Ok, I must have fat fingered there at the end. Sorry. With that said, assuming that I want IDP initiated login, it seems like what I have to do is: - Create a SAML client in Keycloak for my application. - Follow the IDP initiated flow from https://keycloak.gitbooks.io/server-adminstration-guide/content/topics/cl... - Point my IDP to the endpoint that gets generated in here. As a result, it seems like I don't have to even create a SAML IDP in Keycloak, unless that somehow gets used for SP initiated. John On Wed, Feb 22, 2017 at 10:15 PM John D. Ament <john.d.ament(a)gmail.com <mailto:john.d.ament@gmail.com>> wrote: This is the part that's confusing me. What do you mean by a "URL somewhere that links to your app which will then redirect to keycloak"? Are you talking about triggering the inbound IDP initiated by first calling into my app? If I look at (Okta for instance) they actually have a portal-like site that users can leverage to directly link to their apps. The links generated here are doing IDP initiated SSO, by triggering SAML in the broker then the broker is expected to forward to the client (and mind you, I know very little about SAML, but this is how I'm seeing it behave in the browser). With that said, assum On Wed, Feb 22, 2017 at 9:50 PM Bill Burke <bburke(a)redhat.com <mailto:bburke@redhat.com>> wrote: OIDC/OAuth doesn't have an IDP initiated protocol. You'll have to create a URL somewhere that links to your app which will then redirect to Keycloak. On 2/22/17 8:23 PM, John D. Ament wrote: > Looks like I answered half of my question - > https://issues.jboss.org/browse/KEYCLOAK-4454 > > Seems like it will only work if I'm using SAML. > > John > > On Wed, Feb 22, 2017 at 5:18 PM John D. Ament <john.d.ament(a)gmail.com <mailto:john.d.ament@gmail.com>> > wrote: > >> Changing the subject to be a bit clearer about the problems. >> >> I think I'm understanding a bit further. when reading through >> https://keycloak.gitbooks.io/server-adminstration-guide/content/topics/cl... >> >> - It seems like my application has to be SAML. I cannot do an OIDC based >> solution. >> - First thing I have to do is add IDP Initiated SSO URL Name to my >> application. >> - The confusing part is about if my application requires... this seems a >> bit odd, since I'm using the Keycloak adapter but sure. >> - The part that's missing is what gets setup in the actual broker. You >> mention IDP Initiated SSO URL Name but I don't see that field in IDPs. In >> general these look like Keycloak specific parameters. >> >> Any thoughts? >> >> John >> >> On Mon, Feb 20, 2017 at 7:18 AM John D. Ament <john.d.ament(a)gmail.com <mailto:john.d.ament@gmail.com>> >> wrote: >> >> Ok, so I was able to get SP initiated working fine. I had only tried IDP >> when I sent this mail out. >> >> I'm going through this doc, and its not clear to me on a few areas: >> https://keycloak.gitbooks.io/server-adminstration-guide/content/topics/cl... >> >> - I have my application (the SP) and the SAML IDP (Okta in this case). I >> have a link on the okta portal to login automatically to my SP. >> - I think the webpage is saying that this only works if I'm using the SAML >> connector for keycloak, is that accurate? >> - All of my Okta settings are from getting SP initiated working. Do any >> of those need to change? >> - Do I in fact setup Okta as a SAML client in Keycloak? >> >> John >> >> >> On Sun, Feb 19, 2017 at 8:47 PM John D. Ament <john.d.ament(a)gmail.com <mailto:john.d.ament@gmail.com>> >> wrote: >> >> Hi >> >> Just wondering, has anyone setup Keycloak w/ Okta? Every time I try to >> authenticate (both SP initiated and IdP initiated) it fails with this error >> >> 01:40:54,626 WARN [org.keycloak.events] (default task-7) >> type=IDENTITY_PROVIDER_LOGIN_ERROR, realmId=tenant1, clientId=null, >> userId=null, ipAddress=172.17.0.1, error=staleCodeMessage >> 01:40:54,627 ERROR [org.keycloak.services.resources.IdentityBrokerService] >> (default task-7) staleCodeMessage >> >> I suspect its a setup issue on my side, so was hoping someone else has >> tried this and can give tips. I even tried the import feature, no luck. >> >> John >> >> > _______________________________________________ > keycloak-user mailing list > keycloak-user(a)lists.jboss.org <mailto:keycloak-user@lists.jboss.org> > https://lists.jboss.org/mailman/listinfo/keycloak-user _______________________________________________ keycloak-user mailing list keycloak-user(a)lists.jboss.org <mailto:keycloak-user@lists.jboss.org> https://lists.jboss.org/mailman/listinfo/keycloak-user

Right, at this point I'm not thinking about OIDC any longer as my connector. Does what I described make sense as things to be done? On Wed, Feb 22, 2017 at 11:23 PM Bill Burke <bburke(a)redhat.com <mailto:bburke@redhat.com>> wrote: IDP Initiated SSO means that the login is unsolicited,meaning that the application did not initiate the login. OAuth protocol (and thus OIDC) does not support this. The application has to initiate the login. I'm not sure exactly what you're trying to do, but if you just want a page where you can see a list of apps that you can visit, you can just create a simple static web page with links to your apps formatted and pretty as you want it. Some IDPs or apps, Saleforce.com I think, require SAML IDP Initiated SSO and don't support the regular login protocol. On 2/22/17 10:18 PM, John D. Ament wrote: > Ok, I must have fat fingered there at the end. Sorry. > > With that said, assuming that I want IDP initiated login, it > seems like what I have to do is: > > - Create a SAML client in Keycloak for my application. > - Follow the IDP initiated flow from > https://keycloak.gitbooks.io/server-adminstration-guide/content/topics/cl... > - Point my IDP to the endpoint that gets generated in here. > > As a result, it seems like I don't have to even create a SAML IDP > in Keycloak, unless that somehow gets used for SP initiated. > > John > > On Wed, Feb 22, 2017 at 10:15 PM John D. Ament > <john.d.ament(a)gmail.com <mailto:john.d.ament@gmail.com>> wrote: > > This is the part that's confusing me. What do you mean by a > "URL somewhere that links to your app which will then > redirect to keycloak"? > > Are you talking about triggering the inbound IDP initiated by > first calling into my app? > > If I look at (Okta for instance) they actually have a > portal-like site that users can leverage to directly link to > their apps. The links generated here are doing IDP initiated > SSO, by triggering SAML in the broker then the broker is > expected to forward to the client (and mind you, I know very > little about SAML, but this is how I'm seeing it behave in > the browser). > > With that said, assum > > > On Wed, Feb 22, 2017 at 9:50 PM Bill Burke <bburke(a)redhat.com > <mailto:bburke@redhat.com>> wrote: > > OIDC/OAuth doesn't have an IDP initiated protocol. You'll > have to > create a URL somewhere that links to your app which will > then redirect > to Keycloak. > > > On 2/22/17 8:23 PM, John D. Ament wrote: > > Looks like I answered half of my question - > > https://issues.jboss.org/browse/KEYCLOAK-4454 > > > > Seems like it will only work if I'm using SAML. > > > > John > > > > On Wed, Feb 22, 2017 at 5:18 PM John D. Ament > <john.d.ament(a)gmail.com <mailto:john.d.ament@gmail.com>> > > wrote: > > > >> Changing the subject to be a bit clearer about the > problems. > >> > >> I think I'm understanding a bit further. when reading > through > >> > https://keycloak.gitbooks.io/server-adminstration-guide/content/topics/cl... > >> > >> - It seems like my application has to be SAML. I > cannot do an OIDC based > >> solution. > >> - First thing I have to do is add IDP Initiated SSO > URL Name to my > >> application. > >> - The confusing part is about if my application > requires... this seems a > >> bit odd, since I'm using the Keycloak adapter but sure. > >> - The part that's missing is what gets setup in the > actual broker. You > >> mention IDP Initiated SSO URL Name but I don't see > that field in IDPs. In > >> general these look like Keycloak specific parameters. > >> > >> Any thoughts? > >> > >> John > >> > >> On Mon, Feb 20, 2017 at 7:18 AM John D. Ament > <john.d.ament(a)gmail.com <mailto:john.d.ament@gmail.com>> > >> wrote: > >> > >> Ok, so I was able to get SP initiated working fine. I > had only tried IDP > >> when I sent this mail out. > >> > >> I'm going through this doc, and its not clear to me on > a few areas: > >> > https://keycloak.gitbooks.io/server-adminstration-guide/content/topics/cl... > >> > >> - I have my application (the SP) and the SAML IDP > (Okta in this case). I > >> have a link on the okta portal to login automatically > to my SP. > >> - I think the webpage is saying that this only works > if I'm using the SAML > >> connector for keycloak, is that accurate? > >> - All of my Okta settings are from getting SP > initiated working. Do any > >> of those need to change? > >> - Do I in fact setup Okta as a SAML client in Keycloak? > >> > >> John > >> > >> > >> On Sun, Feb 19, 2017 at 8:47 PM John D. Ament > <john.d.ament(a)gmail.com <mailto:john.d.ament@gmail.com>> > >> wrote: > >> > >> Hi > >> > >> Just wondering, has anyone setup Keycloak w/ Okta? > Every time I try to > >> authenticate (both SP initiated and IdP initiated) it > fails with this error > >> > >> 01:40:54,626 WARN [org.keycloak.events] (default task-7) > >> type=IDENTITY_PROVIDER_LOGIN_ERROR, realmId=tenant1, > clientId=null, > >> userId=null, ipAddress=172.17.0.1, error=staleCodeMessage > >> 01:40:54,627 ERROR > [org.keycloak.services.resources.IdentityBrokerService] > >> (default task-7) staleCodeMessage > >> > >> I suspect its a setup issue on my side, so was hoping > someone else has > >> tried this and can give tips. I even tried the import > feature, no luck. > >> > >> John > >> > >> > > _______________________________________________ > > keycloak-user mailing list > > keycloak-user(a)lists.jboss.org > <mailto:keycloak-user@lists.jboss.org> > > https://lists.jboss.org/mailman/listinfo/keycloak-user > > _______________________________________________ > keycloak-user mailing list > keycloak-user(a)lists.jboss.org > <mailto:keycloak-user@lists.jboss.org> > https://lists.jboss.org/mailman/listinfo/keycloak-user >

Effectively, yes. I just got *something* configured, though it resulted in an infinite loop. 1. Created a SAML client for my application, with the following custom settings: - Client ID: my-saml - IDP Initiated SSO URL Name: myapp-saml - Assertion Consumer Service POST Binding URL: http://mykeycloak/auth/realms/tenant1/broker/okta/endpoint/clients/myapp-... 2. Created a SAML IDP for Okta: - SSO URL: https://myokta/app/oktaaccount_testkeycloak_1/exk9n6rr5eSDbwe4Y0h7/sso/saml 3. In Okta, set the SSO URL to http://mykeycloak/auth/realms/tenant1/broker/okta/endpoint/clients/myapp-... This results in an infinite loop of URLs that look like: http://mykeycloak/auth/realms/tenant1/login-actions/required-action?code=... - John On Thu, Feb 23, 2017 at 9:57 AM Bill Burke <bburke(a)redhat.com <mailto:bburke@redhat.com>> wrote: I'm sorry, I only read the top half of the email thread. Is this what you want? 1. User logs into Okta 2. User clicks on app link in Okta 3. This app is actually secured by Keycloak, not Okta 4. You want some brokering done here between Keycloak and Okta. Is that it? On 2/23/17 6:06 AM, John D. Ament wrote: > Right, at this point I'm not thinking about OIDC any longer as my > connector. Does what I described make sense as things to be done? > > On Wed, Feb 22, 2017 at 11:23 PM Bill Burke <bburke(a)redhat.com > <mailto:bburke@redhat.com>> wrote: > > IDP Initiated SSO means that the login is unsolicited,meaning > that the application did not initiate the login. OAuth > protocol (and thus OIDC) does not support this. The > application has to initiate the login. I'm not sure exactly > what you're trying to do, but if you just want a page where > you can see a list of apps that you can visit, you can just > create a simple static web page with links to your apps > formatted and pretty as you want it. > > Some IDPs or apps, Saleforce.com I think, require SAML IDP > Initiated SSO and don't support the regular login protocol. > > > On 2/22/17 10:18 PM, John D. Ament wrote: >> Ok, I must have fat fingered there at the end. Sorry. >> >> With that said, assuming that I want IDP initiated login, it >> seems like what I have to do is: >> >> - Create a SAML client in Keycloak for my application. >> - Follow the IDP initiated flow from >> https://keycloak.gitbooks.io/server-adminstration-guide/content/topics/cl... >> - Point my IDP to the endpoint that gets generated in here. >> >> As a result, it seems like I don't have to even create a >> SAML IDP in Keycloak, unless that somehow gets used for SP >> initiated. >> >> John >> >> On Wed, Feb 22, 2017 at 10:15 PM John D. Ament >> <john.d.ament(a)gmail.com <mailto:john.d.ament@gmail.com>> wrote: >> >> This is the part that's confusing me. What do you mean >> by a "URL somewhere that links to your app which will >> then redirect to keycloak"? >> >> Are you talking about triggering the inbound IDP >> initiated by first calling into my app? >> >> If I look at (Okta for instance) they actually have a >> portal-like site that users can leverage to directly >> link to their apps. The links generated here are doing >> IDP initiated SSO, by triggering SAML in the broker then >> the broker is expected to forward to the client (and >> mind you, I know very little about SAML, but this is how >> I'm seeing it behave in the browser). >> >> With that said, assum >> >> >> On Wed, Feb 22, 2017 at 9:50 PM Bill Burke >> <bburke(a)redhat.com <mailto:bburke@redhat.com>> wrote: >> >> OIDC/OAuth doesn't have an IDP initiated protocol. >> You'll have to >> create a URL somewhere that links to your app which >> will then redirect >> to Keycloak. >> >> >> On 2/22/17 8:23 PM, John D. Ament wrote: >> > Looks like I answered half of my question - >> > https://issues.jboss.org/browse/KEYCLOAK-4454 >> > >> > Seems like it will only work if I'm using SAML. >> > >> > John >> > >> > On Wed, Feb 22, 2017 at 5:18 PM John D. Ament >> <john.d.ament(a)gmail.com <mailto:john.d.ament@gmail.com>> >> > wrote: >> > >> >> Changing the subject to be a bit clearer about >> the problems. >> >> >> >> I think I'm understanding a bit further. when >> reading through >> >> >> https://keycloak.gitbooks.io/server-adminstration-guide/content/topics/cl... >> >> >> >> - It seems like my application has to be SAML. I >> cannot do an OIDC based >> >> solution. >> >> - First thing I have to do is add IDP Initiated >> SSO URL Name to my >> >> application. >> >> - The confusing part is about if my application >> requires... this seems a >> >> bit odd, since I'm using the Keycloak adapter but >> sure. >> >> - The part that's missing is what gets setup in >> the actual broker. You >> >> mention IDP Initiated SSO URL Name but I don't >> see that field in IDPs. In >> >> general these look like Keycloak specific parameters. >> >> >> >> Any thoughts? >> >> >> >> John >> >> >> >> On Mon, Feb 20, 2017 at 7:18 AM John D. Ament >> <john.d.ament(a)gmail.com <mailto:john.d.ament@gmail.com>> >> >> wrote: >> >> >> >> Ok, so I was able to get SP initiated working >> fine. I had only tried IDP >> >> when I sent this mail out. >> >> >> >> I'm going through this doc, and its not clear to >> me on a few areas: >> >> >> https://keycloak.gitbooks.io/server-adminstration-guide/content/topics/cl... >> >> >> >> - I have my application (the SP) and the SAML IDP >> (Okta in this case). I >> >> have a link on the okta portal to login >> automatically to my SP. >> >> - I think the webpage is saying that this only >> works if I'm using the SAML >> >> connector for keycloak, is that accurate? >> >> - All of my Okta settings are from getting SP >> initiated working. Do any >> >> of those need to change? >> >> - Do I in fact setup Okta as a SAML client in >> Keycloak? >> >> >> >> John >> >> >> >> >> >> On Sun, Feb 19, 2017 at 8:47 PM John D. Ament >> <john.d.ament(a)gmail.com <mailto:john.d.ament@gmail.com>> >> >> wrote: >> >> >> >> Hi >> >> >> >> Just wondering, has anyone setup Keycloak w/ >> Okta? Every time I try to >> >> authenticate (both SP initiated and IdP >> initiated) it fails with this error >> >> >> >> 01:40:54,626 WARN [org.keycloak.events] (default >> task-7) >> >> type=IDENTITY_PROVIDER_LOGIN_ERROR, >> realmId=tenant1, clientId=null, >> >> userId=null, ipAddress=172.17.0.1, >> error=staleCodeMessage >> >> 01:40:54,627 ERROR >> [org.keycloak.services.resources.IdentityBrokerService] >> >> (default task-7) staleCodeMessage >> >> >> >> I suspect its a setup issue on my side, so was >> hoping someone else has >> >> tried this and can give tips. I even tried the >> import feature, no luck. >> >> >> >> John >> >> >> >> >> > _______________________________________________ >> > keycloak-user mailing list >> > keycloak-user(a)lists.jboss.org >> <mailto:keycloak-user@lists.jboss.org> >> > https://lists.jboss.org/mailman/listinfo/keycloak-user >> >> _______________________________________________ >> keycloak-user mailing list >> keycloak-user(a)lists.jboss.org >> <mailto:keycloak-user@lists.jboss.org> >> https://lists.jboss.org/mailman/listinfo/keycloak-user >> >

Bill, Thanks. How do i set "Automatic Delegate"? John On Thu, Feb 23, 2017 at 10:53 AM Bill Burke <bburke(a)redhat.com <mailto:bburke@redhat.com>> wrote: Yes, that would be an infinite loop as you are configuring Keycloak to delegate authentication to Okta and Okta to delegate to keycloak. You'd have to: 1. Set up a client for your application in Keycloak 2. Set up a broker in Keycloak that points to Okta and sets that as the automatic delegate. This means no keycloak login screen would be shown and it would delegate directly to Okta for authentication. 3. Log into Okta 4. Get to Okta app screen. 5. Click on app link 6. App redirects to Keycloak for authentication 7. Keycloak redirects automatically to Okta 8. Okta sees you are already logged in 9. Redirects back to Keycloak 10. Creates SAML assertion or OIDC token for client 11. Redirects back to app. On 2/23/17 10:10 AM, John D. Ament wrote: > Effectively, yes. > > I just got *something* configured, though it resulted in an > infinite loop. > > 1. Created a SAML client for my application, with the following > custom settings: > - Client ID: my-saml > - IDP Initiated SSO URL Name: myapp-saml > - Assertion Consumer Service POST Binding URL: > http://mykeycloak/auth/realms/tenant1/broker/okta/endpoint/clients/myapp-... > > 2. Created a SAML IDP for Okta: > - SSO URL: > https://myokta/app/oktaaccount_testkeycloak_1/exk9n6rr5eSDbwe4Y0h7/sso/saml > > 3. In Okta, set the SSO URL to > http://mykeycloak/auth/realms/tenant1/broker/okta/endpoint/clients/myapp-... > > This results in an infinite loop of URLs that look like: > http://mykeycloak/auth/realms/tenant1/login-actions/required-action?code=... > > - John > > On Thu, Feb 23, 2017 at 9:57 AM Bill Burke <bburke(a)redhat.com > <mailto:bburke@redhat.com>> wrote: > > I'm sorry, I only read the top half of the email thread. > > Is this what you want? > > 1. User logs into Okta > > 2. User clicks on app link in Okta > > 3. This app is actually secured by Keycloak, not Okta > > 4. You want some brokering done here between Keycloak and Okta. > > Is that it? > > > On 2/23/17 6:06 AM, John D. Ament wrote: >> Right, at this point I'm not thinking about OIDC any longer >> as my connector. Does what I described make sense as things >> to be done? >> >> On Wed, Feb 22, 2017 at 11:23 PM Bill Burke >> <bburke(a)redhat.com <mailto:bburke@redhat.com>> wrote: >> >> IDP Initiated SSO means that the login is >> unsolicited,meaning that the application did not >> initiate the login. OAuth protocol (and thus OIDC) does >> not support this. The application has to initiate the >> login. I'm not sure exactly what you're trying to do, >> but if you just want a page where you can see a list of >> apps that you can visit, you can just create a simple >> static web page with links to your apps formatted and >> pretty as you want it. >> >> Some IDPs or apps, Saleforce.com I think, require SAML >> IDP Initiated SSO and don't support the regular login >> protocol. >> >> >> On 2/22/17 10:18 PM, John D. Ament wrote: >>> Ok, I must have fat fingered there at the end. Sorry. >>> >>> With that said, assuming that I want IDP initiated >>> login, it seems like what I have to do is: >>> >>> - Create a SAML client in Keycloak for my application. >>> - Follow the IDP initiated flow from >>> https://keycloak.gitbooks.io/server-adminstration-guide/content/topics/cl... >>> - Point my IDP to the endpoint that gets generated in here. >>> >>> As a result, it seems like I don't have to even create >>> a SAML IDP in Keycloak, unless that somehow gets used >>> for SP initiated. >>> >>> John >>> >>> On Wed, Feb 22, 2017 at 10:15 PM John D. Ament >>> <john.d.ament(a)gmail.com >>> <mailto:john.d.ament@gmail.com>> wrote: >>> >>> This is the part that's confusing me. What do you >>> mean by a "URL somewhere that links to your app >>> which will then redirect to keycloak"? >>> >>> Are you talking about triggering the inbound IDP >>> initiated by first calling into my app? >>> >>> If I look at (Okta for instance) they actually have >>> a portal-like site that users can leverage to >>> directly link to their apps. The links generated >>> here are doing IDP initiated SSO, by triggering >>> SAML in the broker then the broker is expected to >>> forward to the client (and mind you, I know very >>> little about SAML, but this is how I'm seeing it >>> behave in the browser). >>> >>> With that said, assum >>> >>> >>> On Wed, Feb 22, 2017 at 9:50 PM Bill Burke >>> <bburke(a)redhat.com <mailto:bburke@redhat.com>> wrote: >>> >>> OIDC/OAuth doesn't have an IDP initiated >>> protocol. You'll have to >>> create a URL somewhere that links to your app >>> which will then redirect >>> to Keycloak. >>> >>> >>> On 2/22/17 8:23 PM, John D. Ament wrote: >>> > Looks like I answered half of my question - >>> > https://issues.jboss.org/browse/KEYCLOAK-4454 >>> > >>> > Seems like it will only work if I'm using SAML. >>> > >>> > John >>> > >>> > On Wed, Feb 22, 2017 at 5:18 PM John D. Ament >>> <john.d.ament(a)gmail.com >>> <mailto:john.d.ament@gmail.com>> >>> > wrote: >>> > >>> >> Changing the subject to be a bit clearer >>> about the problems. >>> >> >>> >> I think I'm understanding a bit further. >>> when reading through >>> >> >>> https://keycloak.gitbooks.io/server-adminstration-guide/content/topics/cl... >>> >> >>> >> - It seems like my application has to be >>> SAML. I cannot do an OIDC based >>> >> solution. >>> >> - First thing I have to do is add IDP >>> Initiated SSO URL Name to my >>> >> application. >>> >> - The confusing part is about if my >>> application requires... this seems a >>> >> bit odd, since I'm using the Keycloak >>> adapter but sure. >>> >> - The part that's missing is what gets setup >>> in the actual broker. You >>> >> mention IDP Initiated SSO URL Name but I >>> don't see that field in IDPs. In >>> >> general these look like Keycloak specific >>> parameters. >>> >> >>> >> Any thoughts? >>> >> >>> >> John >>> >> >>> >> On Mon, Feb 20, 2017 at 7:18 AM John D. >>> Ament <john.d.ament(a)gmail.com >>> <mailto:john.d.ament@gmail.com>> >>> >> wrote: >>> >> >>> >> Ok, so I was able to get SP initiated >>> working fine. I had only tried IDP >>> >> when I sent this mail out. >>> >> >>> >> I'm going through this doc, and its not >>> clear to me on a few areas: >>> >> >>> https://keycloak.gitbooks.io/server-adminstration-guide/content/topics/cl... >>> >> >>> >> - I have my application (the SP) and the >>> SAML IDP (Okta in this case). I >>> >> have a link on the okta portal to login >>> automatically to my SP. >>> >> - I think the webpage is saying that this >>> only works if I'm using the SAML >>> >> connector for keycloak, is that accurate? >>> >> - All of my Okta settings are from getting >>> SP initiated working. Do any >>> >> of those need to change? >>> >> - Do I in fact setup Okta as a SAML client >>> in Keycloak? >>> >> >>> >> John >>> >> >>> >> >>> >> On Sun, Feb 19, 2017 at 8:47 PM John D. >>> Ament <john.d.ament(a)gmail.com >>> <mailto:john.d.ament@gmail.com>> >>> >> wrote: >>> >> >>> >> Hi >>> >> >>> >> Just wondering, has anyone setup Keycloak w/ >>> Okta? Every time I try to >>> >> authenticate (both SP initiated and IdP >>> initiated) it fails with this error >>> >> >>> >> 01:40:54,626 WARN [org.keycloak.events] >>> (default task-7) >>> >> type=IDENTITY_PROVIDER_LOGIN_ERROR, >>> realmId=tenant1, clientId=null, >>> >> userId=null, ipAddress=172.17.0.1, >>> error=staleCodeMessage >>> >> 01:40:54,627 ERROR >>> [org.keycloak.services.resources.IdentityBrokerService] >>> >> (default task-7) staleCodeMessage >>> >> >>> >> I suspect its a setup issue on my side, so >>> was hoping someone else has >>> >> tried this and can give tips. I even tried >>> the import feature, no luck. >>> >> >>> >> John >>> >> >>> >> >>> > _______________________________________________ >>> > keycloak-user mailing list >>> > keycloak-user(a)lists.jboss.org >>> <mailto:keycloak-user@lists.jboss.org> >>> > >>> https://lists.jboss.org/mailman/listinfo/keycloak-user >>> >>> _______________________________________________ >>> keycloak-user mailing list >>> keycloak-user(a)lists.jboss.org >>> <mailto:keycloak-user@lists.jboss.org> >>> https://lists.jboss.org/mailman/listinfo/keycloak-user >>> >> >

:-) Well it seems not needed. Or we can worry about that later. - Is the client I'm setting up for my app a SAML client or OIDC client? Or does it not matter? - When I point Okta to my SAML IDP endpoint ( http://mykeycloak/auth/realms/tenant1/broker/okta/endpoint <http://sso-poc.aws.stratas.net/auth/realms/tenant1/broker/okta/endpoint> ) I'm getting " WE'RE SORRY ... This page is no longer valid, please go back to your application and login again" - this kind of makes sense, I don't see how I'm telling the Okta IDP which app to forward to. John On Thu, Feb 23, 2017 at 12:45 PM Bill Burke <bburke(a)redhat.com <mailto:bburke@redhat.com>> wrote: Hmmm....somebody removed this config option....wtf... On 2/23/17 12:11 PM, John D. Ament wrote: > Bill, > > Thanks. How do i set "Automatic Delegate"? > > John > > On Thu, Feb 23, 2017 at 10:53 AM Bill Burke <bburke(a)redhat.com > <mailto:bburke@redhat.com>> wrote: > > Yes, that would be an infinite loop as you are configuring > Keycloak to delegate authentication to Okta and Okta to > delegate to keycloak. You'd have to: > > 1. Set up a client for your application in Keycloak > > 2. Set up a broker in Keycloak that points to Okta and sets > that as the automatic delegate. This means no keycloak login > screen would be shown and it would delegate directly to Okta > for authentication. > > 3. Log into Okta > > 4. Get to Okta app screen. > > 5. Click on app link > > 6. App redirects to Keycloak for authentication > > 7. Keycloak redirects automatically to Okta > > 8. Okta sees you are already logged in > > 9. Redirects back to Keycloak > > 10. Creates SAML assertion or OIDC token for client > > 11. Redirects back to app. > > On 2/23/17 10:10 AM, John D. Ament wrote: >> Effectively, yes. >> >> I just got *something* configured, though it resulted in an >> infinite loop. >> >> 1. Created a SAML client for my application, with the >> following custom settings: >> - Client ID: my-saml >> - IDP Initiated SSO URL Name: myapp-saml >> - Assertion Consumer Service POST Binding URL: >> http://mykeycloak/auth/realms/tenant1/broker/okta/endpoint/clients/myapp-... >> >> 2. Created a SAML IDP for Okta: >> - SSO URL: >> https://myokta/app/oktaaccount_testkeycloak_1/exk9n6rr5eSDbwe4Y0h7/sso/saml >> >> 3. In Okta, set the SSO URL to >> http://mykeycloak/auth/realms/tenant1/broker/okta/endpoint/clients/myapp-... >> >> This results in an infinite loop of URLs that look like: >> http://mykeycloak/auth/realms/tenant1/login-actions/required-action?code=... >> >> - John >> >> On Thu, Feb 23, 2017 at 9:57 AM Bill Burke >> <bburke(a)redhat.com <mailto:bburke@redhat.com>> wrote: >> >> I'm sorry, I only read the top half of the email thread. >> >> Is this what you want? >> >> 1. User logs into Okta >> >> 2. User clicks on app link in Okta >> >> 3. This app is actually secured by Keycloak, not Okta >> >> 4. You want some brokering done here between Keycloak >> and Okta. >> >> Is that it? >> >> >> On 2/23/17 6:06 AM, John D. Ament wrote: >>> Right, at this point I'm not thinking about OIDC any >>> longer as my connector. Does what I described make >>> sense as things to be done? >>> >>> On Wed, Feb 22, 2017 at 11:23 PM Bill Burke >>> <bburke(a)redhat.com <mailto:bburke@redhat.com>> wrote: >>> >>> IDP Initiated SSO means that the login is >>> unsolicited,meaning that the application did not >>> initiate the login. OAuth protocol (and thus OIDC) >>> does not support this. The application has to >>> initiate the login. I'm not sure exactly what >>> you're trying to do, but if you just want a page >>> where you can see a list of apps that you can >>> visit, you can just create a simple static web page >>> with links to your apps formatted and pretty as you >>> want it. >>> >>> Some IDPs or apps, Saleforce.com I think, require >>> SAML IDP Initiated SSO and don't support the >>> regular login protocol. >>> >>> >>> On 2/22/17 10:18 PM, John D. Ament wrote: >>>> Ok, I must have fat fingered there at the end. >>>> Sorry. >>>> >>>> With that said, assuming that I want IDP initiated >>>> login, it seems like what I have to do is: >>>> >>>> - Create a SAML client in Keycloak for my application. >>>> - Follow the IDP initiated flow from >>>> https://keycloak.gitbooks.io/server-adminstration-guide/content/topics/cl... >>>> - Point my IDP to the endpoint that gets generated >>>> in here. >>>> >>>> As a result, it seems like I don't have to even >>>> create a SAML IDP in Keycloak, unless that somehow >>>> gets used for SP initiated. >>>> >>>> John >>>> >>>> On Wed, Feb 22, 2017 at 10:15 PM John D. Ament >>>> <john.d.ament(a)gmail.com >>>> <mailto:john.d.ament@gmail.com>> wrote: >>>> >>>> This is the part that's confusing me. What do >>>> you mean by a "URL somewhere that links to >>>> your app which will then redirect to keycloak"? >>>> >>>> Are you talking about triggering the inbound >>>> IDP initiated by first calling into my app? >>>> >>>> If I look at (Okta for instance) they actually >>>> have a portal-like site that users can >>>> leverage to directly link to their apps. The >>>> links generated here are doing IDP initiated >>>> SSO, by triggering SAML in the broker then the >>>> broker is expected to forward to the client >>>> (and mind you, I know very little about SAML, >>>> but this is how I'm seeing it behave in the >>>> browser). >>>> >>>> With that said, assum >>>> >>>> >>>> On Wed, Feb 22, 2017 at 9:50 PM Bill Burke >>>> <bburke(a)redhat.com <mailto:bburke@redhat.com>> >>>> wrote: >>>> >>>> OIDC/OAuth doesn't have an IDP initiated >>>> protocol. You'll have to >>>> create a URL somewhere that links to your >>>> app which will then redirect >>>> to Keycloak. >>>> >>>> >>>> On 2/22/17 8:23 PM, John D. Ament wrote: >>>> > Looks like I answered half of my question - >>>> > >>>> https://issues.jboss.org/browse/KEYCLOAK-4454 >>>> > >>>> > Seems like it will only work if I'm >>>> using SAML. >>>> > >>>> > John >>>> > >>>> > On Wed, Feb 22, 2017 at 5:18 PM John D. >>>> Ament <john.d.ament(a)gmail.com >>>> <mailto:john.d.ament@gmail.com>> >>>> > wrote: >>>> > >>>> >> Changing the subject to be a bit >>>> clearer about the problems. >>>> >> >>>> >> I think I'm understanding a bit >>>> further. when reading through >>>> >> >>>> https://keycloak.gitbooks.io/server-adminstration-guide/content/topics/cl... >>>> >> >>>> >> - It seems like my application has to >>>> be SAML. I cannot do an OIDC based >>>> >> solution. >>>> >> - First thing I have to do is add IDP >>>> Initiated SSO URL Name to my >>>> >> application. >>>> >> - The confusing part is about if my >>>> application requires... this seems a >>>> >> bit odd, since I'm using the Keycloak >>>> adapter but sure. >>>> >> - The part that's missing is what gets >>>> setup in the actual broker. You >>>> >> mention IDP Initiated SSO URL Name but >>>> I don't see that field in IDPs. In >>>> >> general these look like Keycloak >>>> specific parameters. >>>> >> >>>> >> Any thoughts? >>>> >> >>>> >> John >>>> >> >>>> >> On Mon, Feb 20, 2017 at 7:18 AM John D. >>>> Ament <john.d.ament(a)gmail.com >>>> <mailto:john.d.ament@gmail.com>> >>>> >> wrote: >>>> >> >>>> >> Ok, so I was able to get SP initiated >>>> working fine. I had only tried IDP >>>> >> when I sent this mail out. >>>> >> >>>> >> I'm going through this doc, and its not >>>> clear to me on a few areas: >>>> >> >>>> https://keycloak.gitbooks.io/server-adminstration-guide/content/topics/cl... >>>> >> >>>> >> - I have my application (the SP) and >>>> the SAML IDP (Okta in this case). I >>>> >> have a link on the okta portal to login >>>> automatically to my SP. >>>> >> - I think the webpage is saying that >>>> this only works if I'm using the SAML >>>> >> connector for keycloak, is that accurate? >>>> >> - All of my Okta settings are from >>>> getting SP initiated working. Do any >>>> >> of those need to change? >>>> >> - Do I in fact setup Okta as a SAML >>>> client in Keycloak? >>>> >> >>>> >> John >>>> >> >>>> >> >>>> >> On Sun, Feb 19, 2017 at 8:47 PM John D. >>>> Ament <john.d.ament(a)gmail.com >>>> <mailto:john.d.ament@gmail.com>> >>>> >> wrote: >>>> >> >>>> >> Hi >>>> >> >>>> >> Just wondering, has anyone setup >>>> Keycloak w/ Okta? Every time I try to >>>> >> authenticate (both SP initiated and IdP >>>> initiated) it fails with this error >>>> >> >>>> >> 01:40:54,626 WARN [org.keycloak.events] >>>> (default task-7) >>>> >> type=IDENTITY_PROVIDER_LOGIN_ERROR, >>>> realmId=tenant1, clientId=null, >>>> >> userId=null, ipAddress=172.17.0.1, >>>> error=staleCodeMessage >>>> >> 01:40:54,627 ERROR >>>> [org.keycloak.services.resources.IdentityBrokerService] >>>> >> (default task-7) staleCodeMessage >>>> >> >>>> >> I suspect its a setup issue on my side, >>>> so was hoping someone else has >>>> >> tried this and can give tips. I even >>>> tried the import feature, no luck. >>>> >> >>>> >> John >>>> >> >>>> >> >>>> > >>>> _______________________________________________ >>>> > keycloak-user mailing list >>>> > keycloak-user(a)lists.jboss.org >>>> <mailto:keycloak-user@lists.jboss.org> >>>> > >>>> https://lists.jboss.org/mailman/listinfo/keycloak-user >>>> >>>> _______________________________________________ >>>> keycloak-user mailing list >>>> keycloak-user(a)lists.jboss.org >>>> <mailto:keycloak-user@lists.jboss.org> >>>> https://lists.jboss.org/mailman/listinfo/keycloak-user >>>> >>> >> >

Keycloak is delegating to Okta in my case. I almost want to say ELI5, but I'm not sure I'm that far off. I still feel like there's a piece missing in my setup, based on what you're describing. 1. A user logs in to Okta. They see an option for my app, which is in fact Keycloak. 2. User clicks said link, it does IDP initiated auth to Keycloak. 3. User now has a session in keycloak. 4. ?? 5. The user is now in my app. The part that seems to be missing is 4. How am I telling keycloak that when a user comes in this way, they should then come to my app? Is that where I want to use "Assertion Consumer Service POST Binding URL" ? John On Thu, Feb 23, 2017 at 2:54 PM Bill Burke <bburke(a)redhat.com&gt; wrote: Maybe I should explain brokering? If you want Keycloak to delegate authentication to a different IDP, then you need to set up an Identity Provider. If you have a child IDP that is delegating authentication to Keycloak the you must set up a client within Keycloak. This client represents the connection to the child IDP. Does that shed any light on things? Is Keycloak delegating authentication to Okra? Or is Okra delegating to Keycloak? Thanks, Bill On 2/23/17 12:54 PM, John D. Ament wrote: :-) Well it seems not needed. Or we can worry about that later. - Is the client I'm setting up for my app a SAML client or OIDC client? Or does it not matter? - When I point Okta to my SAML IDP endpoint ( http://mykeycloak/auth/realms/tenant1/broker/okta/endpoint <http://sso-poc.aws.stratas.net/auth/realms/tenant1/broker/okta/endpoint> ) I'm getting " WE'RE SORRY ... This page is no longer valid, please go back to your application and login again" - this kind of makes sense, I don't see how I'm telling the Okta IDP which app to forward to. John On Thu, Feb 23, 2017 at 12:45 PM Bill Burke <bburke(a)redhat.com&gt; wrote: Hmmm....somebody removed this config option....wtf... On 2/23/17 12:11 PM, John D. Ament wrote: Bill, Thanks. How do i set "Automatic Delegate"? John On Thu, Feb 23, 2017 at 10:53 AM Bill Burke <bburke(a)redhat.com&gt; wrote: Yes, that would be an infinite loop as you are configuring Keycloak to delegate authentication to Okta and Okta to delegate to keycloak. You'd have to: 1. Set up a client for your application in Keycloak 2. Set up a broker in Keycloak that points to Okta and sets that as the automatic delegate. This means no keycloak login screen would be shown and it would delegate directly to Okta for authentication. 3. Log into Okta 4. Get to Okta app screen. 5. Click on app link 6. App redirects to Keycloak for authentication 7. Keycloak redirects automatically to Okta 8. Okta sees you are already logged in 9. Redirects back to Keycloak 10. Creates SAML assertion or OIDC token for client 11. Redirects back to app. On 2/23/17 10:10 AM, John D. Ament wrote: Effectively, yes. I just got *something* configured, though it resulted in an infinite loop. 1. Created a SAML client for my application, with the following custom settings: - Client ID: my-saml - IDP Initiated SSO URL Name: myapp-saml - Assertion Consumer Service POST Binding URL: http://mykeycloak/auth/realms/tenant1/broker/okta/endpoint/clients/myapp-... 2. Created a SAML IDP for Okta: - SSO URL: https://myokta/app/oktaaccount_testkeycloak_1/exk9n6rr5eSDbwe4Y0h7/sso/saml 3. In Okta, set the SSO URL to http://mykeycloak/auth/realms/tenant1/broker/okta/endpoint/clients/myapp-... This results in an infinite loop of URLs that look like: http://mykeycloak/auth/realms/tenant1/login-actions/required-action?code=... - John On Thu, Feb 23, 2017 at 9:57 AM Bill Burke <bburke(a)redhat.com&gt; wrote: I'm sorry, I only read the top half of the email thread. Is this what you want? 1. User logs into Okta 2. User clicks on app link in Okta 3. This app is actually secured by Keycloak, not Okta 4. You want some brokering done here between Keycloak and Okta. Is that it? On 2/23/17 6:06 AM, John D. Ament wrote: Right, at this point I'm not thinking about OIDC any longer as my connector. Does what I described make sense as things to be done? On Wed, Feb 22, 2017 at 11:23 PM Bill Burke <bburke(a)redhat.com&gt; wrote: IDP Initiated SSO means that the login is unsolicited,meaning that the application did not initiate the login. OAuth protocol (and thus OIDC) does not support this. The application has to initiate the login. I'm not sure exactly what you're trying to do, but if you just want a page where you can see a list of apps that you can visit, you can just create a simple static web page with links to your apps formatted and pretty as you want it. Some IDPs or apps, Saleforce.com I think, require SAML IDP Initiated SSO and don't support the regular login protocol. On 2/22/17 10:18 PM, John D. Ament wrote: Ok, I must have fat fingered there at the end. Sorry. With that said, assuming that I want IDP initiated login, it seems like what I have to do is: - Create a SAML client in Keycloak for my application. - Follow the IDP initiated flow from https://keycloak.gitbooks.io/server-adminstration-guide/content/topics/cl... - Point my IDP to the endpoint that gets generated in here. As a result, it seems like I don't have to even create a SAML IDP in Keycloak, unless that somehow gets used for SP initiated. John On Wed, Feb 22, 2017 at 10:15 PM John D. Ament <john.d.ament(a)gmail.com&gt; wrote: This is the part that's confusing me. What do you mean by a "URL somewhere that links to your app which will then redirect to keycloak"? Are you talking about triggering the inbound IDP initiated by first calling into my app? If I look at (Okta for instance) they actually have a portal-like site that users can leverage to directly link to their apps. The links generated here are doing IDP initiated SSO, by triggering SAML in the broker then the broker is expected to forward to the client (and mind you, I know very little about SAML, but this is how I'm seeing it behave in the browser). With that said, assum On Wed, Feb 22, 2017 at 9:50 PM Bill Burke <bburke(a)redhat.com&gt; wrote: OIDC/OAuth doesn't have an IDP initiated protocol. You'll have to create a URL somewhere that links to your app which will then redirect to Keycloak. On 2/22/17 8:23 PM, John D. Ament wrote: > Looks like I answered half of my question - > https://issues.jboss.org/browse/KEYCLOAK-4454 > > Seems like it will only work if I'm using SAML. > > John > > On Wed, Feb 22, 2017 at 5:18 PM John D. Ament <john.d.ament(a)gmail.com&gt; > wrote: > >> Changing the subject to be a bit clearer about the problems. >> >> I think I'm understanding a bit further. when reading through >> https://keycloak.gitbooks.io/server-adminstration-guide/content/topics/cl... >> >> - It seems like my application has to be SAML. I cannot do an OIDC based >> solution. >> - First thing I have to do is add IDP Initiated SSO URL Name to my >> application. >> - The confusing part is about if my application requires... this seems a >> bit odd, since I'm using the Keycloak adapter but sure. >> - The part that's missing is what gets setup in the actual broker. You >> mention IDP Initiated SSO URL Name but I don't see that field in IDPs. In >> general these look like Keycloak specific parameters. >> >> Any thoughts? >> >> John >> >> On Mon, Feb 20, 2017 at 7:18 AM John D. Ament <john.d.ament(a)gmail.com&gt; >> wrote: >> >> Ok, so I was able to get SP initiated working fine. I had only tried IDP >> when I sent this mail out. >> >> I'm going through this doc, and its not clear to me on a few areas: >> https://keycloak.gitbooks.io/server-adminstration-guide/content/topics/cl... >> >> - I have my application (the SP) and the SAML IDP (Okta in this case). I >> have a link on the okta portal to login automatically to my SP. >> - I think the webpage is saying that this only works if I'm using the SAML >> connector for keycloak, is that accurate? >> - All of my Okta settings are from getting SP initiated working. Do any >> of those need to change? >> - Do I in fact setup Okta as a SAML client in Keycloak? >> >> John >> >> >> On Sun, Feb 19, 2017 at 8:47 PM John D. Ament <john.d.ament(a)gmail.com&gt; >> wrote: >> >> Hi >> >> Just wondering, has anyone setup Keycloak w/ Okta? Every time I try to >> authenticate (both SP initiated and IdP initiated) it fails with this error >> >> 01:40:54,626 WARN [org.keycloak.events] (default task-7) >> type=IDENTITY_PROVIDER_LOGIN_ERROR, realmId=tenant1, clientId=null, >> userId=null, ipAddress=172.17.0.1, error=staleCodeMessage >> 01:40:54,627 ERROR [org.keycloak.services.resources.IdentityBrokerService] >> (default task-7) staleCodeMessage >> >> I suspect its a setup issue on my side, so was hoping someone else has >> tried this and can give tips. I even tried the import feature, no luck. >> >> John >> >> > _______________________________________________ > keycloak-user mailing list > keycloak-user(a)lists.jboss.org > https://lists.jboss.org/mailman/listinfo/keycloak-user _______________________________________________ keycloak-user mailing list keycloak-user(a)lists.jboss.org https://lists.jboss.org/mailman/listinfo/keycloak-user

On 2/23/17 9:14 PM, John D. Ament wrote: > After I sent this email, it dawned on me what #4 was. I was able to > get IDP initiated working. Here's what my setup looks like. So I'm > interested, is this correct, is this too much? > > - Create an IDP for Okta. > > - App Client: > - This represents the real application, receiving the final assertion. > - Client Protocol: SAML > - IDP Initiated SSO Name: some-value > - Assertion Consumer Service POST Binding URL: > http://myapp/saml (the /saml comes from the wildfly SAML adapter) > > Within Okta, I'm entering a URL like this: > > http://mykeycloak/auth/realms/ <<realm>>/broker/<<alias>>/endpoint/clients/<<some-value>> > > Where: > > realm: your realm, e.g. tenant1 in my case > alias: the value of the "alias" field from your IDP > some-value: the IDP Initiated SSO Name value from above > > After doing this, I'm able to confirm that the principal is coming > from Keycloak properly. I'm assuming based on this, I can only do > this via the SAML adapter, not the OIDC connector. > Correct, no OIDC. Reason? Its the OAuth protocol. OAuth only allows the client to initiate authentication.

Bill