Configuring Keycloak
Keycloak is an open source identity and access management technology that integrates with applications in the cloud, on-premises, or on a mobile device. This documentation describes how to configure a single sign-on integration between Keycloak as the Identity Provider (IdP) and the Single Sign-On Service (SSO) for Security Journey as the Service Provider (SP).
All SSO communication takes place over TLS/SSL.
Configuring Keycloak as IdP
In your Keycloak admin console, select the realm that you want to use.
From left menu, select Clients.
Create a new client/application. Configure the following:
Client ID:
urn:amazon:cognito:sp:us-east-1_CHi5tsM8XName: Security Journey
Description: Security Journey
Enabled:
ONConsent Required:
OFFClient Protocol:
samlInclude AuthnStatement:
ONInclude OneTimeUse Condition:
OFFForce Artifact Binding:
OFFSign Documents:
ONOptimize REDIRECT signing key lookup:
OFFSign Assertions:
ONSignature Algorithm:
RSA_SHA256SAML Signature Key Name:
NONECanonicalization Method:
EXCLUSIVEEncrypt Assertions:
OFFClient Signature Required:
OFFForce POST Binding:
ONFront Channel Logout:
OFFForce Name ID Format:
ONName ID Format:
EmailRoot URL:
https://auth.hackedu.com/saml2/idpresponseValid Redirect URIs:
https://app.hackedu.com/*
Click on Save.
Screenshot of these settings:
Automatically Sync Teams to HackEDU (optional)
If you want to automatically sync Teams from your SSO provider to HackEDU, follow these instructions.
Upload HackEDU Metadata File
Export a metadata.xml file from your Keycloak client. From the Installation tab, choose the SAML Metadata IDPSSODescriptor format option and download your file.
Additional Resources
Additional instructions can be found in KeyCloak's Documentation.