Guides

Set up SAML with Keycloak

Step by step: register a SAML application in Keycloak, then check the sign-in with ID-Kit.

The steps

1. Admin console → your realm → Clients → Create client → Client type SAML, Client ID = https://app.example.com/saml/metadata.

2. In Settings: Valid redirect URIs = https://app.example.com/saml/acs ; Master SAML Processing URL = https://app.example.com/saml/acs ; Name ID format = email.

3. Keys tab: if "Client signature required" is on, either disable it for the test, or import ID-Kit's certificate (enable "Sign the request" in ID-Kit).

4. IdP metadata: https://YOUR-KEYCLOAK/realms/YOUR-REALM/protocol/saml/descriptor — paste it into ID-Kit.

Check the sign-in

Start a sign-in, get the SAML response, then paste it into theanalyseur : ID-Kit checks the signature, audience, receiving address and clock.

Common errors

• Keycloak: “Invalid parameter: redirect_uri”
• Keycloak: “Invalid client credentials” or “Client not found”
• “Invalid signature” / “digest mismatch”
• “Wrong ACS URL” / “Recipient” / “Destination”