMLEndpoint$Binding.getAssertion(SAMLEndpoin >>>>t >>>> >>>>> .jav >>>> >>>>> a:309) >>>> >>>>> at >>>> >>>>> >>>> >>>>> >>>> >>>>org.keycloak.broker.saml.SAMLEndpoint$Binding.handleLoginResponse(SAML >>>>E >>>> >>>>> ndpo >>>> >>>>> int.java:264) >>>> >>>>> ... 54 more >>>> >>>>> >>>> >>>>> Any idea? >>>> >>>>> >>>> >>>>> Henk >>>> >>>>> >>>> >>>>> >>>> >>>>> >>>> >>>>> >>>> >>>>> On 30/04/15 14:31, "Bill Burke" <bburke(a)redhat.com >>>> <mailto:bburke@redhat.com>> wrote: >>>> >>>>> >>>> >>>>>> You want to chain keycloak server to Salesforce? >>>> >>>>>> >>>> >>>>>> If you create a SAMLv2 IdentityProvider in keycloak that >>>> points to >>>> >>>>>> Salesforce, you;ll see after you create it, an Export >>>>button. >>>> Click >>>> >>>>>> that. That will create an entity descriptor with all the >>>> information >>>> >>>>>> you need. >>>> >>>>>> >>>> >>>>>> On 4/30/2015 2:45 AM, Henk Laracker wrote: >>>> >>>>>>> Hi, >>>> >>>>>>> >>>> >>>>>>> I like to use Salesforce as Identity Provider, the >>>>metadata >>>> >>>>>>> provided by >>>> >>>>>>> salesforce can be imported. >>>> >>>>>>> But I need to specify the Service Provider in salesforce, >>>>I >>>> have to >>>> >>>>>>> fill >>>> >>>>>>> in a couple of fields, but two of them I don¹t understand >>>> (and are >>>> >>>>>>> mandatory). Does someone have any clue >>>> >>>>>>> >>>> >>>>>>> 1. entity id , remark of salesforce : get this value >>> >from your >>>> >>>>>>> serviceprovider >>>> >>>>>>> 2. ACS URL, remark of slaesforce : The assertion >>>> consumer >>>> >>>>>>> service. Get >>>> >>>>>>> this value from your service provider. >>>> >>>>>>> >>>> >>>>>>> I have tried a lot of values but every-time I click the >>>>saml >>>> button >>>> >>>>>>> on >>>> >>>>>>> my app, it redirects to salesforce but I get a page with >>>>the >>>> error : >>>> >>>>>>> Error: Unable to resolve request into a Service Provider >>>> >>>>>>> >>>> >>>>>>> Henk >>>> >>>>>>> >>>> >>>>>>> >>>> >>>>>>> _______________________________________________ >>>> >>>>>>> keycloak-user mailing list >>>> >>>>>>> keycloak-user(a)lists.jboss.org >>>> <mailto:keycloak-user@lists.jboss.org> >>>> >>>>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user >>>> >>>>>>> >>>> >>>>>> >>>> >>>>>> -- >>>> >>>>>> Bill Burke >>>> >>>>>> JBoss, a division of Red Hat >>>> >>>>>> http://bill.burkecentral.com >>>><http://bill.burkecentral.com/> >>>> >>>> >>>> >>>> >>>>>> _______________________________________________ >>>> >>>>>> keycloak-user mailing list >>>> >>>>>> keycloak-user(a)lists.jboss.org >>>> <mailto:keycloak-user@lists.jboss.org> >>>> >>>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user >>>> >>>>> >>>> >>>> >>>> >>> >>>> >> >>>> >> -- >>>> >> Bill Burke >>>> >> JBoss, a division of Red Hat >>>> >> http://bill.burkecentral.com <http://bill.burkecentral.com/> >>>> >> _______________________________________________ >>>> >> keycloak-user mailing list >>>> >> keycloak-user(a)lists.jboss.org >>>> <mailto:keycloak-user@lists.jboss.org> >>>> >> https://lists.jboss.org/mailman/listinfo/keycloak-user >>>> > >>>> >>>> -- >>>> Bill Burke >>>> JBoss, a division of Red Hat >>>> http://bill.burkecentral.com <http://bill.burkecentral.com/> >>>> _______________________________________________ >>>> keycloak-user mailing list >>>> keycloak-user(a)lists.jboss.org <mailto:keycloak-user@lists.jboss.org> >>>> https://lists.jboss.org/mailman/listinfo/keycloak-user >>>> >>>> >>> >> >> -- >> Bill Burke >> JBoss, a division of Red Hat >> http://bill.burkecentral.com >> _______________________________________________ >> keycloak-user mailing list >> keycloak-user(a)lists.jboss.org >> https://lists.jboss.org/mailman/listinfo/keycloak-user > -- Bill Burke JBoss, a division of Red Hat http://bill.burkecentral.com