Keycloak IdP SAML 2 Export of XML metdata to an SP

Question

I'm using Keycloak version 1.6.1, newly installed as a standalone application.

Keycloak should act as an IdP (Identity provider) for an SP (Service Provider) called Tableau.

I have read from this page: http://blog.keycloak.org/2015/03/picketlink-and-keycloak-projects-are.html

... Keycloak from being Identity Broker grew into being fully fledged Identity Provider

While it was an Identity Broker, it is now also an Identity Provider.

My question is then:

I have exported the SP XML Metadata from Tableau, which I imported into Keycloak, but when it comes to the export of the IdP XML Metadata from Keycloak (which should be imported into Tableau) I cannot find the button/command/guide anything about how to export this XML file.

I have worked with other IdPs and they all support this export of IdP Metadata which you can see an example of here: https://docs.oracle.com/cd/E19636-01/819-7664/g2enua/index.html

If I search for Keycloak and the keyword IDPSSODescriptor I find this: grepcode.com/file/repo1.maven.org/maven2/org.keycloak/keycloak-saml-protocol/1.1.0.Beta2/idp-metadata-template.xml

Which is exactly the 'template' I need, with the correct links on all ${idp.sso.HTTP-POST} etc. places.

Should I create the file manually - if so how do I find the correct POST, REDIRECT etc. URLs?

Or is there some way of exporting this file I haven't seen?

Answer 1

Since Keycloak 3.x, IdP XML descriptor needs /auth/ after keycloak-url

https://{KEYCLOAK-URL}/auth/realms/{REALM-NAME}/protocol/saml/descriptor

Answer 2

The original poster is correct that the option SAML Metadata IDPSSODescriptor is no longer available on Keycloak 6.0.1

One change to make is when you use the URL https://{KEYCLOAK-URL}/auth/realms/{REALM-NAME}/protocol/saml/descriptor, Rancher expects the root element to be EntityDescriptor so you need to remove EntitiesDescriptor and copy the namespaces from the root element.

i.e.

<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#" entityID="https://{KEYCLOAK-URL}/auth/realms/{REALM-NAME}">
  ....

</EntityDescriptor>