Keycloak SAML Identity Provider

This document outlines the process for configuring Willba's SAML identity provider using Google Workspace.

The process expect to have SAML config file created from the identity provider as Google Workspace.

See instructions if you don't have yet completed this step.

Steps

1. Login as realm-admin into Keycloak console
2. Open Identity Providers from main menu
3. Add new provider with option SAML
4. Set Alias with unique name if you have multiple identity providers in one environment
5. Set Display name with descriptive name. It will be shown in the Willba login screen main button. If you have multiple identity providers in one environment, users can select the correct one by this name.
6. Set Display order to 1. If multiple providers, set 2 for the second and so on. Willba Support team Admin login is reserved with Display order 100.
7. Switch Use entity descriptor OFF
8. Import config from file created earlier
9. Specify settings
10. Save
11. Specify mappers
12. Verify connection works

Settings

Setting	Value	Description
NameID policy format	Email
Principal type	Subject NameID
Allow create	On	Important, let SAML create Willba users on first login
HTTP-POST binding response	On
HTTP-POST binding for AuthnRequest	On
HTTP-POST binding for AuthnRequest	On
Comparison	exact
Trust Email	On	Do not require email verification
First login flow	first broker login
Post login flow	None
Sync mode	Force	Important setting to force sync user properties at every login

Mappers

Specify firstName, lastName and user group mappers. These mappers import values from Identity Provider into Willba. This documentation includes fundamental mappers, it is possible to add more mappers if needed and available.

First Name

Create new mapper for first name with following details

• ID: firstName
• Name: firstName
• Sync mode override: Inherit
• Mapper type: Attribute Importer
• Attribute Name: firstName
• Friendly Name:
• Name Format: ATTRIBUTE_FORMAT_BASIC
• User Attribute Name: firstName

Last Name

Create new mapper for last name with following details

• ID: lastName
• Name: lastName
• Sync mode override: Inherit
• Mapper type: Attribute Importer
• Attribute Name: lastName
• Friendly Name:
• Name Format: ATTRIBUTE_FORMAT_BASIC
• User Attribute Name: lastName

User Group Mappers

Create own mapper for each user group you want to import into Willba from Identity Provider.

• ID: {groupName}, for example Housekeeping
• Name: User Group {groupName}, for example User Group Housekeeping
• Sync mode override: Force
• Mapper type: Advanced Attribute to Group
• Attributes:
  • Key: groups, this is the same name as in customer's SAML mapper
  • Value: {group-exact-name-in-source-identity-provider}
• Regex Attribute Values: Off
• Group: Select correct Willba group name