Keycloak SSO With SSOGEN

Keycloak SSO works with SSOGEN as a SAML or an OpenID Connect provider. This page lists the client settings that matter and the three that usually break it.

Start a guided trial

Keycloak SSO with SSOGEN keeps Keycloak as the place users sign in. They get one session across every application SSOGEN protects, including Oracle E-Business Suite, PeopleSoft and JD Edwards.

You register SSOGEN in Keycloak as a SAML client or an OpenID Connect client.

Users sign in with the Keycloak accounts and rules they already have, and SSOGEN accepts the signed response and opens a session.

A few settings decide the result:

SAML: Keycloak signs the assertion, does not demand signed requests unless you turned request signing on in SSOGEN, and sends an email attribute SSOGEN reads.
OpenID Connect: the issuer matches exactly. The complete wizard is in the SAML guide and the OpenID Connect guide.

SAML or OIDC for Keycloak

Keycloak supports both, so choose by effort.

OpenID Connect. It needs a confidential client, a secret and a redirect address.
SAML. It is usually faster: import SSOGEN’s metadata file into Keycloak, and it fills in the client ID, the redirect address and SSOGEN’s certificate in one step.

	SAML	OpenID Connect
Client type in Keycloak	SAML	OpenID Connect, Client authentication On
Address you give Keycloak	SSOGEN’s ACS URL as a valid redirect URI	SSOGEN’s redirect URI as a valid redirect URI
What SSOGEN reads	`https://keycloak.acme.example/realms/<realm>/protocol/saml/descriptor`	`https://keycloak.acme.example/realms/<realm>/.well-known/openid-configuration`
Entity ID or issuer	`https://keycloak.acme.example/realms/<realm>`	The same value, with no trailing slash

Set up the SAML client in Keycloak

Start the Add SAML Provider wizard in SSOGEN and copy the SP entity ID and ACS URL. On the provider’s page you can also use Download SP metadata.
In Keycloak, choose Clients and either Import client with that metadata file, or create a client of type SAML with the SP entity ID as its Client ID and the ACS URL as its valid redirect URI.
On the client’s Settings tab, turn Sign assertions On. Keycloak signs the document by default but not the assertion, and SSOGEN requires the assertion itself to be signed.
Set Name ID format to username or email, choose one and keep it, and turn Force name ID format On. This value becomes the person’s SSOGEN username. If it changes, SSOGEN treats the person as new.
On the Keys tab, turn Client signature required Off unless you enabled request signing in SSOGEN. Keycloak’s default expects signed requests and refuses SSOGEN’s unsigned ones. If you did enable request signing, leave it On and import SSOGEN’s certificate.
Add the email mapper on the client’s dedicated scope: type User Property, property email, SAML attribute name http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress, name format URI Reference.
Give SSOGEN the descriptor address under Metadata URL, or save the XML and use Metadata file upload.

After the steps, three points apply:

Mail. With that attribute name, SSOGEN’s default Mail assertion attribute works unchanged. If you use a plain name such as email instead, type the same name into the Mail assertion attribute field.
Display name. Add a mapper and type its attribute name into the Display name field, or leave it empty.
Encryption. Keycloak can turn Encrypt assertions on after a metadata import, because SSOGEN’s metadata offers an encryption certificate. SSOGEN decrypts encrypted assertions, so either setting works.

Set up the OIDC client in Keycloak

Choose Clients, then Create client. Type OpenID Connect, with a client ID such as ssogen-acme.
Turn Client authentication On and keep Standard flow selected. Leave Authorization off.
Set Valid redirect URIs to SSOGEN’s redirect URI exactly.
Open Credentials, check that the authenticator is Client Id and Secret and copy the secret.
Check that the client scopes email and profile are defaults. The person needs an email address on the Keycloak account.
In SSOGEN, enter the issuer as your Keycloak address plus /realms/<realm>. Store the client ID under Settings > Secrets and enter its secret://stored/ reference. Paste the secret into Client secret.

Where the three common failures come from

Unsigned assertions. Test only reads the metadata, so it passes even when Keycloak sends an unsigned assertion. If the real sign-in then fails, check Sign assertions first.

Signed requests demanded. If Keycloak refuses the request before showing a login page, Client signature required is still On.

A metadata address SSOGEN may not fetch. Keycloak may run on a private network that the SSOGEN server cannot reach or is not allowed to call. The wizard says so. Save the descriptor as an XML file and upload it instead.

With a file, upload it again when Keycloak rotates its realm key.

Test, then keep it healthy

In SSOGEN, select Validate and Test.
Select Try signing in in a single browser.

The result page shows the NameID and every attribute Keycloak sent, which is the fastest way to find a mapper with the wrong name. The test creates nothing.

After activation, keep these two settings in view:

Sign-in domains on the provider’s Configuration tab send people with a matching email domain straight to Keycloak.
Also sign out of this provider ends the Keycloak session when someone signs out of SSOGEN. Without it, a realm that signs people in through Keycloak signs them straight back in on the next page.

Questions people ask

Can SSOGEN use Keycloak as its identity provider?

Yes. Add Keycloak as a SAML or OpenID Connect provider, and the Keycloak login page becomes one of the ways to sign in to SSOGEN and every application behind it.

Do I need Keycloak admin rights?

Yes, for the realm that holds your users. You need it to create the client and its mappers.

Why do people get no email address in SSOGEN?

Either the mapper name does not match the Mail assertion attribute, or the Keycloak account has no email. Run Try connection and read what the provider sent.

Where to go next

SSOGEN connects to Keycloak and to any other SAML 2.0 or OpenID Connect provider.

Providers. Compare the other providers on the identity provider hub.
Checklist. Read the any SAML provider checklist.
Wizard. Follow the full SAML wizard guide.
Comparison. A row-by-row comparison is in Keycloak vs SSOGEN.