Hi, I am trying to work on SAML ECP profile. According to Keycloak's server administration documentation this SAML binding is supported. But when I configure IdP/SSO in metadata I am not seeing any description/meta specific to ECP binding. Any documentation available on how to use ECP profile in Keycloak? Also, while testing IdP initiated SSO/ SP initiated SSO,how can I inform Keycloak to use specific binding? Is there any query string parameter available that I can use?

Thanks John for your inputs. Will give it a try. On Fri, Feb 10, 2017 at 11:19 AM, John Dennis <jdennis(a)redhat.com&gt; wrote: > On 02/10/2017 12:59 PM, Jason B wrote: > >> Hi, >> >> I am trying to work on SAML ECP profile. According to Keycloak's server >> administration documentation this SAML binding is supported. But when I >> configure IdP/SSO in metadata I am not seeing any description/meta >> specific >> to ECP binding. Any documentation available on how to use ECP profile in >> Keycloak? >> >> Also, while testing IdP initiated SSO/ SP initiated SSO,how can I inform >> Keycloak to use specific binding? Is there any query string parameter >> available that I can use? >> > > ECP definitely works with Keycloak, we use all the time. > > You want to use the SOAP endpoint, e.g. > > <SingleSignOnService > Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" > Location="https:xxx/auth/realms/xxx/protocol/saml" > /> > > You may not see this endpoint in your IdP metadata depending on how you > obtained the metadata from Keycloak. It always appears if you use the > /auth/realms/{realm}/protocol/saml/descriptor REST endpoint. But if you > use the "Installation" on the client to get the IDPSSODescriptor it won't > appear unless you configure the client to use the endpoint (keycloak only > populates HTTP-POST using this method). IMHO this inconsistency is broken, > but Bill disagrees (the fact the OP couldn't find the SOAP endpoint to me > is further evidence a client specific view of the IdP metadata is not a > good idea). > > But back to the original question of how to use ECP with Keycloak. There > is very little you need to do in Keycloak. You only need to determine the > SOAP endpoint [1] and of course have the SP registered. Make sure PAOS > endpoint as it appears in the SP metadata is in the list of redirectURI's > for Keycloak's SP client. That's it. > > Most of the configuration occurs in the ECP client. The ECP client must > know the SP as well as the Keycloak SOAP endpoint. Currently Keycloak only > supports basic and digest HTTP authentication with ECP. > > [1] FWIW Keycloak uses the same endpoint for all bindings, however you > should not count on this, you should get the binding endpoint from the > metadata. > > -- > John >

On 02/10/2017 05:07 PM, Jason B wrote: > Quick question: Can keycloak act as ECP client? Or it need be some kind > of gateway/proxy server sitting in front of Service Provider > intercepting the requests going to service provider? I think you might be confused as to how ECP works. An ECP client sits *between* the SP and the IdP. An IdP such as Keycloak does not implement ECP, rather ECP is implemented in the ECP client. An IdP participates in an ECP flow by advertising a SingleSignOn SOAP binding protected by some form of HTTP authentication (typically basic and digest). The ECP client utilizes the IdP's SOAP binding. A good explanation of ECP and an example flow can be found in the SAML Technical overview in section 5.2: https://www.oasis-open.org/committees/download.php/27819/sstc-saml-tech-o... The ECP specification give all the gory details: http://docs.oasis-open.org/security/saml/Post2.0/saml-ecp/v2.0/saml-ecp-v...

Thank for the detailed response. I agree with you. Actually the requirement, I am trying to implement is IdP discovery services. I want to find out a correct realm for a user based on use's email address. Initially I thought it can be implemented using ECP profile but later realized it is not the solution I am looking for. Thinking of writing a UI service infront of keycloak to intercept the incoming AuthN request (SP SSO) to capture the user's email address to determine the correct realm IDP.