Skip to main content
This page configures SAML 2.0 authentication between Keycloak and the Syteca Management Tool, including synchronizing users from Active Directory via an LDAP provider in Keycloak. See SSO integration overview for what SSO integration does and the Management Tool settings shared across every provider.

​
1. Create a realm in Keycloak

1

Log in to the Keycloak administrative console

Open the Keycloak admin console.
2

Create a realm

In the upper left corner, click Manage realms, then Create realm. Enter a name for the realm and click Create.

​
2. Configure the LDAP provider

To synchronize users from Active Directory into this realm:
1

Add an LDAP provider

Go to User Federation, then click Add LDAP providers.
2

Set connection and authentication settings

3

Set LDAP searching and updating settings

4

Set synchronization settings

5

Save

Save the LDAP provider settings.

​
3. Add a mapper for the distinguished name

To pass each user’s full distinguished name (DN) from LDAP into Keycloak — required later for the SAML assertion mapper:
1

Open the LDAP provider's mappers

Go to User Federation > [your LDAP provider] > Mappers > Add mapper.
2

Create the mapper

3

Save

Save the mapper.
Confirm DN synchronization is working before continuing: open Users, select any user imported from LDAP, and check that the Details tab shows a dn attribute with user and domain information (for example CN=User Name,OU=Users,DC=domain,DC=com).

​
4. Set up the SAML identity provider

1

Add a SAML identity provider

Go to Identity Providers, and select SAML v2.0.
2

Disable the entity descriptor option

Deselect Use entity descriptor — this is required to make the fields below available.
3

Fill in the identity provider fields

4

Add the identity provider

Click Add.

​
5. Export the realm’s IdP metadata

1

Open Realm Settings

Go to Realm Settings, then the General tab.
2

Download the metadata

Click SAML 2.0 Identity Provider Metadata and save the file (for example, IdP_metadata.xml).
This file is used on the Service Provider side, in the Syteca Management Tool’s SSO settings.

​
6. Create a client (service provider) in Keycloak

1

Create a client

Go to Clients, then click Create client.
2

Set general settings

Leave the remaining parameters at their defaults, and click Next.
3

Set login settings

Click Save.
4

Verify SAML capabilities

Open the client’s settings and confirm, under SAML capabilities:
5

Configure SAML endpoints

On the client’s Advanced tab:Save the changes.

​
7. Create a SAML attribute mapper for the DN

To pass the user’s DN (from LDAP) into the SAML assertion:
1

Open the client's scopes

Go to Clients > [your SAML client] > Client scopes.
2

Add a mapper

If no mappers exist yet, click Configure a new mapper. Otherwise, click Add mapper > By configuration. Either way, select User Attribute.
3

Configure the mapper

The User Attribute value must exactly match the attribute name created in the LDAP mapper in step 3 (dn).
4

Save

Save the mapper.

​
8. Configure SSO integration in the Management Tool

1

Open SSO Integration settings

In the Management Tool, click Configuration, then select the SSO Integration tab.
2

Enter the issuer and upload the metadata

SSO authentication is not currently supported in Multi-Tenant mode.
3

Save and restart the Application Server

Click Save, then restart the EkranServer service in Windows Services.

​
Using a self-signed certificate from the Management Tool

If you plan to use a self-signed certificate generated by the Management Tool (rather than one generated by Keycloak), complete these additional steps.
1

Export the Management Tool's certificate

In the Management Tool’s SSO settings, with the required fields already filled in, click Download signing certificate and save the file (for example, SsoCert.cer).
2

Convert the certificate to PEM format, if needed

If the certificate downloaded in DER format, convert it:
3

Import the certificate into Keycloak

Go to Clients > [your SAML client] > Keys, click Import key, and upload the SsoCert.pem file.
4

Save

Click Save to apply the changes.

SSO integration overview

All supported SSO providers and shared Management Tool settings.

LDAP targets

A separate LDAP integration for user provisioning and login, independent of SSO.

Azure SSO

Configure SSO through Azure instead.

User management

Managing Management Tool user accounts and permissions.