> ## Documentation Index
> Fetch the complete documentation index at: https://test-8ad8522e-feat-ai-sre.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Keycloak

> Configure SAML2.0 or OIDC protocol via Keycloak for single sign-on

Keycloak is an open-source identity and access management solution that provides a comprehensive set of tools and features to help developers quickly implement secure user authentication and authorization mechanisms.

<Note>
  This article does not cover deployment or explanation of Keycloak. For more information, please refer to the [official documentation](https://www.keycloak.org/).
</Note>

## Protocol Configuration

<Tabs>
  <Tab title="SAML2.0 Protocol">
    ### 1. Get ACS URL

    Login to Flashduty console and obtain the ACS URL (needed in subsequent steps).

    Path: **Access Control => Single Sign-On => SAML2.0 Protocol => Flashduty Service Provider Info => Assertion Consumer Service URL**

    ![Get ACS URL](https://docs-cdn.flashcat.cloud/images/png/437194.png)

    ### 2. Create Client

    Login to Keycloak console, path: **Clients => Create client**

    * **Client Type**: Select SAML protocol
    * **Client ID**: Enter `flashcat.cloud` (fixed value, cannot be changed)

    ![Create Client](https://docs-cdn.flashcat.cloud/images/png/437197.png)

    **Valid redirect URIs**: Enter the ACS URL obtained from Flashduty

    ![Configure redirect](https://docs-cdn.flashcat.cloud/images/png/437029.png)

    ### 3. Configure Client Information

    Change **Name ID format** to email type:

    ![Name ID format](https://docs-cdn.flashcat.cloud/images/png/437031.png)

    Set **Client signature required** to disabled:

    ![Disable signature](https://docs-cdn.flashcat.cloud/images/png/437195.png)

    **Create Client scope**:

    <Warning>
      Before creating, delete the previous OpenID Connect protocol user first, then set it as Default after creation.
    </Warning>

    Create email/phone/username types as shown:

    ![Create scope](https://docs-cdn.flashcat.cloud/images/png/437033.png)

    Completed result:

    ![Scope result](https://docs-cdn.flashcat.cloud/images/png/437034.png)

    **Add users to the Client**:

    ![Add user 1](https://docs-cdn.flashcat.cloud/images/png/437037.png)

    ![Add user 2](https://docs-cdn.flashcat.cloud/images/png/437038.png)

    **Configure email/phone/username mappers** (using email as example, configure others similarly):

    ![Mapper 1](https://docs-cdn.flashcat.cloud/images/png/437057.png)

    ![Mapper 2](https://docs-cdn.flashcat.cloud/images/png/437058.png)

    ![Mapper 3](https://docs-cdn.flashcat.cloud/images/png/437060.png)

    ### 4. Download XML File

    <Note>
      The downloaded file is a compressed package. After extracting locally, there will be two xml files; only the `idp-metadata.xml` file is needed.
    </Note>

    Download locally from **Client => Action**:

    ![Download XML](https://docs-cdn.flashcat.cloud/images/png/437039.png)

    Upload the XML file to Flashduty's single sign-on configuration:

    ![Upload XML](https://docs-cdn.flashcat.cloud/images/png/437040.png)

    ### 5. Create User and Test Login

    Create user (must bind an email address):

    ![Create user](https://docs-cdn.flashcat.cloud/images/png/437041.png)

    **Login test**: Visit `console.flashcat.cloud`, select SSO login, and enter your organization's login domain in the domain field (configured on the **Platform Management → Organization → Organization Information → Organization Profile** page). You can also initiate single sign-on directly at `{domain}.sso.flashcat.cloud`.

    ![Test login](https://docs-cdn.flashcat.cloud/images/png/437062.png)
  </Tab>

  <Tab title="OIDC Protocol">
    ### 1. Get Redirect URL

    Login to Flashduty console and obtain the Redirect URL (needed in subsequent steps).

    Path: **Access Control => Single Sign-On => OIDC Protocol => Flashduty Service Provider Info => Redirect URL**

    ![Get Redirect URL](https://docs-cdn.flashcat.cloud/images/png/437183.png)

    ### 2. Create Client

    Login to Keycloak console, create new Client:

    * **Client Type**: Select OIDC protocol
    * **Client ID**: No special requirements

    ![Create Client](https://docs-cdn.flashcat.cloud/images/png/437179.png)

    **Client authentication**: Keep enabled

    ![Client authentication](https://docs-cdn.flashcat.cloud/images/png/437180.png)

    **Valid redirect URIs**: Enter the Redirect URL obtained in step 1

    ![Configure redirect](https://docs-cdn.flashcat.cloud/images/png/437184.png)

    ### 3. Get Client Information

    * **Client ID**: The ID entered when creating the Client
    * **Client Secret**: View in **Client Details => Credentials** card

    ![Client Secret](https://docs-cdn.flashcat.cloud/images/png/437186.png)

    * **Issuer**: View in **Realm settings => Endpoints => OpenID Endpoint Configuration**

    ![Issuer](https://docs-cdn.flashcat.cloud/images/png/437187.png)

    ### 4. Configure Flashduty Single Sign-On

    Enter the above information into Flashduty single sign-on configuration:

    ![Flashduty configuration](https://docs-cdn.flashcat.cloud/images/png/437188.png)

    <Tip>
      After configuration, refer to step 5 of the SAML2.0 protocol for login testing.
    </Tip>
  </Tab>
</Tabs>