Exchange external SAML assertion to internal OIDC token #16245

raulvaldoleiros · 2023-01-04T12:35:18Z

raulvaldoleiros
Jan 4, 2023

Hi,

I have an use case where we need to exchange an external SAML assertion to an internal OIDC token through keycloak.
We want to configure this external third party as an identity provider using SAML protocol and after getting the SAML assertion use token-exchange to get the oidc token in our keycloak realm.

I found this documentation and looks like this isn't possible right now.
Right now I have two questions:

Is there other way to do it? We want to keep our internal services to authenticate through oidc token (jwt)
Any preview when this feature will be added to keycloak?

Thanks,
Raul

raulvaldoleiros · 2023-01-19T11:00:11Z

raulvaldoleiros
Jan 19, 2023
Author

Actually works more or less like this:

Open web app login page
choose saml login and execute the login
When returning to the web app, it's possible to return the jwt
All of this using the libraries I shared with you. I think the workflow is the normal workflow for sso with saml.

0 replies

raulvaldoleiros · 2023-01-19T07:27:24Z

raulvaldoleiros
Jan 19, 2023
Author

What we did was to use the keycloak.js and keycloak-angular libraries to open keycloak login pages, we added the idp hint to open directly the identity provided (documentation here: https://www.keycloak.org/docs/latest/server_admin/#_client_suggested_idp). Then, somehow, the oidc token is available on the browser and we just start using it.
This example helped us: https://b-nova.com/en/home/content/sso-with-quarkus-angular-and-keycloak

1 reply

phamann Jan 19, 2023

Thanks for the quick reply @raulvaldoleiros. So to understand further:

after the SAML login you redirect to your application
then get keycloak.js to initiate a new new OIDC authentication flow back to keycloak, but this time passing the passing the idp_hint (which you extracted from the saml assertion?)
keycloak will then redirect to the external IdP again but because there is an existign session it redirects instantly
keycloak generates the OIDC access token and returns back to your application

Correct?

I can see how this may be the only temproary solution until keycloack supports saml-to-oidc token exchange, however, my only concern is the user expereince. I.e. the user will notice that they get redirected to the external IdP twice during the flow? Have you found this to be an issue?

phamann · 2023-01-18T22:27:11Z

phamann
Jan 18, 2023

I'm also looking for exctly this functionality, so would be interested in what you've decided to do in absence of the feature existing in Keycloak?

After some further research it seems that Keycloak needs to support the urn:ietf:params:oauth:grant-type:saml2-bearer authorization grant type, which is specficed in https://www.rfc-editor.org/rfc/rfc7522 , for token exchange.

0 replies

Navigation Menu

Repository navigation

Exchange external SAML assertion to internal OIDC token #16245

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Replies: 3 comments 1 reply

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Select a reply

Uh oh!

Exchange external SAML assertion to internal OIDC token #16245

Uh oh!

Uh oh!

raulvaldoleiros Jan 4, 2023

Replies: 3 comments · 1 reply

Uh oh!

raulvaldoleiros Jan 19, 2023 Author

Uh oh!

raulvaldoleiros Jan 19, 2023 Author

Uh oh!

Uh oh!

phamann Jan 19, 2023

Uh oh!

Uh oh!

phamann Jan 18, 2023

raulvaldoleiros
Jan 4, 2023

Replies: 3 comments 1 reply

raulvaldoleiros
Jan 19, 2023
Author

raulvaldoleiros
Jan 19, 2023
Author

phamann
Jan 18, 2023