security nextcloud service #19840

MorganReid · 2023-04-20T11:29:37Z

MorganReid
Apr 20, 2023

I configured according to stack overflow - SSO with SAML, Keycloak and Nextcloud, my realm name is myrealm and my keycloak host is
http://10.112.0.141:51122/ .but an error was reported during the final test：

The keycloak I deployed based on the latest version (21.1.0) of the mirror cannot be found.So during the configuration process, I did not operate this step, will it affect it?
Update the Client SAML Endpoint field with: https://login.example.com/auth/realms/example.com.

besides,If I replace /auth with /admin in the path in the configuration below:
Identifier of the IdP: https://login.example.com/auth/realms/example.com URL Target of the IdP where the SP will send the Authentication Request Message: https://login.example.com/auth/realms/example.com/protocol/saml URL Location of IdP where the SP will send the SLO Request: https://login.example.com/auth/realms/example.com/protocol/saml.
I will get another error:

Then I look at the log output of keycloak:

I just came into contact with keycloak, can you help me find out why, thank you very much.

Answered by darius-m

Apr 22, 2023

You need to read a bit more of the Keycloak administration documentation to understand how the authentication protocols work, and what the Keycloak endpoints do,

The issue in your case is most likely the fact that in the stackoverflow link that you've linked, they used the old default /auth base path, while you are using /. As such, the /auth/realms/myrealm/protocol/saml is not a valid path, it should be /realms/myrealm/protocol/saml. The /admin path is used for administration purposes only (with the /auth base it would have been /auth/admin), so clients should almost never connect to it (unless you explicitly configure some admin privileges to accounts).

View full answer

darius-m · 2023-04-22T11:24:31Z

darius-m
Apr 22, 2023

You need to read a bit more of the Keycloak administration documentation to understand how the authentication protocols work, and what the Keycloak endpoints do,

The issue in your case is most likely the fact that in the stackoverflow link that you've linked, they used the old default /auth base path, while you are using /. As such, the /auth/realms/myrealm/protocol/saml is not a valid path, it should be /realms/myrealm/protocol/saml. The /admin path is used for administration purposes only (with the /auth base it would have been /auth/admin), so clients should almost never connect to it (unless you explicitly configure some admin privileges to accounts).

0 replies

Navigation Menu

Repository navigation

security nextcloud service #19840

Uh oh!

{{title}}

Uh oh!

Replies: 1 comment

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Select a reply

Uh oh!

security nextcloud service #19840

Uh oh!

MorganReid Apr 20, 2023

Replies: 1 comment

Uh oh!

Uh oh!

darius-m Apr 22, 2023

MorganReid
Apr 20, 2023

darius-m
Apr 22, 2023