https://github.com/osquery/osquery logo
Title
d

David Serrano Amarelle

07/15/2022, 11:25 AM
Hi! Does anyone have any doc/tutorial to integrate keycloak and fleet? I tried to follow https://fleetdm.com/docs/deploying/configuration#configuring-single-sign-on-sso but even If I am correctly redirected to keycloak and redirected back to fleet, I can't log in. Thanks!
k

Keith Swagler

07/15/2022, 3:30 PM
If you have any specific questions I can find our config
:ty: 1
d

David Serrano Amarelle

07/18/2022, 6:57 AM
Hi Keith, First, thanks for your help. I am going to read it carefully. I have the keycloak (saml connfiguration) already working with another environment, so I think I am not doing right with the Fleet environment. I suspect it's something about the mappers in the client configuration. I am receiving in my SAML response: ~ <saml:Subject> <saml:NameID Format="urn😮asis:names🇹🇨SAML:1.1:nameid-format:*unspecified*">daviduser</saml:NameID> <saml:SubjectConfirmation Method="urn😮asis:names🇹🇨SAML:2.0:cm:bearer"> <saml:SubjectConfirmationData InResponseTo="idcIByF4fOnS7qtOuE" NotOnOrAfter="2022-07-18T07:00:43.338Z" ~ Do you mind if you show me your client's configuration? There is also an export option if it is easier and it does not bother you. Thanks a lot.
k

Keith Swagler

07/18/2022, 6:20 PM
Looks like we don't have any mappers in our keycloak config. We are also using email address to sign in to Fleet, are you using usernames ?
Ah we do have the following in our
sso_settings:
metadata:
...
<md:NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</md:NameIDFormat>
<md:NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</md:NameIDFormat>
<md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</md:NameIDFormat>
<md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</md:NameIDFormat>
...
d

David Serrano Amarelle

07/19/2022, 10:36 AM
Hi Keith, Thanks again for your help. I am trying to use the email address to sign in to fleet, withou sucess at this point. I have also tryed adding your last metadata conf to my fleet config. Same result. If this not bother you... could you share your keycloak config? There are not a lot of options in the fleet side of the SAML configuration. Thanks a lot david