Skip to main content
Sign in

Search

RIVO Help

How can we help?

Keycloak IdP provider – finish setup after receiving the IdP metadata

Sandhyaselvi Kalaivanan
  • Updated
  1. In the  KEYCLOAK console insert the value of App Federation Metadata Url received from the user in the field Import from URL and click Import
  2. Duplicate the value of Single Sign-On Service URL into Single Logout Service URL.Click Save at the bottom of the page
  3. Configure IDP'S Provider Mapper  : Email Mapper :RIVO SSO requires that SAMLResponse contain the claim with the user’s email address for map IdP response data to the user, created in RIVO (see Key Points above in this document). For this purpose, the emailMapper should be configured for the IdP provider
  4. Roles Mapper :

  5. Additional note about IdP provider mappers

    If owner of the IdP requires that NameID element (the essential part of <Subject>) will have the format other than persistent (which is preferable in RIVO IdP provider), specifically – emailAddress (see the example below), then the additional IdP provider’s mapper -  should be configured in Keycloak – see Figure 19 below.

    Example with emailAddress format of NameID:

    <Subject><NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress" >…</saml2:NameID…</saml:Subject>

  6. Advanced SAML Configuration in Keycloak IdP provider

    IdP can require signing SAML requests, issued by Keycloak. The Keycloak in its turn can be configured to require IdP assertions to be signed and/or encrypted.

  7. To export the IdP provider metadata, click the link shown below :

  8. Example of Keycloak IdP provider metadata

    Surecomp should share the link to Keycloak IdP provider’s metadata (or the metadata file) with the IdP owner.

Comments

0 comments

Please sign in to leave a comment.