Keycloak SSO

​

Prepare the SSO form in Minimus

1. Go to Manage > Users & Groups (direct link)
2. Click Configure SSO at the top of the page to open the Minimus SSO form.
   Keep this form open and available in another browser tab as you configure the SAML app in Keycloak.
3. The form has 4 parts:
   1. Configure Minimus as a custom app in your identity provider - You will copy these parameters from Minimus to Keycloak in the next steps.
      1. SP Entity ID
      2. Reply URL (Callback / ACS URL)
      3. Relay State (optional) - If you leave the Relay State blank, users will only be able to log in with SSO from the Minimus homepage.
   2. Connect Minimus to your identity provider - You will fetch these parameters from your Keycloak client and save them to the Minimus form:
      1. Login SSO URL
      2. IdP Entity ID
      3. Certificate
   3. SAML Attribute Mapping - You will fetch the Keycloak claim names for the following parameters and save them to the Minimus form:

      Minimus Parameter	Keycloak Attribute Name
      Email	user.mail
      Full Name	user.userprincipalname

   4. Group Mapping is optional and can be enabled if you plan to configure user groups. See the instructions in user groups.

​

Add Minimus as a client in Keycloak

1

Create a Minimus client in Keycloak

Create the Minimus client in Keycloak and link it to your Minimus Console.

1. Visit your Keycloak admin center. (URL example http://address:8080/admin/master/console/) 
2. Select Clients from the left menu > Select Create client.
3. Fill out the form:
   1. Client type - Change the selection to SAML.
   2. Client ID - Copy & paste the value from Minimus SP Entity ID (link to your Minimus form).
   3. Name the client and add a description (optional). 
   4. Select Next to proceed.

2

Configure the client

Configure the client:

1. Set the following as https://images.minimus.io:
   1. Root URL
   2. Home URL
   3. Valid post logout redirect URIs
2. Valid Redirect URI - Set it to https://images.minimus.io/*
3. IDP-Initiated SSO URL Name - Set the name as minimus
4. IDP Initiated SSO Relay State - for example:
   {
     "tenantName": "My-Org"
   }
   
5. Master SAML Processing URL - Set it as https://images.minimus.io/saml/callback
6. Save your changes.

3

Configure SAML capabilities

Scroll down to the section SAML capabilities and set the following:

• Name ID format - Select email from the dropdown list
• Force name ID format - ON
• Force POST binding - ON

Scroll down to the section Signature and Encryption and set the following:

• Sign documents - ON
• Sign assertions - ON

Adjust the rest of the optional settings as relevant and save your changes.

4

Disable client signature requirement

1. Navigate to the Keys tab
2. The section is named Signing keys config
3. Disable Client signature required. You will be asked to confirm your change
4. Save your changes

5

Configure an email mapper

1. Navigate to the Client scopes tab in the top bar.
2. Select your Client ID in the table
   1. Select Configure a new mapper
   2. Select User Property
3. Fill in the mapper attributes:
   • Name - email
   • Property - Select email from the dropdown list
   • Friendly Name - Optional field
   • SAML Attribute Name - Paste in http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress
   • SAML Attribute NameFormat - Basic
4. Save your changes

6

Configure a second mapper

1. In the mappers table, select Add mapper > By configuration
2. Select User Property
3. Fill in the mapper attributes:
   • Name - Type in fullName
   • Property - Select firstName from the dropdown list
   • SAML Attribute Name - http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
   • SAML Attribute NameFormat - Basic
4. Save your changes

7

Copy the certificate

1. In the left menu, select Realm settings.
2. In the General tab, select SAML 2.0 Identity Provider Metadata.
3. Copy the certificate between <ds:X509Certificate> and </ds:X509Certificate>.

8

Configure SAML in Minimus

1. In your Minimus console, go to Manage > Users & Groups > Configure SSO.
2. Fill the following fields:
   • IdP Entity ID - https://YOUR_KEYCLOAK_EXTERNAL_IP_OR_URL/realms/master
   • Login URL - https://YOUR_KEYCLOAK_EXTERNAL_IP_OR_URL/realms/master/protocol/saml
   • Certificate - Paste the certificate you copied in the previous step.
3. Fill in the SAML Attribute Mapping fields:
   • Email - http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress
   • Full Name - http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
   • Group Mapping - groups
4. Save your changes. 

​

Troubleshooting SSO access

-----BEGIN CERTIFICATE-----

-----END CERTIFICATE-----