Repository navigation
Replies: 1 comment 6 replies
|
Up up anyone has any working example, any reference of documentation will be helpful |
|
I login with either one of oidc or saml2 clients and either clients accept my identity |
|
Keycloak, as any other SSO should do that by default. When you log in with either client, the client redirects you to the SSO portal where you must enter your credentials (alternatively, the SSO can use cookies it set in your browser for authentication). After the authentication process finishes, the SSO releases the user information token / assertions to the client. As such, when you log in with any type of client (OIDC / SAML), the manual user authentication part is performed only the first time, and after that the authentication should be done automatically based on the cookies set in the browser. Technically, the SSO authenticates the user for every redirect, but cookies or session tokens can be kept for some interval (e.g. if the Please tell me if I misunderstood your question. |
|
Yes in paper it should have but here is the part that I still trying to figure out. |
|
The equivalents of response JWT for OIDC are called documents and assertions in SAML. You may find some examples by searching for "saml assertion examples" (e.g. https://help.salesforce.com/s/articleView?id=sf.sso_saml_assertion_examples.htm&type=5, but there are other more complete examples). The OASIS committee provides a technical overview of the SAML protocol. From your last question, I believe the discussion topic should have been how SAML clients / mappers should be configured in Keycloak so a service can receive the proper information. If this is the case, you should note that as opposed to OIDC clients, which have pre-defined mappers in Keycloak for username, mail, first name, last name, etc., SAML clients do not. You need to define a different client scope, e.g. |
|
Thank you for the detail explanation, I understand the difference between the two protocols, I'm still trying to figure out what "thing" should I send to my SAML clients while I only have jwt token after login with OIDC clients, I will follow up the configuration about the mapper and the client scope in my SAML clients, thanks alot for replying friend. |
Uh oh!
There was an error while loading. Please reload this page.
Does SSO between OIDC and SAML2 clients are possible in keycloak?
All reactions