Repository navigation
Replies: 3 comments 2 replies
|
https://www.keycloak.org/docs/latest/server_admin/#saml-v2-0-identity-providers |
|
I definitely saw where I can configure a SAML provider here, but I didn't see where and how to require such a provider as the only authentication source for the Admin Console. Thank you for replying, I'll keep looking at this - if you know where the section I'm looking for is, please let me know! |
|
Do you want to allow authenticating administrator accounts through an external identity provider? If so, you could probably allow users in the master realm to authenticate using it (add the identity broker inside the master realm). However, the admin console is security critical, so adding an external service as a source of authentication (in addition to the authentication provided by Keycloak) may greatly increase your attack surface. |
|
Not only do I want to allow external authentication for administrators, I want to mandate that this is the only methodology allowed for the authentication of administrators.
This is because I construct the security question differently than you have. If I am manually adding and removing Administrators every time someone joins or departs, or is granted access/has access removed, that manual process will entail a high likelihood of human error. Meaning that some off boarded account will retain access.
On the other hand, if I regulate access using single sign on from my core identity provider, then at the time of off boarding (for example) the user by definition no longer maintains access.
Are you certain that I can mandate the use of my external identity provider through saml for administrative logins?
Thank you for replying!
|
|
If you have an external SSO that is the core identity provider that you ultimately trust and you understand possible risks, then please proceed with your plan. I assumed Keycloak would be the core IDP, sorry for the misunderstanding. I have not used external IDPs, so someone more knowledgeable may correct me, but I believe that in your case you would have to add the external IDP to the master realm, change it to be the default provider and then update the authentication flows (i.e., I think the browser flow would suffice) to mandate the use of the IDP (i.e., switch the Identity Provider Redirector to Required, instead of Alternative). |
Uh oh!
There was an error while loading. Please reload this page.
I have reviewed the Keycloak documentation but I do not see anything that clearly lays out the procedure for connecting the Admin Console to a SAML provider. Is this possible, and, if so, how to do it? Apologies if this was covered elsewhere, I did some searching but did not see it stated clearly.
All reactions