---
title: "Create SAML federation for Keycloak"
sidebar_label: "Create SAML federation for Keycloak"
sidebar_position: 1
description: "How to configure a SAML federation on the Selectel side and with the Keycloak identity provider"
---

import Formbricks from '@theme/MDXComponents/Formbricks'
import CreateFederationForSelectel from '@site/i18n/en/docusaurus-plugin-content-docs/current/_partials/access-control/federations/manage-saml/create-federation-for-selectel.mdx'

# Create SAML federation for Keycloak

1. If you do not have a certificate issued by Keycloak, [issue one](#issue-certificate).
2. [Create a federation on the Selectel side](#create-federation-for-selectel).
3. [Configure a SAML application](#configure-saml).
4. If you checked the **Sign authentication requests** checkbox when creating a federation on the Selectel side, [configure digital signature verification](#configure-digital-signature-verification).
5. If you enabled automatic user creation when creating a federation on the Selectel side, [configure user group mapping](#configure-mapping).

### 1. Issue a certificate \{#issue-certificate}

Issue a certificate on the Keycloak side; for more details, see the [Certificates](/access-control/federations/manage-saml/certificates.mdx) guide.

You can create a federation without a certificate and add it later, but the federation will not work without a certificate.

## 2. Create a federation on the Selectel side \{#create-federation-for-selectel}

<CreateFederationForSelectel KeycloakSession="Время жизни сессии также можно установить on стороне провайдера Keycloak in параметре SSO Session Max or Assertion Lifespan. Если время жизни сессии установлено and in настройках федерации, and in Keycloak, будет применяться наименьшее значение." IdIssuer="https://<idp_url>/realms/master" Link="https://<idp_url>/realms/master/protocol/saml" />

## 3. Configure a SAML application \{#configure-saml}

1. In the Keycloak control panel, log in to the administrator account (Administration Console).

2. Go to the **Clients** section.

3. Click **Create client**.

4. At the **General Settings** step:

   4.1. In the **Client type** field, select **SAML**.

   4.2. In the **Client ID** field, enter the URL to which users will be redirected after authentication — `https://api.selectel.ru/v1/federations/saml/<federation_id>`.

   Specify `<federation_id>` — the federation ID on the Selectel side; you can find it in the [control panel](https://my.selectel.ru/iam/federations): in the top menu, click **IAM** → **Federations** → federation row → field **ID**.

   4.3. In the **Name** field, enter the name of the SAML application.

   4.4. Click **Next**.

5. At the **Login Settings** step:

   5.1. In the **Root URL** field, insert `https://api.selectel.ru/v1/federations/saml/<federation_id>`.

   Specify `<federation_id>` — the federation ID on the Selectel side; you can find it in the [control panel](https://my.selectel.ru/iam/federations): in the top menu, click **IAM** → **Federations** → federation row → field **ID**.

   5.2. In the **Home URL** field, insert `https://my.selectel.ru/federated-login`.

   5.3. In the **Valid Redirect URIs** field, insert `https://api.selectel.ru/v1/auth/federations/<federation_id>/saml/acs`.

   Specify `<federation_id>` — the federation ID on the Selectel side; you can find it in the [control panel](https://my.selectel.ru/iam/federations): in the top menu, click **IAM** → **Federations** → federation row → field **ID**.

   5.4. Click **Save**.

6. At the **SAML capabilities** step:

   6.1. In the **Name ID Format** field, select the user identifier format — **username** or **email**.

   6.2. Enable the **Force POST binding** and **Include AuthnStatement** toggles.

7. At the **Signature and Encryption** step:

   7.1. Enable the **Sign assertions** toggle.

   7.2. If you do not plan to [configure digital signature verification](#configure-digital-signature-verification), make sure the **Client signature required** toggle is turned off in the **Signing keys config** block.

   7.3. In the **Signature algorithm** field, select **RSA\_SHA256**.

   7.4. In the **SAML Signature Key Name** field, select **NONE**.

8. At the **Logout settings** step:

   8.1. Enable the **Front channel logout** toggle.

   8.2. Click **Save**.

## 4. Configure digital signature verification \{#configure-digital-signature-verification}

You need to configure digital signature verification if you checked the **Sign authentication requests** checkbox at step 5.2 when [creating a federation on the Selectel side at step 2](#create-federation-for-selectel).

1. [Download the Selectel certificate for request signing](/access-control/federations/manage-saml/certificates.mdx#download-certificate-for-request-verification).
2. In the Keycloak control panel, go to the **Clients** section.
3. Open the SAML application page → tab **Keys**.
4. At the **Signature and Encryption** step:

   4.1. In the **Signing keys config** block, enable the **Encrypt Assertions** and **Client signature required** toggles.

   4.2. In the **Encryption keys config** block, enable the **Client Signature Required** toggle.

   4.3. In the **Select method** field, select **Import**.

   4.4. In the **Archive Format** field, select **Certificate PEM**. If the **Certificate PEM** option is missing, close the window, click **Regenerate** → **Yes** → **Import key**. The option will appear in the list.

   4.5. Click **Browse** and select the certificate you downloaded from the federation page in Selectel.

   4.6. Click **Confirm**.

## 5. Configure user group mapping \{#configure-mapping}

Group mapping must be configured if you enabled automatic user creation during [creation of the federation on the Selectel side at step 2](#create-federation-for-selectel). Use the [Configure group mapping](/access-control/groups/mapping.mdx#configure-group-mapping) subsection of the [User group mapping](/access-control/groups/mapping.mdx) guide.

<Formbricks />