You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Service Provider SAML Application Multi Tenancy Scenario
#38431
Hi Team,
While integrating a Saml SP application with keycloak, we stumbled on an issue where SP application supports MSP functionality (multi tenancy),
so multiple saml clients needs to be created in a keycloak realm.
But SP app's EntityID(client id of saml app) and the ACS(Assertion consumer service url) are same for all tenants. Example values : https://spapp.net/saml and https://spapp.net/callback
Since we cannot add multiple saml clients in a keycloak realm using same client id, we are unable to proceed with integration.
When checked with SP app, they claim that integration works with okta.
(The issue can be resolved by integrating each SP tenant saml app in a separate realm, but due to overall integration of the product this is not desirable.)
Queries :
In a multi tenant scenario, is it mandatory that SP application should support unique per tenant SP EntityID and ACS url? The RFC doesnot have any say on multi tenancy scenarios.
Since okta creates unique IDP Issuer and IDP SSO Url per saml app, the integration works. So is there anyway to achieve the same within a keycloak realm?
reacted with thumbs up emoji reacted with thumbs down emoji reacted with laugh emoji reacted with hooray emoji reacted with confused emoji reacted with heart emoji reacted with rocket emoji reacted with eyes emoji
Uh oh!
There was an error while loading. Please reload this page.
Hi Team,
While integrating a Saml SP application with keycloak, we stumbled on an issue where SP application supports MSP functionality (multi tenancy),
so multiple saml clients needs to be created in a keycloak realm.
But SP app's EntityID(client id of saml app) and the ACS(Assertion consumer service url) are same for all tenants. Example values :
https://spapp.net/saml and https://spapp.net/callback
Since we cannot add multiple saml clients in a keycloak realm using same client id, we are unable to proceed with integration.
When checked with SP app, they claim that integration works with okta.
(The issue can be resolved by integrating each SP tenant saml app in a separate realm, but due to overall integration of the product this is not desirable.)
Queries :
All reactions