KeyCloak SAML SSSO with WordPress
This blog discusses about the wordpress SAML SSO woth KeyCloak IAM
- Start wordpress install miniOrange SSO using SAML 2.0 plugin.
- Start keycloak server in administartor mode.
- In your Keycloak admin console, select the realm that you want to use.
- From left menu, select Clients.
- Create a new client/application. Configure the following:
Client ID – The SP-EntityID / Issuer from the wordpress plugin under Identity Provider tab
Name – Provide a name for this client (Eg. WordPress)
Description – Provide a description (Eg. WordPress site)
Enabled – ON
Client Protocol – SAML
Include AuthnStatement – ON
Sign Documents – ON
Sign Assertions – ON
Signature Algorithm – RSA_SHA256
Canonicalization Method – EXCLUSIVE
Force Name ID Format – ON
Name ID Format – Email
Root URL – The ACS (Assertion Consumer Service) URL from the wordpress plugin under Identity Provider tab.
Valid Redirect URIs – The ACS (Assertion Consumer Service) URL from the wordpress plugin under Identity Provider tab.
- Under Fine Grain SAML Endpoint Configuration, configure the following:
Assertion Consumer Service – The ACS (Assertion Consumer Service) URL from the POST Binding URL wordpress plugin under Identity Provider tab.
- Click on Save.
- Configuring WordPress as SP in WordPress
- Go to,
http://<YOUR_DOMAIN>>/auth/realms/{YOUR_REALM}/ protocol/ saml/ descriptor. This will open an XML in the browser.
- In miniOrange SAML plugin, go to Service Provider Tab. Enter the following values:
Identity Provider Name – Keycloak
IdP Entity ID or Issuer – Search for entityID. Enter it’s value in this textbox.
SAML Login URL – Search for SingleSignOnService Binding= “urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect”. Enter the Location value in the textbox.
X.509 Certificate – Enter the X509Certificate tag value in this textbox
- In miniOrange SAML plugin, go to Attribute/RoleMapping tab. Enter the following values:
Username – Name of the username attribute from IdP (Keep NameID by default)
Email – Name of the email attribute from IdP (Keep NameID by default)
FirstName – Name of the firstname attribute from IdP
LastName – Name of the lastname attribute from IdP
- Under the Role Mapping section, configure which GROUP value coming in the SAML response needs to be mapped to which role in WordPress. The Group value coming in the SAML response will be mapped to the Role assigned here and the user will be assigned that role in WordPress.
Keep all values as it is. Click Save.
- Go to SSO Login Settings tab. Enable Check this option if you want to add a Widget to your page under Use a Widget.
11.1. Go to Appearances > Widgets.
11.2. Select “Login with Keycloak“. Drag and drop to your favourite location and save.
- Hit the URL : http://localhost/wordpress
- Click on login with Keycloak, you will be directed to Keycloak Authentication page.
- Login with registered email and password.
You will see it redirects to word press and user is logged in.
Tidak ada komentar:
Posting Komentar