Configuring the Identity Provider

SAML Integration Guide for PTT Pro and Profile Manager

Use the information from the SAML Descriptor file to configure the Identity Provider.

Click on

Identity Providers

in the left pane of the Keycloak user interface.

Select

SAML v2.0

from the Add Provider drop-down menu.

Configure OAuth.

Enter the redirect URL in the

Redirect URI

field.

The Redirect URI entry is constructed as follows:

https://wfc-keycloak.pttpro.zebra.com/auth/realms/<realm-name>/broker/<alias>/endpoint

The

<Alias>

is a convenient label. Change it to an appropriate value. In this example, the alias is

WFC-SAML-Auth

that results in the following redirect URI:

https://wfc-keycloak.pttpro.zebra.com/auth/realms/WFC-SAML-Test-Realm/broker/WFC-SAML-Auth/endpoint

Set

Enable

to on.

Configure SAML.

Enter the single sign-on URL in the

Single Sign-On URL Service

field.

The Single Sign-On Service URL can be copied from the

paramter in the SAML Descriptor file. In this example it is:

https://wfc-keycloak2.pttpro.zebra.com/auth/realms/WFC-SAML-Test-Realm/protocol/saml

Enter the single logout service URL in the

Single Logout Service URL

field.

The Single Logout Service URL can be copied from the

parameter in the SAML Description file.

Enable

Validate Signature

Enable

HTTP-POST Binding Response

Enable

HTTP-POST Binding for AuthnRequest

Enable

HTTP-POST Binding Logout

Enable

Want AuthnRequests Signed

Click

Save

Entering these URLs causes the ACS service to read the descriptor file and populate the x509 Certificate and the Signature Algorithm fields.