KB No. 18: Using Keycloak as an Identity Provider (IdP) with OLFEO SaaS

Introduction

This KB explains how to configure Keycloak as an identity provider (IdP) for OLFEO SaaS, via SAML. Once these steps have been completed, your users will be able to log in to OLFEO by authenticating themselves on Keycloak.

Prerequisites

  1. Synchronization machine
    • A server equipped with an Olfeo synchronization agent to retrieve user accounts.
  2. DNS alias

Please note: The case below represents if Keycloak is configured to read emails by default.

Preparation of the synchronization agent

  1. Open your agent configuration
  2. Change the attribute mapping:

SAMAccountName → email


Creating a dedicated realm in Keycloak
  1. Log in to the Keycloak admin console.
  2. In Master (top left), click Add realm.
  3. Give it a descriptive name (e.g., olfeo-saas).

SAML Client Configuration
  1. Select your newly created Realm.
  2. In the left menu, click on Clients, then Create.
  3. Please provide the following information:
    • Client ID: olfeo login link
    • Client Type: SAML
  4. Click Save and follow the configuration steps (Endpoints, Signature, etc.).

     

     

Important 

  • In the Keys tab, disable authentication key signing if you encounter 500 errors.
  • In SAML Settings, set NameID Format to email and enable Force NameID Format.

SAML metadata retrieval

  1. Go to Realm Settings > Endpoints.
  2. Click SAML 2.0 Identity Provider Metadata to download the XML file.
  3. Import this XML into the OLFEO SaaS administration interface.

     

Tip: Open the XML file in a text or code editor to verify that the format is correct before importing.

Synchronizing users from Active Directory

  1. In your Realm, open User Federation > Add provider > ldap.
  2. Fill in:
    • Connection URL (e.g., ldap://ad.mydomain.com:389)
    • Bind DN and Bind Credential
    • User DN (the container where accounts are stored)
  3. Enable Read Only if you do not want to create or modify accounts from Keycloak.
  4. Click Test connection, then Save.
  5. Run a manual sync to verify the import of users.

Expected success message:

 

 Checks and error resolution

  • Email as username In Realm Settings > Login, enable Email as username to use your email address as your login ID.
  • Invalid requester error If, when connecting for the first time, Keycloak returns an Invalid requester error, go back to Clients > Keys and disable key signing.