From c3d121760c36bca1bc0e89e495431ce00fbd1d6d Mon Sep 17 00:00:00 2001 From: Daniel Koopmans Date: Sat, 24 Aug 2019 00:46:14 +0200 Subject: [PATCH] Added instructions/workaround for Keycloak 6.0.1 SAML Metadata IDPSSODescriptor is no longer available on Keycloak 6.0.1. --- .../authentication/keycloak/_index.md | 22 +++++++++++++++++++ 1 file changed, 22 insertions(+) diff --git a/content/rancher/v2.x/en/admin-settings/authentication/keycloak/_index.md b/content/rancher/v2.x/en/admin-settings/authentication/keycloak/_index.md index 6eb4373db2d..e54a31355dd 100644 --- a/content/rancher/v2.x/en/admin-settings/authentication/keycloak/_index.md +++ b/content/rancher/v2.x/en/admin-settings/authentication/keycloak/_index.md @@ -88,3 +88,25 @@ You are correctly redirected to your IdP login page and you are able to enter yo * Check your Keycloak log. * If the log displays `request validation failed: org.keycloak.common.VerificationException: SigAlg was null`, set `Client Signature Required` to `OFF` in your Keycloak client. + +### Keycloak 6.0.0+: IDPSSODescriptor missing from options + +SAML Metadata IDPSSODescriptor is no longer available on Keycloak 6.0.0+. You can still get the XML from the following url: + +`https://{KEYCLOAK-URL}/auth/realms/{REALM-NAME}/protocol/saml/descriptor` + +At the moment of writing rancher (rancher 2.2.7) wants the root element to be `EntityDescriptor` rather than `EntitiesDescriptor` follow the the steps to adjust the xml: + + * Copying the tags from `EntitiesDescriptor` to the `EntityDescriptor`. + * Remove the `` tag from the beginning. + * Remove the `` from the end of the xml. + +You are left with something similar as the example below: + +``` + + .... + + +``` +