# Keycloak

{% hint style="danger" %} <mark style="color:red;">If Keycloak and CISO Assistant are both deployed locally with docker, you'll need to make sure that both containers can communicate together. You can do this with a</mark> [<mark style="color:red;">bridge network</mark>](https://docs.docker.com/engine/network/drivers/bridge/)<mark style="color:red;">.</mark>
{% endhint %}

{% tabs %}
{% tab title="SAML" %}
Go into your **Keycloak admin console**

1. Open the sidebar menu > **Clients** and **Create client**

   <figure><img src="https://217025809-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUJGpmCYDFJNsz2CDasSm%2Fuploads%2FaJPj1KcrShXp5yTWeh8e%2FScreenshot%202024-08-20%2009.40.06.png?alt=media&#x26;token=2d0cfafc-d252-49ee-9fa1-fcec49bbdffe" alt=""><figcaption></figcaption></figure>

2. Choose **SAML** client type and name it **ciso-assistant** or with your custom <mark style="color:purple;">**SP Entity ID**</mark>

   <figure><img src="https://217025809-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUJGpmCYDFJNsz2CDasSm%2Fuploads%2F5Hf1gVGOtPEyck8GHbU1%2FScreenshot%202024-08-20%2009.41.23.png?alt=media&#x26;token=ab774765-3be4-4db1-a810-487aebe20ba0" alt=""><figcaption></figcaption></figure>

3. Fill the **Home URL** with your `<base_url>` and **Valid redirect URIs** with `<backend_url/*>`

   <figure><img src="https://217025809-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUJGpmCYDFJNsz2CDasSm%2Fuploads%2FO4vxs3sOMYko8culRz5X%2FScreenshot%202024-08-20%2009.53.57.png?alt=media&#x26;token=a090f23d-088d-4637-80d8-6a3e9f17c96c" alt=""><figcaption></figcaption></figure>

   If you have some problems to configure these urls you can ask for help on [Discord](https://discord.gg/8C4X7ndQQ4) or by emailing us

4. Go into **Keys** and disable **Signing keys config**

   <figure><img src="https://217025809-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUJGpmCYDFJNsz2CDasSm%2Fuploads%2FAJfiCmAUgBeEhRiVjoC6%2FScreenshot%202024-08-20%2009.57.51.png?alt=media&#x26;token=ecdb88f7-3ec9-43d2-892f-7c474070c521" alt=""><figcaption></figcaption></figure>

5. Go into **Advanced** and fill **ACS field** with `<backend_url/api/accounts/saml/0/acs/>` (on a cloud instance it is simply `<base_url/api/accounts/saml/0/acs/>`)

   <figure><img src="https://217025809-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUJGpmCYDFJNsz2CDasSm%2Fuploads%2FCIO2BCCmmk6OBwHS8yVS%2FScreenshot%202024-08-20%2010.01.40.png?alt=media&#x26;token=4c4ee706-9606-4e3d-a430-4e867703f798" alt=""><figcaption></figcaption></figure>

6. Go to **Client scopes** and click on **ciso-assistant-dedicated**

   <figure><img src="https://217025809-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUJGpmCYDFJNsz2CDasSm%2Fuploads%2Fenr92GNZzW2QulLkA4Kj%2FScreenshot%202024-08-20%2010.04.23.png?alt=media&#x26;token=3953a1c4-27ff-4d93-bd78-cbce0acbae9a" alt=""><figcaption></figcaption></figure>

7. **Add a predefined mapper** and check all **X500** ones

   <figure><img src="https://217025809-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUJGpmCYDFJNsz2CDasSm%2Fuploads%2FHU2LLdo9rimJaKaGzbAx%2FScreenshot%202024-08-20%2010.07.22.png?alt=media&#x26;token=571e09fe-8a75-428a-ae13-84b048585048" alt=""><figcaption></figcaption></figure>

8. Click on **X500 surname** and replace **SAML Attribute name** with `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname`

   <figure><img src="https://217025809-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUJGpmCYDFJNsz2CDasSm%2Fuploads%2FRTDrINEyXJ5eFNBMvIvH%2FScreenshot%202024-08-20%2011.00.15.png?alt=media&#x26;token=5ae173dc-1749-4cc9-8538-fdc7c6b34596" alt=""><figcaption></figcaption></figure>

9. Click on **X500 givenName** and replace **SAML Attribute name** with `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname`

   <figure><img src="https://217025809-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUJGpmCYDFJNsz2CDasSm%2Fuploads%2FjUieb0xrY7JpMqHeMCC4%2FScreenshot%202024-08-20%2011.02.11.png?alt=media&#x26;token=574de6d5-0366-47f1-bf61-318b93c1123c" alt=""><figcaption></figcaption></figure>

10. Go into **Realm settings > General**, you will find the <mark style="color:purple;">**Metadata URL**</mark>

    <figure><img src="https://217025809-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUJGpmCYDFJNsz2CDasSm%2Fuploads%2FpH8A2Y6OYSqpbMksDcoz%2FScreenshot%202024-08-20%2011.14.57.png?alt=media&#x26;token=0af50f3b-0201-475d-9e86-c1d7f73bdee4" alt=""><figcaption></figcaption></figure>

11. You'll find inside the **Metadata URL** the <mark style="color:purple;">**Entity ID**</mark><br>

    <figure><img src="https://217025809-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUJGpmCYDFJNsz2CDasSm%2Fuploads%2FwD3kWJ5AzZn1NrMU8PJQ%2FScreenshot%202024-08-20%2011.15.46.png?alt=media&#x26;token=fe5aae0d-b56a-45d9-ba0b-f4b83a8ad4b3" alt=""><figcaption></figcaption></figure>

{% endtab %}

{% tab title="OpenID Connect (OIDC)" %}
Go into your **Keycloak admin console**

1. Open the sidebar menu > **Clients** and **Create client**

   <figure><img src="https://217025809-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUJGpmCYDFJNsz2CDasSm%2Fuploads%2FaJPj1KcrShXp5yTWeh8e%2FScreenshot%202024-08-20%2009.40.06.png?alt=media&#x26;token=2d0cfafc-d252-49ee-9fa1-fcec49bbdffe" alt=""><figcaption></figcaption></figure>

2. Choose **OpenID Connect** client type and give it a **Client ID**, then click **Next**![](https://217025809-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUJGpmCYDFJNsz2CDasSm%2Fuploads%2FUKXk8pZyDbTHGs1HQGTT%2Fimage.png?alt=media\&token=fba0e5d6-e797-4558-893d-b011afc44761)

3. Enable **Client authentication**, make sure **Standard flow** is selected, then click **Next**![](https://217025809-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUJGpmCYDFJNsz2CDasSm%2Fuploads%2FfGHfvoYnfrPLzVsZtRzB%2Fimage.png?alt=media\&token=9175318a-a99a-48b8-b596-c66060c466a8)

4. Enter your deployment's **Root URL**. It is the URL of your frontend.
   1. Set it to `<frontend_url>`&#x20;
   2. For cloud deployments, you must set it to `<base_url>`

5. Set the **Home URL** to **`/`**

6. Enter your **Valid redirect URIs**
   1. Set it to `<backend_url>/api/accounts/oidc/openid_connect/login/callback/`&#x20;
   2. For cloud deployments, you must set it to `<base_url>/api/accounts/oidc/openid_connect/login/callback/`

      <figure><img src="https://217025809-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUJGpmCYDFJNsz2CDasSm%2Fuploads%2FfrABqHZsyoKLHP8i4PGn%2Fimage.png?alt=media&#x26;token=52409298-910b-4813-8a12-423f5f37ab39" alt=""><figcaption></figcaption></figure>

7. Once your client is created, you can find its **Client secret** under the **Credentials** tab. You can copy it from there

   <figure><img src="https://217025809-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUJGpmCYDFJNsz2CDasSm%2Fuploads%2FDqzKFd9yZVXtyaziU0FC%2Fimage.png?alt=media&#x26;token=af8d8b67-b6be-4b0c-b9e9-924f76bf20fe" alt=""><figcaption></figcaption></figure>

8. Go into **Realm settings > General** to find the <mark style="color:purple;">**OpenID Endpoint Configuration**</mark><mark style="color:purple;">,</mark> which you will have to paste into CISO Assistant's **Server URL** SSO parameter

   <figure><img src="https://217025809-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUJGpmCYDFJNsz2CDasSm%2Fuploads%2FbaqN3UFFwtdkHLSvwah1%2Fimage.png?alt=media&#x26;token=b91050f9-3b62-4b56-8ffe-22bada4229b4" alt=""><figcaption></figcaption></figure>

{% endtab %}
{% endtabs %}

{% hint style="warning" %} <mark style="color:orange;">Adding a user in your application doesn't automatically create the user on CISO Assistant</mark>
{% endhint %}

You can now [configure CISO Assistant](https://intuitem.gitbook.io/ciso-assistant/features-highlights/sso#configure-ciso-assistant-with-saml) with the <mark style="color:purple;">**parameters**</mark> you've retrieved.