Differences

This shows you the differences between two versions of the page.

--- en:2.0:single_sign_on:saml_keycloak [2025/05/11 02:11] – kainhofer
+++ en:2.0:single_sign_on:saml_keycloak [2026/09/09 20:28] (current) – [Profile Attributes from Admidio] kainhofer
@@ Line 9: / Line 9: @@
 Throughout the document we will assume you have both Admidio and Keycloak already set up properly at https://admidio.local/ and https://keycloak.local/. Please modify these URLs to your actual installation.
-As a first step, one needs to **configure Admidio to act as a SAML 2.0 Identity Provider** (IdP). This has to be done once and is not specific to any client. Please follow this guide: [[en:2.0:single_sign_on|#a_basic_setup_for_admidio_as_a_saml_id_provider]]
+As a first step, one needs to **configure Admidio to act as an SAML 2.0 Identity Provider** (IdP). This has to be done once and is not specific to any client. Please follow this guide: [[en:2.0:single_sign_on|#a_basic_setup_for_admidio_as_a_saml_id_provider|follow this guide]].
 {{ :en:2.0:sso:sso_saml_01-05_setup_admidio_preferences.png?direct&600 |}}
-Basically, one (1) needs to **create a cryptographic key** to sign message and **choose a unique EntityID**.
+Basically, one needs to enable SAML 2.0 and **choose a unique EntityID**.
-The page preferences https://admidio.local/modules/preferences.php?panel=sso also provides the link to the metadata xml, and the individual settings in case a client does not support auto-configuration via metadata.
+The page https://admidio.local/adm_program/modules/preferences.php?panel=sso provides the link to the metadata xml, and the individual settings in case a client does not support auto-configuration via metadata.
 ===== Quick Overview =====
-Setting up a client (SAML "Service Provider" - short SP) to use Admidio's user accounts for logging in consists of two steps. If both the IdP (Admidio in our case) and the SP (Keycloak in this document) support metadata loading, the setup is very straightforward and easy. Otherwise, one has to copy URLs manually to the client, but Admidio already provides these in a single place, so this situation is not as bad, either.
+Setting up a client (SAML "Service Provider" = "SP") to use Admidio's user accounts for log-in consists of two steps. If both the IdP (Admidio in our case) and the SP (Keycloak in this document) support metadata loading, the setup is very straightforward and easy. Otherwise, one has to copy URLs manually to the client, but Admidio already provides these in a single place, so this case is also straightforward.
   * Configure the Service Provider (SP) -- Keycloak in our case -- with Admidio's link to the **metadata file**, which will tell Keycloak the URLs for the SSO, logout endpoints, and which key is used for signatures.
   * In **Admidio**, **create a new SAML client**. Keycloak provides a **metadata URL** to configure the IdP. Paste that URL into Admidio it and let it automatically load the configuration from Keycloak.
-    * Choose an easily understood **label for the client** (only used in Admidio's list of clients, but has no technical use)
+    * Choose an easily understood **label for the client** (only used in Admidio's list of clients as visual identifier, but has no technical use)
   * In Admidio, also choose whether sent messages should be **signed or encrypted**. The crypto key generated in the general SAML setup will be used.
   * Optionally select which **profile fields should be mapped** to SAML attributes and sent to the client, and configure which **group memberships** should be transmitted.
@@ Line 55: / Line 58: @@
 Keycloak also provides some more configuration settings that allow fine-tuning the SAML login behavior. The defaults should work fine, but changes can be made if other settings are prefered.
 {{:en:2.0:sso:sso_saml_keycloak_04_config_keycloak.png?direct&400|}}{{:en:2.0:sso:sso_saml_keycloak_04b_config_keycloak.png?direct&400|}}
@@ Line 62: / Line 66: @@
 {{ :en:2.0:sso:sso_saml_keycloak_04d_config_admidio_mapping.png?direct&400 |}}
-Unfortunately, there is no specification of the meaning of particular SAML attributes, so Keycloak by default does map those fields to its user's profile data. One can set up attribute mappers in Keycloak to use SAML attributes and assign them to the user's profile.
+Unfortunately, there is no specification of the meaning of particular SAML attributes, so Keycloak by default does not map those fields to its user's profile data. One can set up attribute mappers in Keycloak to use SAML attributes and assign them to the user's profile.
 Go to the "Mappers" tab of the SAML provider in Keycloak and add new mappers of type "Attribute Importer". It is a good idea to choose "Force", which will always update the keycloak user with the value from Admidio on every login. The "Attribute Name" is the SAML attribute, while the "User Attribute Name" is Keycloak's profile field name.
 {{ :en:2.0:sso:sso_saml_keycloak_04c_config_mappers.png?direct&600 |}}
@@ Line 89: / Line 93: @@
-===== Multiple SSO providers for the same account =====
+=== Multiple SSO providers for the same account ===
 If the account already exists (e.g. because you are in a hybrid setup with multiple identity providers, e.g. SAML and OpenID through Admidio), then Keycloak will ask for permission to add the SAML login to the existing account. The user must additionally log in to the existing account to prevent security issues:
-{{ :en:2.0:sso:sso_saml_keycloak_09_login_accountexists.png?direct&400 |}}{{ :en:2.0:sso:sso_saml_keycloak_10_login_link_login.png?direct&400 |}}
+{{:en:2.0:sso:sso_saml_keycloak_09_login_accountexists.png?direct&400|}}{{:en:2.0:sso:sso_saml_keycloak_10_login_link_login.png?direct&400|}}
+{{ :en:2.0:sso:sso_oidc_keycloak_10_linkedaccounts.png?direct&800 |}}