Configure Keycloak as an Identity Provider for CISO Assistant
If Keycloak and CISO Assistant are both deployed locally with docker, you'll need to make sure that both containers can communicate together. You can do this with a bridge network.
Go into your Keycloak admin console
Open the sidebar menu > Clients and Create client
Choose SAML client type and name it ciso-assistant or with your custom SP Entity ID
Fill the Home URL with your <base_url> and Valid redirect URIs with <backend_url/*>
If you have some problems to configure these urls you can ask for help on or by emailing us
Go into Keys and disable Signing keys config
Go into Advanced and fill ACS field with <backend_url/api/accounts/saml/0/acs/> (on a cloud instance it is simply <base_url/api/accounts/saml/0/acs/>)
Go to Client scopes and click on ciso-assistant-dedicated
Add a predefined mapper and check all X500 ones
Click on X500 surname and replace SAML Attribute name with http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname
Click on X500 givenName and replace SAML Attribute name with http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname
Go into Realm settings > General, you will find the Metadata URL
You'll find inside the Metadata URL the Entity ID
Go into your Keycloak admin console
Open the sidebar menu > Clients and Create client
Choose OpenID Connect client type and give it a Client ID, then click Next
Adding a user in your application doesn't automatically create the user on CISO Assistant
You can now with the parameters you've retrieved.
Enable Client authentication, make sure Standard flow is selected, then click Next
Enter your deployment's Root URL. It is the URL of your frontend.
Set it to <frontend_url>
For cloud deployments, you must set it to <base_url>
Set the Home URL to /
Enter your Valid redirect URIs
Set it to <backend_url>/api/accounts/oidc/openid_connect/login/callback/
For cloud deployments, you must set it to <base_url>/api/accounts/oidc/openid_connect/login/callback/
Once your client is created, you can find its Client secret under the Credentials tab. You can copy it from there
Go into Realm settings > General to find the OpenID Endpoint Configuration, which you will have to paste into CISO Assistant's Server URL SSO parameter
