---
title: Keycloak
slug: keycloak
docTags: 
createdAt: 2021-11-09T09:05:54.000Z
---

# Setup with Keycloak as SAML Identity Provider

## Keycloak settings

1. In the Keycloak admin console, head to Clients and click Create
2. Select SAML as Client Protocol and complete the ClientID and Client SAML Endpoint with the Echoes SP information that can be found on the [configuration page](https://app.echoeshq.com/admin/security).
3. Click Save.

![](https://api.archbee.com/api/optimize/cnN9HGi_h1eJLSFAvJkF4/b-auxETIr5H6rS-sG_Wii_keycloak-idp.png "Create SAML client")

You will then be redirected to the Keycloak configuration page of the client for further configuration.

On this page, you should have the following configuration

:::hint{type="warning"}
- **Client Signature Required** should be turned **OFF**
- **Sign Documents **&** Sign Assertions **should be turned** ON**
:::

![](https://api.archbee.com/api/optimize/cnN9HGi_h1eJLSFAvJkF4/mtrrnIiQkLxgwEvwBRu31_localhost8080authadminmasterconsole.png "SAML client full configuration")

In the **Mappers** section, configure the SAML attributes mapping required by Echoes.

![](https://api.archbee.com/api/optimize/cnN9HGi_h1eJLSFAvJkF4/FKJJf9j0PUegmhfeOhQZt_screenshot-2021-11-09-at-103925.png "Attributes mapping")

All attribute's NameFormat should be **Basic.**

::Image[]{src="https://api.archbee.com/api/optimize/cnN9HGi_h1eJLSFAvJkF4/yUy9CLjR6YZPM6WS9_W6W_screenshot-2021-11-09-at-104003.png" size="80" width="1560" height="906" caption="Email attribute" position="center" showCaption="true"}

::Image[]{src="https://api.archbee.com/api/optimize/cnN9HGi_h1eJLSFAvJkF4/7UJYtQSjorBKBXJp3re9m_screenshot-2021-11-09-at-104135.png" size="80" width="1558" height="772" caption="LastName attribute" position="center" showCaption="true"}

::Image[]{src="https://api.archbee.com/api/optimize/cnN9HGi_h1eJLSFAvJkF4/CoAtUOfQVm_jMte1-ujNc_screenshot-2021-11-09-at-104216.png" size="80" width="1568" height="776" caption="Firstname attribute" position="center" showCaption="true"}

## Echoes settings

### SAML Sign-in URL 

Should have the form of: https\://\<your-keycloak-domain>/auth/realms/\<your-realm>/protocol/saml&#x20;

### Public Key x.509 Certificate&#x20;

Can be found in the Keycloak realm's **Keys ->** **Certificate**.