Configuring Syteca integration with Keycloak SSO

Configuring Keycloak SSO

To set up Keycloak SSO (SAML 2.0) authentication so as to integrate it for use with the Syteca Management Tool, do the following:

1. Log in to the Keycloak administrative console.

2. In the upper left corner, click Manage realms.

3. Click Create realm.

4. Enter a name for the Realm and click Create.

2. Configuring the LDAP Provider.
   To synchronize users from LDAP, you need to add an LDAP provider:

3. Go to the User Federation section
   

   

4. Click Add Ldap providers

   

5. Next, fill in the required parameters:
   Connection and authentication settings:

LDAP searching and updating:

Synchronization settings:

Save LDAP Provider settings

3. Configure LDAP Mapper for Distinguished Name (DN) synchronization
   To transfer a user's full DN from LDAP to Keycloak, you need to create a mapper.
   Navigate to:
   User Federation → LDAP provider → Mappers → Add mapper

Let's create a mapper with the following parameters:

Save the mapper.

4. Check DN synchronization
   After configuration, we recommend checking that the distinguishedName attribute is synchronizing correctly:
   1. Go to the Users section.
   2.Open any user imported from LDAP.
   

   

   3.The Details tab should display the dn attribute with user and domain information (e.g. CN=User Name,OU=Users,DC=domain,DC=com)
   

   

5. Setting up an Identity Provider (SAML v2.0)
   Adding a SAML Identity Provider:
   1. Go to the Identity Providers section
   

   

2. Select SAML v2.0

To make the required fields available, you must disable the Use entity descriptor option.

Fill in the following fields:

Add using the Add button

6. Export IdP Metadata XML
   To complete SAML configuration, you need to export the Realm metadata:
   1. Go to the Realm Settings section
   2. Open the General tab
   3. Click SAML 2.0 Identity Provider Metadata
   4.Save the file, for example: IdP_metadata.xml

This file is used on the Service Provider in the Syteca Management Tool.

2.Creating a Client (Service Provider)

Go to the Clients section and create a new client:

1. Click Create client

   

2. In the General Settings section, fill in:
   General Settings

The remaining parameters can be left at default.

Click Next

Login Settings

Click Save

Checking SAML Capabilities
After saving, open the created Client (Service Provider) settings and check the parameters in the SAML capabilities section:

In the Signature and Encryption settings section, make the following settings:

Configuring SAML Endpoints
Go to the Advanced tab of the client settings and fill in the endpoints:

Save the changes.

Creating a SAML Attribute Mapper
To pass the user's DN (obtained from LDAP) to the SAML assertion, you need to create a mapper.
Navigate to:
Clients → our SAML Client → Client scopes

If mappers have not been created previously, click Configure a new mapper

If mappers already exist, select Add mapper → By configuration

Then click on User Atributes

We create a mapper with the following parameters:

The User Attribute value must exactly match the name of the attribute created earlier in LDAP Mapper (in our case dn).

Save the mapper.

Setting up SSO Integration in the Syteca Management Tool.

In the SSO Integration settings in the Syteca Management Tool, fill in the following fields:

Parameters	Values
Issuer name	URL in the Syteca Management Tool ( for example, https://<ip-or-hostname>/Syteca)
Identity provider metadata (XML)	XML file (Save the XML on the Realm settings page - SAML 2.0 Identity Provider Metadata)
Custom certificate	If we want to use a certificate generated by Keycloak

SSO authentication is not currently implemented for use in Multi-Tenant mode.

Click Save to apply the changes.

Restart the EkranServer service in Services.

Using a Self-signed Certificate in the Syteca Management Tool
If you plan to use a self-signed certificate from MT, you must complete additional steps.
Step 1. Export the MT certificate:
In the SSO settings in MT:

1. Fill in the required fields

2. Click Download signing certificate

3. Save the certificate (SsoCert.cer)
   

   

   Step 2. Converting the certificate to PEM format
   If the certificate was downloaded in DER format (.cer), convert it to PEM:

   BASH

   openssl x509 -inform DER -in SsoCert.cer -out SsoCert.pem

Step 3. Import the certificate into Keycloak:

1. Go to Clients → [our SAML client]

2. Open the Keys tab

3. Click Import key
   

   

4. Upload file SssoCert.pem

   

Click Save to apply the changes.