Channels
android_tests
apple-silicon
arm-architecture
auditing-warroom
aws
carving
code-review
community-feeds
core
darkbytes
doorman
ebpf
eclecticiq-polylogyx-extension
extensions
file-carving
fim
fleet
fleet-dev
fleetosquery
foundation
fuzzing
general
golang
goquery
infrastructure
jobs
kolide
linen-dev
linux
macos
officehours
osctrl
plugins
process-auditing
querycon
queryhub
random
selfgroup
sql
tls
uptycs
vendor-feeds
website
windows
zeek
zentral
zercurity
Title
d
David Serrano Amarelle
07/15/2022, 11:25 AMHi!
Does anyone have any doc/tutorial to integrate keycloak and fleet?
I tried to follow https://fleetdm.com/docs/deploying/configuration#configuring-single-sign-on-sso but even If I am correctly redirected to keycloak and redirected back to fleet, I can't log in.
Thanks!
k
Keith Swagler
07/15/2022, 3:30 PMHere's what the admin guide says
https://www.keycloak.org/docs/latest/server_admin/#_client-saml-configuration
❤️ 1
If you have any specific questions I can find our config
:ty: 1
d
David Serrano Amarelle
07/18/2022, 6:57 AMHi Keith,
First, thanks for your help. I am going to read it carefully.
I have the keycloak (saml connfiguration) already working with another environment, so I think I am not doing right with the Fleet environment. I suspect it's something about the mappers in the client configuration.
I am receiving in my SAML response:
~
<saml:Subject>
<saml:NameID Format="urn😮asis:names🇹🇨SAML:1.1:nameid-format:*unspecified*">daviduser</saml:NameID>
<saml:SubjectConfirmation Method="urn😮asis:names🇹🇨SAML:2.0:cm:bearer">
<saml:SubjectConfirmationData InResponseTo="idcIByF4fOnS7qtOuE"
NotOnOrAfter="2022-07-18T07:00:43.338Z"
~
Do you mind if you show me your client's configuration? There is also an export option if it is easier and it does not bother you.
Thanks a lot.
k
Keith Swagler
07/18/2022, 6:20 PMLooks like we don't have any mappers in our keycloak config.
We are also using email address to sign in to Fleet, are you using usernames ?
Ah we do have the following in our
sso_settings:metadata:...<md:NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</md:NameIDFormat><md:NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</md:NameIDFormat><md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</md:NameIDFormat><md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</md:NameIDFormat>...d
David Serrano Amarelle
07/19/2022, 10:36 AMHi Keith,
Thanks again for your help.
I am trying to use the email address to sign in to fleet, withou sucess at this point.
I have also tryed adding your last metadata conf to my fleet config. Same result.
If this not bother you... could you share your keycloak config? There are not a lot of options in the fleet side of the SAML configuration.
Thanks a lot
david