Keycloak IDP-initiated flow with OIDC application #37669

rtufisi · 2025-02-26T18:57:59Z

rtufisi
Feb 26, 2025

Hello community,

I have the following situation:

In the realm called: test-realm

An application that uses OIDC for authentication with Keycloak (e.q: we can also use the security-admin-console for this example).
A Keycloak Identity provider 'okta-broker' used to consume the SAMLResponse from Okta when the user click the Application to initiate the flow.
A Keycloak SAML 2.0 client 'test-client-saml-oidc' with the IDP-Initiated SSO URL name: okta-client
A OKTA identity provider with the IDP-initiated flow setup configured. The Single Sign on URL : {kc_domain}/realms/test-realm/broker/okta-broker/endpoint/clients/okta-client

By default the SAML 2.0 client configured at step 3 will forward the response from Okta to another entity which consumes SAML. For OIDC this doesn't work out of the box.
What I did was to go to the client Advanced Settings and enable the REDIRECT binding, which I populated with the value of the HomeUrl "http://localhost:8080/admin/test-realm/console" of the 'security-admin-console'.

Exported client.json:

{
  "clientId": "test-client-saml-oidc",
  ....
  "bearerOnly": false,
  "consentRequired": false,
  "standardFlowEnabled": true,
  "implicitFlowEnabled": false,
  "directAccessGrantsEnabled": true,
  "serviceAccountsEnabled": false,
  "publicClient": true,
  "frontchannelLogout": true,
  "protocol": "saml",
  "attributes": {
    "saml_assertion_consumer_url_redirect": "http://localhost:8080/admin/test-realm/console/",
    "saml.force.post.binding": "false",
    "saml_idp_initiated_sso_url_name": "okta-client"
    ...
  },
  "authenticationFlowBindingOverrides": {},
  "fullScopeAllowed": true,
  "nodeReRegistrationTimeout": -1,
  "defaultClientScopes": [
    "saml_organization",
    "role_list"
  ],
  "optionalClientScopes": [],
  "access": {
    "view": true,
    "configure": true,
    "manage": true
  }
}

With this method I'm logged in in both the SAML client 'test-client-saml-oidc' and the 'security-admin-console'.

This is possible because the "browser" authentication flow has the "CookieAuthenticator" which will attach a session in security-admin-console to the root session test-client-saml-oidc.
Could a similar logic be added to the SAML client (or a special client implementation) in order to make the IDP-init client to redirect to a OIDC application?

Answered by anish-pr

Apr 7, 2025

@rtufisi were you able to find a solution for this ?
I was looking at https://phasetwo.io/blog/keycloak-saml-identity-provider-idp-initiated-flow-with-okta/
It does login, But i had issues going back to the original url the user was in. It always goes to home page

View full answer

anish-pr · 2025-04-07T04:33:15Z

anish-pr
Apr 7, 2025

@rtufisi were you able to find a solution for this ?
I was looking at https://phasetwo.io/blog/keycloak-saml-identity-provider-idp-initiated-flow-with-okta/
It does login, But i had issues going back to the original url the user was in. It always goes to home page

1 reply

rtufisi Apr 7, 2025
Author

Hello @anish-pr .Yes I have written about an alternative solution in the blog post here https://phasetwo.io/blog/keycloak-saml-identity-provider-idp-initiated-flow-with-okta/#idp-initiated-flow-redirects-to-a-oidc-application. Please try it and let me know if it helps

Navigation Menu

Repository navigation

Keycloak IDP-initiated flow with OIDC application #37669

Uh oh!

{{title}}

Uh oh!

Replies: 1 comment 1 reply

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit 8000

Uh oh!

Select a reply

Uh oh!

Keycloak IDP-initiated flow with OIDC application #37669

Uh oh!

rtufisi Feb 26, 2025

Replies: 1 comment · 1 reply

Uh oh!

Uh oh!

anish-pr Apr 7, 2025

Uh oh!

Uh oh!

rtufisi Apr 7, 2025 Author

rtufisi
Feb 26, 2025

Replies: 1 comment 1 reply

anish-pr
Apr 7, 2025

rtufisi Apr 7, 2025
Author