Keycloak IdP SAML 2 Export XML Metadata to SP

Question

I am using Keycloak version 1.6.1, recently installed as a standalone application.

Keycloak must act as an IdP (identity provider) for an SP (service provider) called Tableau.

I read from this page: http://blog.keycloak.org/2015/03/picketlink-and-keycloak-projects-are.html

... Keycloak from Identity Broker has evolved into a full-fledged Identity Provider

Although it was an Identity Broker, now it is also an Identity Broker.

My question is:

I exported the SP XML metadata from Tableau, which I imported into Keycloak, but when it comes to exporting the IdP XML metadata from Keycloak (which should be imported into Tableau), I cannot find a button / command / guide on how to export this file XML

I worked with other IdPs and they all support this export of IdP metadata, an example of which you can see here: https://docs.oracle.com/cd/E19636-01/819-7664/g2enua/index.html

If I search for Keycloak and the IDPSSODescriptor keyword, I find this: grepcode.com/file/repo1.maven.org/maven2/org.keycloak/keycloak-saml-protocol/1.1.0.Beta2/idp-metadata-template.xml

This is exactly the template I need, with the correct links to all $ {idp.sso.HTTP-POST}, etc. Places.

Do I have to create the file manually - if so, how do I find the correct POST, REDIRECT, etc. URLs?

Or is there some way to export this file that I have not seen?

Answer 1

It is sometimes useful to indicate in writing what you need - what I did here in Stack Overflow.

I found a URL where IdP XML can be exported to Keycloak

https://keycloak-url/realms/{REALM-NAME}/protocol/saml/descriptor 

This gave me an IDPSSODescriptor.

I will leave this topic here so that people can take advantage of my mistakes.

Answer 2

Since Keycloak 3.x, the IdP XML descriptor needs / auth / after keycloak-url

 https://{KEYCLOAK-URL}/auth/realms/{REALM-NAME}/protocol/saml/descriptor 

Answer 3

The original poster is correct that the SAML Metadata IDPSSODescriptor no longer available in Keycloak 6.0.1

One change is to use the https://{KEYCLOAK-URL}/auth/realms/{REALM-NAME}/protocol/saml/descriptor . The rancher expects the root element to be an EntityDescriptor , so you need to remove the EntitiesDescriptor and copy the namespaces from the root element.

those.

 <EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#" entityID="https://{KEYCLOAK-URL}/auth/realms/{REALM-NAME}"> .... </EntityDescriptor>