# Keycloak

{% hint style="danger" %} <mark style="color:red;">If Keycloak and CISO Assistant are both deployed locally with docker, you'll need to make sure that both containers can communicate together. You can do this with a</mark> [<mark style="color:red;">bridge network</mark>](https://docs.docker.com/engine/network/drivers/bridge/)<mark style="color:red;">.</mark>
{% endhint %}

{% tabs %}
{% tab title="SAML" %}
Go into your **Keycloak admin console**

1. Open the sidebar menu > **Clients** and **Create client**

   <figure><img src="/files/AXKamFQiTj8xjochKm5J" alt=""><figcaption></figcaption></figure>

2. Choose **SAML** client type and name it **ciso-assistant** or with your custom <mark style="color:purple;">**SP Entity ID**</mark>

   <figure><img src="/files/ulXxXX1iEefASIeX7405" alt=""><figcaption></figcaption></figure>

3. Fill the **Home URL** with your `<base_url>` and **Valid redirect URIs** with `<backend_url/*>`

   <figure><img src="/files/GzqexAtvHTnOeTMG8MQA" alt=""><figcaption></figcaption></figure>

   If you have some problems to configure these urls you can ask for help on [Discord](https://discord.gg/8C4X7ndQQ4) or by emailing us

4. Go into **Keys** and disable **Signing keys config**

   <figure><img src="/files/fWVsBEex1VxrpAPgAtP9" alt=""><figcaption></figcaption></figure>

5. Go into **Advanced** and fill **ACS field** with `<backend_url/api/accounts/saml/0/acs/>` (on a cloud instance it is simply `<base_url/api/accounts/saml/0/acs/>`)

   <figure><img src="/files/EK3YTCkShTc1NuEN7dkQ" alt=""><figcaption></figcaption></figure>

6. Go to **Client scopes** and click on **ciso-assistant-dedicated**

   <figure><img src="/files/2bFxdROKJPptfKvTed4P" alt=""><figcaption></figcaption></figure>

7. **Add a predefined mapper** and check all **X500** ones

   <figure><img src="/files/x15VfYR54E44lFFP1Ola" alt=""><figcaption></figcaption></figure>

8. Click on **X500 surname** and replace **SAML Attribute name** with `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname`

   <figure><img src="/files/RllFqgv4RfQh68uLNAlR" alt=""><figcaption></figcaption></figure>

9. Click on **X500 givenName** and replace **SAML Attribute name** with `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname`

   <figure><img src="/files/CXikUzJicviS3UhqrgP7" alt=""><figcaption></figcaption></figure>

10. Go into **Realm settings > General**, you will find the <mark style="color:purple;">**Metadata URL**</mark>

    <figure><img src="/files/CuJ7Gs6N2wNUD2v6keao" alt=""><figcaption></figcaption></figure>

11. You'll find inside the **Metadata URL** the <mark style="color:purple;">**Entity ID**</mark><br>

    <figure><img src="/files/R8v7JyilP35BgWoQZbpf" alt=""><figcaption></figcaption></figure>

{% endtab %}

{% tab title="OpenID Connect (OIDC)" %}
Go into your **Keycloak admin console**

1. Open the sidebar menu > **Clients** and **Create client**

   <figure><img src="/files/AXKamFQiTj8xjochKm5J" alt=""><figcaption></figcaption></figure>

2. Choose **OpenID Connect** client type and give it a **Client ID**, then click **Next**![](/files/AjTUP2eI9t0ImjI6i8Zm)

3. Enable **Client authentication**, make sure **Standard flow** is selected, then click **Next**![](/files/EG2OmStBAM0KDb08uSTs)

4. Enter your deployment's **Root URL**. It is the URL of your frontend.
   1. Set it to `<frontend_url>`&#x20;
   2. For cloud deployments, you must set it to `<base_url>`

5. Set the **Home URL** to **`/`**

6. Enter your **Valid redirect URIs**
   1. Set it to `<backend_url>/api/accounts/oidc/openid_connect/login/callback/`&#x20;
   2. For cloud deployments, you must set it to `<base_url>/api/accounts/oidc/openid_connect/login/callback/`

      <figure><img src="/files/MTvBYnZRU0KIpuZrdHJS" alt=""><figcaption></figcaption></figure>

7. Once your client is created, you can find its **Client secret** under the **Credentials** tab. You can copy it from there

   <figure><img src="/files/9KOi6MNxGUP1YURHOOHN" alt=""><figcaption></figcaption></figure>

8. Go into **Realm settings > General** to find the <mark style="color:purple;">**OpenID Endpoint Configuration**</mark><mark style="color:purple;">,</mark> which you will have to paste into CISO Assistant's **Server URL** SSO parameter

   <figure><img src="/files/LuEfQcs9H8n2Y6cgEiI8" alt=""><figcaption></figcaption></figure>

{% endtab %}
{% endtabs %}

{% hint style="warning" %} <mark style="color:orange;">Adding a user in your application doesn't automatically create the user on CISO Assistant</mark>
{% endhint %}

You can now [configure CISO Assistant](https://intuitem.gitbook.io/ciso-assistant/features-highlights/sso#configure-ciso-assistant-with-saml) with the <mark style="color:purple;">**parameters**</mark> you've retrieved.


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://intuitem.gitbook.io/ciso-assistant/features-focus/sso/identity-providers/keycloak.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.