1. Configure Keycloak 15 as the Identity Provider (IdP) Liferay 7.4
Keycloak will manage your users and issue SAML assertions.
·
Create a SAML
Client:
1.
Log in to the
Keycloak Admin Console and go to Clients
> Create.
2.
Client ID: Use a unique identifier (e.g., liferay-saml-sp).
3.
Client Protocol: Select saml.
4.
Client SAML
Endpoint: Use Liferay's ACS URL: https://[your-domain]/c/portal/saml/acs.
·
Adjust Client
Settings:
1.
Valid Redirect
URIs: Set to https://[your-domain]/*.
2.
Name ID Format: Set to email or username based on your Liferay user mapping.
3.
Force Name ID
Format: Set to On.
4.
Client Signature
Required: Set to Off for initial testing, though recommended On for production once certificates are exchanged.
·
Export Metadata: Go to Realm
Settings > General
and click on SAML 2.0
Identity Provider Metadata. Save this XML file; you will need
it for Liferay.
2. Configure Liferay 7.4 EE as the Service Provider (SP)
In Liferay 7.4, SAML is built-in and configured via the SAML Admin panel. [1]
·
General Setup:
1.
Navigate to Global Menu → Control Panel → Security → SAML Admin.
2.
Set SAML Role to Service Provider.
3.
Entity ID: Enter the same Client ID used in Keycloak (e.g., liferay-saml-sp).
4.
Click Create Certificate and
provide the required details (Common Name, Organization, etc.).
·
Identity Provider
Connection:
1.
Go to the Identity Provider Connections
tab and click Add Identity
Provider.
2.
Name: Enter Keycloak.
3.
Entity ID: This is found in the Keycloak metadata XML (usually the realm URL).
4.
Metadata: Select Upload
Metadata XML and upload the file you saved from Keycloak.
5.
Name Identifier
Format: Ensure this matches Keycloak (e.g., Email Address).
6.
Check Enabled and Save.
3. Map Attributes (Optional but Recommended)
To ensure Liferay automatically creates/updates users with the correct
data, map Keycloak attributes to Liferay fields in the Identity Provider Connection
settings: [1]
·
emailAddress ↔ email
Comments
Post a Comment