Keycloak

Use this to connect your own, separately-hosted Keycloak instance as an external IdP — distinct from the internal Keycloak Safeguard's auth service uses as its broker.

Example values

The tenant-specific values (the sg_ab12cde parts) show the shape only — Safeguard displays your real ACS URL and SP Entity ID in the Add Provider dialog after you click Save. This table makes it unambiguous which value goes on which side.

In Keycloak — the SAML app / SP details (you enter these at the IdP):

In Safeguard — Add Provider → SAML 2.0 (you copy these from the IdP):

-----BEGIN CERTIFICATE-----
MIIDdDCCAlygAwIBAgIGAX...(full cert from your IdP)...P3B/k0SolrFYPo
-----END CERTIFICATE-----

1. In your organization's Keycloak admin console, select your realm, then go to Clients → Create client → SAML.
2. Set Client ID to the SP Entity ID Safeguard shows after Save (this is the SP Entity ID), and set the Assertion Consumer Service POST Binding URL to the ACS URL Safeguard shows after Save.
3. Under Realm Settings → General, copy the realm's SAML 2.0 endpoint and issuer, and export the realm's signing certificate.
4. Set Name ID format to Email under the client's Advanced settings.
5. Add a SAML Attribute mapper on the client with SAML attribute name email mapped to the user's email attribute — separate from the Name ID mapper above.
6. In Safeguard, click Add Provider → SAML 2.0 → Keycloak, and enter the endpoint, issuer (Entity ID), and certificate.
7. Assign the client's role/group mappers to the users who should have access.
8. Click Test in Safeguard to confirm.

Common errors: an "invalid_redirect_uri" error from Keycloak means the Callback URL wasn't added to the client's Valid Redirect URIs exactly as shown.