simple chaining of Keycloak #23599

mysterypersonx · 2023-09-29T10:58:30Z

mysterypersonx
Sep 29, 2023

I'm trying to do a simple chaining of Keycloak.

I tried first with two realms. Now trying with two instances of keycloak on the same server, but different ports.

Let's call them: inner-keycloak and outer-keycloak.

The inner-keycloak instance is configured with User Federation, where LDAP servers have been configured.
From this a SAML Token is generated. SAML client has been defined: this SAML Client is referring to Identity Provider defined in the outer-keycloak instance. Using the SP metadata from that Identity Provider definition in the outer-keycloak instance.

So, in the outer-keycloak instance, a SAML Identity Provider has been defined, using the Identity Provider metadata from the realm (containing corresponding client definition) in the inner-keycloak instance.
(Also Azure Active Directory is defined in a second Identity Provider in the outer-keycloak instance - this IDP works!)
An application has been defined as SAML client in this outer-keycloak instance. Users are to be authenticated by either Azure AD (doesn't contain all users) or the LDAP Server (contains the missing users).

Using a SAML tracer, we can see that the SAML Token gets correctly created from the LDAP server, in the inner-keycloak instance. But it doesn't get transferred to the IDP of the outer-keycloak instance.

Questions:

Can this 'chaining' work in Keycloak?
We could also use openid instead of SAML, between client in inner-keycloak instance and IDP in outer-keycloak instance. If that would solve the 'connection' issue between them.
I was hoping to accomplish this with two realms in one Keycloak instance, instead of two instances of Keycloak. Could it be done with realms, also?
Do I need to use the 'Token-Exchange' preview feature to accomplish the intended chaining? I have the feature enabled.
Any pointers/suggestions that I need to pay attention to? A setting that needs changing from the default?
Can you only accomplish this by creating a custom authentication flow? In the outer-keycloak instance only? Or also in the inner-keycloak instance? Have tried configuration to make it use the default 'first broker login' and 'browser' authentication flows - also didn't help.

Any help/suggestions on this issue is very welcome.

justin-tay · 2023-09-29T11:59:00Z

justin-tay
Sep 29, 2023

It sounds like you just want to configure Identity Brokers so it's not clear what isn't working.

For instance there are Keycloak tests that configure a consumer realm and a provider realm for integration testing for the brokering.

There's no relation here with using token exchange.

2 replies

mysterypersonx Sep 29, 2023
Author

It is Identity Brokering indeed. Thanks for the link.
And there are 2 Identity Providers being brokered.
One is in the same realm, same instance, to Azure AD. The brokering works fine for this one. Client application gets the SAML Token from Azure AD via the IDP configuration for it.
The other one (IDP configuration) is to another Keycloak realm and instance acting as the Identity Provider. There it fails to pass the authentication Token from that other Keycloak realm and instance.

Looking at the documentation it fails on step 8 - I can see the SAML Token in the tracer from step 7 still.

8. Keycloak checks if the response from the identity provider is valid. If valid, Keycloak imports and creates a user if the user does not already exist. Keycloak may ask the identity provider for further user information if the token does not contain that information. This behavior is identity federation. If the user already exists, Keycloak may ask the user to link the identity returned from the identity provider with the existing account. This behavior is account linking. With Keycloak, you can configure Account linking and specify it in the First Login Flow. At this step, Keycloak authenticates the user and issues its token to access the requested resource in the service provider.

How can I get Keycloak to just pass the Identification Token from one realm to another. Or from one Keycloak instance to another. Using SAML or OpenID. Trusting the Token from the other realm, or from the other instance?

justin-tay Sep 29, 2023

I don't understand what is not working and what you mean by pass the token. What is the error message? What token? As in the SAML assertion / OpenID ID Token? After Keycloak processes the brokered Identity Provider's response it will then issue its own SAML assertion / OpenID Token based on what mappers you have configured.

mysterypersonx · 2023-10-02T11:22:05Z

mysterypersonx
Oct 2, 2023
Author

Error message I am getting now:

I checked the mappers again. They are correct I believe. The application only needs: email, firstname and lastname. I have configured it as basic.

This is the SAML Token generated by the "inner" Keycloak instance (port 9443), just before the error occurs, trying to send it back to the "outer" Keycloak instance (port 8443).

In the "outer" Keycloak instance the mapping is defined as:

6 replies

justin-tay Oct 2, 2023

The assertion is being rejected. You will need to check the logs to narrow it down.

keycloak/services/src/main/java/org/keycloak/broker/saml/SAMLEndpoint.java

Lines 411 to 598 in 9b71900

    
                   protected Response handleLoginResponse(String samlResponse, SAMLDocumentHolder holder, ResponseType responseType, String relayState, String clientId) { 
        
                       try { 
        
                           AuthenticationSessionModel authSession; 
        
                           if (clientId != null && ! clientId.trim().isEmpty()) { 
        
                               authSession = samlIdpInitiatedSSO(clientId); 
        
                           } else { 
        
                               authSession = callback.getAndVerifyAuthenticationSession(relayState); 
        
                           } 
        
                           session.getContext().setAuthenticationSession(authSession); 
        
                           if (! isSuccessfulSamlResponse(responseType)) { 
        
                               String statusMessage = responseType.getStatus() == null || responseType.getStatus().getStatusMessage() == null ? Messages.IDENTITY_PROVIDER_UNEXPECTED_ERROR : responseType.getStatus().getStatusMessage(); 
        
                               return callback.error(statusMessage); 
        
                           } 
        
                           if (responseType.getAssertions() == null || responseType.getAssertions().isEmpty()) { 
        
                               return callback.error(Messages.IDENTITY_PROVIDER_UNEXPECTED_ERROR); 
        
                           } 
        
                           boolean assertionIsEncrypted = AssertionUtil.isAssertionEncrypted(responseType); 
        
                           if (config.isWantAssertionsEncrypted() && !assertionIsEncrypted) { 
        
                               logger.error("The assertion is not encrypted, which is required."); 
        
                               event.event(EventType.IDENTITY_PROVIDER_RESPONSE); 
        
                               event.error(Errors.INVALID_SAML_RESPONSE); 
        
                               return ErrorPage.error(session, authSession, Response.Status.BAD_REQUEST, Messages.INVALID_REQUESTER); 
        
                           } 
        
                           Element assertionElement = null; 
        
                           if (assertionIsEncrypted) { 
        
                               try { 
        
                                   /* This code is deprecated and will be removed in Keycloak 24 */ 
        
                                   if (DEPRECATED_ENCRYPTION) { 
        
                                       KeyManager.ActiveRsaKey keys = session.keys().getActiveRsaKey(realm); 
        
                                       assertionElement = AssertionUtil.decryptAssertion(responseType, keys.getPrivateKey()); 
        
                                   } else { 
        
                                   /* End of deprecated code */ 
        
                                       assertionElement = AssertionUtil.decryptAssertion(responseType, new SAMLDecryptionKeysLocator(session, realm, config.getEncryptionAlgorithm())); 
        
                                   } 
        
                               } catch (ProcessingException ex) { 
        
                                   logger.warnf(ex, "Not possible to decrypt SAML assertion. Please check realm keys of usage ENC in the realm '%s' and make sure there is a key able to decrypt the assertion encrypted by identity provider '%s'", realm.getName(), config.getAlias()); 
        
                                   throw new WebApplicationException(ex, Response.Status.BAD_REQUEST); 
        
                               } 
        
                           } else { 
        
                               /* We verify the assertion using original document to handle cases where the IdP 
        
                               includes whitespace and/or newlines inside tags. */ 
        
                               assertionElement = DocumentUtil.getElement(holder.getSamlDocument(), new QName(JBossSAMLConstants.ASSERTION.get())); 
        
                           } 
        
                           // Validate the response Issuer 
        
                           final String responseIssuer = responseType.getIssuer() != null ? responseType.getIssuer().getValue(): null; 
        
                           final boolean responseIssuerValidationSuccess = config.getIdpEntityId() == null || 
        
                               (responseIssuer != null && responseIssuer.equals(config.getIdpEntityId())); 
        
                           if (!responseIssuerValidationSuccess) { 
        
                               logger.errorf("Response Issuer validation failed: expected %s, actual %s", config.getIdpEntityId(), responseIssuer); 
        
                               event.event(EventType.IDENTITY_PROVIDER_RESPONSE); 
        
                               event.error(Errors.INVALID_SAML_RESPONSE); 
        
                               return ErrorPage.error(session, authSession, Response.Status.BAD_REQUEST, Messages.INVALID_REQUESTER); 
        
                           } 
        
                           // Validate InResponseTo attribute: must match the generated request ID 
        
                           String expectedRequestId = authSession.getClientNote(SamlProtocol.SAML_REQUEST_ID_BROKER); 
        
                           final boolean inResponseToValidationSuccess = validateInResponseToAttribute(responseType, expectedRequestId); 
        
                           if (!inResponseToValidationSuccess) 
        
                           { 
        
                               event.event(EventType.IDENTITY_PROVIDER_RESPONSE); 
        
                               event.error(Errors.INVALID_SAML_RESPONSE); 
        
                               return ErrorPage.error(session, authSession, Response.Status.BAD_REQUEST, Messages.INVALID_REQUESTER); 
        
                           } 
        
                           boolean signed = AssertionUtil.isSignedElement(assertionElement); 
        
                           final boolean assertionSignatureNotExistsWhenRequired = config.isWantAssertionsSigned() && !signed; 
        
                           final boolean signatureNotValid = signed && config.isValidateSignature() && !AssertionUtil.isSignatureValid(assertionElement, getIDPKeyLocator()); 
        
                           final boolean hasNoSignatureWhenRequired = ! signed && config.isValidateSignature() && ! containsUnencryptedSignature(holder); 
        
                           if (assertionSignatureNotExistsWhenRequired || signatureNotValid || hasNoSignatureWhenRequired) { 
        
                               logger.error("validation failed"); 
        
                               event.event(EventType.IDENTITY_PROVIDER_RESPONSE); 
        
                               event.error(Errors.INVALID_SIGNATURE); 
        
                               return ErrorPage.error(session, authSession, Response.Status.BAD_REQUEST, Messages.INVALID_REQUESTER); 
        
                           } 
        
                           if (AssertionUtil.isIdEncrypted(responseType)) { 
        
                               try { 
        
                                   /* This code is deprecated and will be removed in Keycloak 24 */ 
        
                                   if (DEPRECATED_ENCRYPTION) { 
        
                                       KeyManager.ActiveRsaKey keys = session.keys().getActiveRsaKey(realm); 
        
                                       AssertionUtil.decryptId(responseType, data -> Collections.singletonList(keys.getPrivateKey())); 
        
                                   } else { 
        
                                       /* End of deprecated code */ 
        
                                       AssertionUtil.decryptId(responseType, new SAMLDecryptionKeysLocator(session, realm, config.getEncryptionAlgorithm())); 
        
                                   } 
        
                               } catch (ProcessingException ex) { 
        
                                   logger.warnf(ex, "Not possible to decrypt SAML encryptedId. Please check realm keys of usage ENC in the realm '%s' and make sure there is a key able to decrypt the encryptedId encrypted by identity provider '%s'", realm.getName(), config.getAlias()); 
        
                                   throw new WebApplicationException(ex, Response.Status.BAD_REQUEST); 
        
                               } 
        
                           } 
        
                           AssertionType assertion = responseType.getAssertions().get(0).getAssertion(); 
        
                           // Validate the assertion Issuer 
        
                           final String assertionIssuer = assertion.getIssuer() != null ? assertion.getIssuer().getValue(): null; 
        
                           final boolean asse
8000
rtionIssuerValidationSuccess = config.getIdpEntityId() == null || 
        
                               (assertionIssuer != null && assertionIssuer.equals(config.getIdpEntityId())); 
        
                           if (!assertionIssuerValidationSuccess) { 
        
                               logger.errorf("Assertion Issuer validation failed: expected %s, actual %s", config.getIdpEntityId(), assertionIssuer); 
        
                               event.event(EventType.IDENTITY_PROVIDER_RESPONSE); 
        
                               event.error(Errors.INVALID_SAML_RESPONSE); 
        
                               return ErrorPage.error(session, authSession, Response.Status.BAD_REQUEST, Messages.INVALID_REQUESTER); 
        
                           } 
        
                           NameIDType subjectNameID = getSubjectNameID(assertion); 
        
                           String principal = getPrincipal(assertion); 
        
                           if (principal == null) { 
        
                               logger.errorf("no principal in assertion; expected: %s", expectedPrincipalType()); 
        
                               event.event(EventType.IDENTITY_PROVIDER_RESPONSE); 
        
                               event.error(Errors.INVALID_SAML_RESPONSE); 
        
                               return ErrorPage.error(session, authSession, Response.Status.BAD_REQUEST, Messages.INVALID_REQUESTER); 
        
                           } 
        
                           //Map<String, String> notes = new HashMap<>(); 
        
                           BrokeredIdentityContext identity = new BrokeredIdentityContext(principal); 
        
                           identity.getContextData().put(SAML_LOGIN_RESPONSE, responseType); 
        
                           identity.getContextData().put(SAML_ASSERTION, assertion); 
        
                           identity.setAuthenticationSession(authSession); 
        
                           identity.setUsername(principal); 
        
                           //SAML Spec 2.2.2 Format is optional 
        
                           if (subjectNameID != null && subjectNameID.getFormat() != null && subjectNameID.getFormat().toString().equals(JBossSAMLURIConstants.NAMEID_FORMAT_EMAIL.get())) { 
        
                               identity.setEmail(subjectNameID.getValue()); 
        
                           } 
        
                           if (config.isStoreToken()) { 
        
                               identity.setToken(samlResponse); 
        
                           } 
        
                           ConditionsValidator.Builder cvb = new ConditionsValidator.Builder(assertion.getID(), assertion.getConditions(), destinationValidator) 
        
                                   .clockSkewInMillis(1000 * config.getAllowedClockSkew()); 
        
                           try { 
        
                               String issuerURL = getEntityId(session.getContext().getUri(), realm); 
        
                               cvb.addAllowedAudience(URI.create(issuerURL)); 
        
                               // getDestination has been validated to match request URL already so it matches SAML endpoint 
        
                               if (responseType.getDestination() != null) { 
        
                                   cvb.addAllowedAudience(URI.create(responseType.getDestination())); 
        
                               } 
        
                           } catch (IllegalArgumentException ex) { 
        
                               // warning has been already emitted in DeploymentBuilder 
        
                           } 
        
                           if (! cvb.build().isValid()) { 
        
                               logger.error("Assertion expired."); 
        
                               event.event(EventType.IDENTITY_PROVIDER_RESPONSE); 
        
                               event.error(Errors.INVALID_SAML_RESPONSE); 
        
                               return ErrorPage.error(session, authSession, Response.Status.BAD_REQUEST, Messages.EXPIRED_CODE); 
        
                           } 
        
                           AuthnStatementType authn = null; 
        
                           for (Object statement : assertion.getStatements()) { 
        
                               if (statement instanceof AuthnStatementType) { 
        
                                   authn = (AuthnStatementType)statement; 
        
                                   identity.getContextData().put(SAML_AUTHN_STATEMENT, authn); 
        
                                   break; 
        
                               } 
        
                           } 
        
                           if (assertion.getAttributeStatements() != null ) { 
        
                               String email = getX500Attribute(assertion, X500SAMLProfileConstants.EMAIL); 
        
                               if (email != null) 
        
                                   identity.setEmail(email); 
        
                           } 
        
                           String brokerUserId = config.getAlias() + "." + principal; 
        
                           identity.setBrokerUserId(brokerUserId); 
        
                           identity.setIdpConfig(config); 
        
                           identity.setIdp(provider); 
        
                           if (authn != null && authn.getSessionIndex() != null) { 
        
                               identity.setBrokerSessionId(config.getAlias() + "." + authn.getSessionIndex()); 
        
                            } 
        
                           return callback.authenticated(identity); 
        
                       } catch (WebApplicationException e) { 
        
                           return e.getResponse(); 
        
                       } catch (Exception e) { 
        
                           throw new IdentityBrokerException("Could not process response from SAML identity provider.", e); 
        
                       } 
        
                   }

mysterypersonx Oct 3, 2023
Author

that helped me a bit further.
So the error was "validation failed". Looking at the section in the code, it is related to assertion signatures. I changed the settings of the client definition in the 'inner' Keycloak instance to have the assertion signed.

and the IDP definition "idptest" in the 'outer' Keycloak instance to this:

The SAML tracer doesn't show an error anymore:

But at the end the 'outer' Keycloak instance redirects the users to this page. Asking email/username and password a second time.

and if we give email and password again, it doesn't recognize it and gives error messages:

In the Keycloak log of the 'outer' Keycloak instance, we get these messages related to this:

where the clientID and redirect_uri are the from the application defined as client in the 'outer' Keycloak instance.

So, it seems to have gotten closer!

How can we avoid this second screen for entering username/password again in Keycloak? Is this related to the authentication flows?

The authentication flows are defined as this in the 'inner' Keycloak instance for the client:

And the authentication flow is defined as this for the 'outer' Keycloak instance:

justin-tay Oct 3, 2023

Keycloak has detected that the user as defined in idptest already exists in azureadplus and so is asking to do account linkage and prompting for the credentials for logging in to azureadplus to do so. The linkage will need to be done once. Typically it will identify that a user with the same email or username is a unique user.

mysterypersonx Oct 5, 2023
Author

With the realm AZUREADPLUS selected, a search for the user that I used to test, gives nothing.
Can it be something else?

Also, do you need to create the user in the realm? Will that then happen to each user that authenticates via Keycloak? And if it is necessary, can you overwrite/refresh existing user in the Keycloak realm automatically, each time the user is authenticated? To avoid this 'screen' and question to link account to account in i

justin-tay Oct 5, 2023

That would be rather unusual. This is following the default first broker login authentication flow. If the user doesn't exist it will create the user, if the user exists it then it will attempt to do the linkage.

You might want to read the documentation for First login flow and see if any of the options meets your needs. For instance Disabling automatic user creation.

skn33 · 2025-05-28T12:36:01Z

skn33
May 28, 2025

dont know if it has been solved, anyway I have been facing the same issue, the pb is that I have updated the alias of the IDP, when u change the alias, the redirect URI is changed automatically, so need to update the URL in the SAML IDP

0 replies

Navigation Menu

Repository navigation

simple chaining of Keycloak #23599

Uh oh!

{{title}}

Uh oh!

Replies: 3 comments 8 replies

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

simple chaining of Keycloak #23599

Uh oh!

mysterypersonx Sep 29, 2023

Replies: 3 comments · 8 replies

Uh oh!

justin-tay Sep 29, 2023

Uh oh!

mysterypersonx Sep 29, 2023 Author

Uh oh!

justin-tay Sep 29, 2023

Uh oh!

mysterypersonx Oct 2, 2023 Author

Uh oh!

justin-tay Oct 2, 2023

Uh oh!

mysterypersonx Oct 3, 2023 Author

Uh oh!

justin-tay Oct 3, 2023

Uh oh!

mysterypersonx Oct 5, 2023 Author

Uh oh!

justin-tay Oct 5, 2023

Uh oh!

skn33 May 28, 2025

mysterypersonx
Sep 29, 2023

Replies: 3 comments 8 replies

justin-tay
Sep 29, 2023

mysterypersonx Sep 29, 2023
Author

mysterypersonx
Oct 2, 2023
Author

mysterypersonx Oct 3, 2023
Author

mysterypersonx Oct 5, 2023
Author

skn33
May 28, 2025