EasySSO SAML with Keycloak Signed Requests

Configuration of EasySSO with signed POST requests, using KeyCloak v19 as an IdP

EasySSO Side

1. Set the IdP Metadata URL, and then click "load certificate"
   
2. Click to generate certificate
   
3. Set binding types to POST
   
4. Set to sign and verify signatures
   
5. Save the settings
   
6. Open the metadata.xml and save to desktop
   

KeyCloak Side

KeyCloak Client Scope

1. In KeyCloak Administration console, navigate to Client Scopes, click the "Create client scope" button
   
2. Set the name to EASY_SSO and protocol to SAML
   
3. Click save
   
4. Select the mappers tab
   
5. Configure a new mapper
   
6. Select User Property
   
7. Configure username user property
   1. Name: username
   2. Mapper Type: User Property
   3. Property: username
   4. Friendly Name: username
   5. SAML Attribute Name: urn:oid:0.9.2342.19200300.100.1.1
   6. Click Save
      
8. Configure Email user property
   1. Name: email
   2. Mapper Type: User Property
   3. Property: email
   4. Friendly Name: email
   5. SAML Attribute Name: urn:oid:0.9.2342.19200300.100.1.3
   6. Click Save
      
9. Configure first name user property
   1. Name: firstName
   2. Mapper Type: User Property
   3. Property: firstName
   4. Friendly Name: firstName
   5. SAML Attribute Name: urn:oid:2.5.4.42
   6. Click Save
      
10. Configure last name user property
    1. Name: lastName
    2. Mapper Type: User Property
    3. Property: lastName
    4. Friendly Name: lastName
    5. SAML Attribute Name: urn:oid:2.5.4.4
    6. Click Save
       
11. (Optional) Configure Groups group list property
    1. Name: groups
    2. Mapper Type: Group list
    3. Group attribute name: urn:oid:2.5.4.31
    4. Friendly Name: groups
    5. Full group path: off
    6. Click Save
       
12. The final EASY_SSO Client scope should look something like this
    

KeyCloak Client

1. In KeyCloak Administration console, navigate to clients, click the "Import client" button
   
2. Click browse and upload the metadata.xml file exported from EasySSO earlier
   
3. Ensure the Encrypt assertions is turned off, and that client signature required is turned on
   
4. Save setting for the imported file
   
5. In the client that has just been imported, open Client scopes
   
6. Click to add the EASY_SSO client scope configured earlier
   
7. On the client configuration general configuration page ensure the following settings
   1. Sign documents is enabled
   2. Sign assertions is enabled
      

Configuring Users

For users to successfully log in, they must also have permission to access the application. See EasySSO SAML JIT User Provisioning for more details.