Keycloak Guide

Quick Overview

Keycloak is an open-source identity and access management solution that provides a comprehensive set of tools and features, helping developers quickly implement secure user authentication and authorization mechanisms while simplifying identity and access management processes for applications.

提示

This article does not cover Keycloak deployment and detailed explanations. For more information, please refer to the official documentation

SAML 2.0 Protocol Configuration

1. Log in to FlashDuty Console

1.1 Get the ACS URL from FlashDuty (needed in step 2)
1.2 Path: Access Control => Single Sign-On => Settings => SAML 2.0 Protocol => Flashcat Service Provider Information => Assertion Consumer Service URL

2. Create a New Client in Keycloak Console

2.1 Path: Clients => Create client
2.2 Client Type: Select SAML protocol
2.3 Client ID: Enter flashcat.cloud (fixed value, cannot be changed)

2.4 Valid redirect URIs: Enter the ACS URL obtained from FlashDuty

3. Configure Client Settings

3.1 Change Name ID format to email type

3.2 Set Client signature required to OFF

3.3 Create Client scope

提示

Before creating, you need to delete previous OpenID Connect protocol users. After creation, set it as Default

3.3.1 Create email/phone/username types following the image below

3.3.2 Final result after creation

3.4 Add users to the Client

3.5 Configure email/phone/username mappers (using email as an example, follow the same steps for others)

4. Download XML File

提示

The downloaded file is a compressed archive containing two XML files. You only need the idp-metadata.xml file

4.1 Download from Client > Action

4.2 Upload the XML file to FlashDuty's SSO configuration

5.1 Create user (must bind an email address)

5.2 Test login

Visit console.flashcat.cloud, select SSO login => Enter the login domain prefix from SSO configuration

OIDC Protocol Configuration

1. Log in to FlashDuty Platform

1.1 Get Redirect URL from FlashDuty (needed in step 2)
2.2 Path: Access Control => Single Sign-On => Settings => OIDC Protocol => Flashcat Service Provider Information => Redirect URL