问题
I'm using Keycloak version 1.6.1, newly installed as a standalone application.
Keycloak should act as an IdP (Identity provider) for an SP (Service Provider) called Tableau.
I have read from this page: http://blog.keycloak.org/2015/03/picketlink-and-keycloak-projects-are.html
... Keycloak from being Identity Broker grew into being fully fledged Identity Provider
While it was an Identity Broker, it is now also an Identity Provider.
My question is then:
I have exported the SP XML Metadata from Tableau, which I imported into Keycloak, but when it comes to the export of the IdP XML Metadata from Keycloak (which should be imported into Tableau) I cannot find the button/command/guide anything about how to export this XML file.
I have worked with other IdPs and they all support this export of IdP Metadata which you can see an example of here: https://docs.oracle.com/cd/E19636-01/819-7664/g2enua/index.html
If I search for Keycloak and the keyword IDPSSODescriptor I find this: grepcode.com/file/repo1.maven.org/maven2/org.keycloak/keycloak-saml-protocol/1.1.0.Beta2/idp-metadata-template.xml
Which is exactly the 'template' I need, with the correct links on all ${idp.sso.HTTP-POST} etc. places.
Should I create the file manually - if so how do I find the correct POST, REDIRECT etc. URLs?
Or is there some way of exporting this file I haven't seen?
回答1:
Sometimes it's a good thing to specify in writing what you need - which I did here on Stack Overflow.
I found the URL to where on Keycloak one can export the IdP XML
https://keycloak-url/realms/{REALM-NAME}/protocol/saml/descriptor
That gave me the IDPSSODescriptor.
I'll leave this thread here, so people can benefit from my mistakes.
回答2:
Since Keycloak 3.x, IdP XML descriptor needs /auth/ after keycloak-url
https://{KEYCLOAK-URL}/auth/realms/{REALM-NAME}/protocol/saml/descriptor
回答3:
The original poster is correct that the option SAML Metadata IDPSSODescriptor is no longer available on Keycloak 6.0.1
One change to make is when you use the URL https://{KEYCLOAK-URL}/auth/realms/{REALM-NAME}/protocol/saml/descriptor, Rancher expects the root element to be EntityDescriptor so you need to remove EntitiesDescriptor and copy the namespaces from the root element.
i.e.
<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#" entityID="https://{KEYCLOAK-URL}/auth/realms/{REALM-NAME}">
....
</EntityDescriptor>
来源：https://stackoverflow.com/questions/33542812/keycloak-idp-saml-2-export-of-xml-metdata-to-an-sp