🔑Configure SAML authentication

This document outlines the steps to configure SAML2 authentication.

Configuration

SAML2 Identity Provider side (Your Identity Provider)

Go to your OIDC Provider administration console and configure the necessary settings for SAML2 authentication:

1. Create the SAML2 Client in your Identity Provider.

2. Set the Assertion Consumer URL to https://<app hostname>/api/auth/realms/7bf98083-e4ff-4769-baa7-da4fde86d932/broker/saml2/endpoint.

   • 7bf98083-e4ff-4769-baa7-da4fde86d932 correspond the the helm chart default value global.tenantID. In which, it has no other function beside naming the tenant. This used internally at Toucan.

   • saml2 (before the /endpoint) correspond to the name of the SAML2 authenticator (see below), in the SAML2 client configuration. If you plan to use another name, replace saml2 by the name of the authenticator.

3. Configure the allowed entity IDs for the SAML2 client (keycloak for example). Your identity provider will also provide an entity ID to provide to the SAML2 client.

4. Fetch the Provider's metadata URL.

SAML2 Service Provider side (Keycloak)

At the moment, the feature is very young and we are not allowing much configuration (SSO methods, etc.).

If you need any specific configuration from Keycloak, please reach out to us.

To configure SAML2 authentication, follow these steps:

1. In the Helm Charts, set these parameters:

yaml: values.override.yaml

keycloak:
  config:
    sso:
      authenticators:
        - id: saml2
          displayName: 'SAML2'
          type: saml
          idpEntityID: 'https://sso.example.com/saml'
          spEntityID: 'keycloak'
          singleSignOnURL: 'https://sso.example.com/saml'
          singleLogoutURL: 'https://sso.example.com/saml'
          # Required for assertion signing verification
          metadataDescriptorURL: 'https://sso.example.com/saml/descriptor'

1. Deploy the Helm Charts (helm upgrade -f ./values.override.yaml ...).

That's it! The SAML2 authentication should be configured and working now.