0

Currently I'm trying to setup my Google Cloud organization to accept login from SSO using Keycloak. I've followed the documentation from Keycloak and from Google during the setup, but the setup isn't working. Can someone confirm if the client configuration is properly set? Anytime I login into the keycloak with the my test keycloak user in keycloak I get redirected to google authentication page and from there keycloak is out of the authentication. When I'm trying to login from Google Account login page, I can't get redirected to the sso, so basically the connection between Keycloak and Google isn't working properly.

Client Setup

Client ID - google.com/a/gcp-test2.com
Name - gcp-test2.com

Enabled ON
Consent Required OFF
Client Protocol - saml
Include AuthnStatement - ON
Include OneTimeUse Condition - OFF
Sign Documents - ON
Sign Assertions  - ON
Signature Algorithm -RSA_SHA512
Force POST Binding - ON
Front Channel Logout - ON
Force Name ID Format - ON
Name ID Format - email
Root URL - empty
Valid Redirect URIs - empty
Base URL  - /auth/realms/gcp-test2.com/protocol/saml/clients/gcp-test2.com?RelayState=true
Master SAML Processing URL - https://google.com/a/gcp-test2.com
IDP Initiated SSO URL Name - gcp-test2.com
Target IDP initiated SSO URL: https://fqdn/auth/realms/gcp-test2.com/protocol/saml/clients/gcp-test2.com
Assertion Consumer Service POST Binding URL  - https://google.com/a/gcp-test2.com


SSO config on GCP side:
Login URL: https://fqdn/auth/realms/gcp-test2.com/protocol/saml/clients/gcp-test2.com?RelayState=true
Logout URL: https://fqdn/auth/
Use a domain-specific issuer - checked
Certificate is the one from the REALM certificate with public key.
guyfromnowhere
  • 7
  • 6
  • https://cloud.google.com/architecture/identity/keycloak-single-sign-on this seems to be the documentation, make sure to post that next time if you mention 'documentation'. – Vincent Gerris Oct 09 '21 at 07:20

2 Answers2

0

This :

Assertion Consumer Service POST Binding URL -

https://google.com/a/gcp-test2.com

Should point to

https://google.com/a/gcp-test2.com/acs
Julien Joubin
  • 1
  • 1
0

https://cloud.google.com/architecture/identity/keycloak-single-sign-on documents how to do this and it works for me. As it is noted in blue:

Note: For SAML federation to work, Client ID must be google.com.

So change you client ID to google.com.* .

I don't know why you use RelayState, I do not see that mentioned. Set it up precisely as documented and it should work.

Vincent Gerris
  • 7,228
  • 1
  • 24
  • 22