Integration of Keycloak IDP with Google Workspace

Summary

In this tutorial, you'll learn how to integrate Keycloak with Google Workspace using SAML for Single Sign-On (SSO). The step-by-step guide covers configuring Keycloak with Active Directory, retrieving SAML metadata, and setting up the Google Admin Console for SSO. The tutorial also walks through creating a SAML profile in Keycloak, uploading certificates, and assigning profiles to specific organizational units in Google Workspace. By the end of the video, viewers will successfully log into Google Workspace using Keycloak credentials, streamlining their login process.

Takeaways

• 😀 The video demonstrates integrating Keycloak with Google Workspace to enable SSO using Active Directory credentials.
• 😀 Users can log in to Google accounts via Keycloak using their existing organizational identity.
• 😀 Keycloak realm and clients must be properly configured before setting up SSO in Google Workspace.
• 😀 SAML metadata from Keycloak is required to configure Google Workspace SSO settings.
• 😀 Important URLs for SSO setup include Sign-in Page URL, Sign-out Page URL, Change Password URL, and ACS URL.
• 😀 The X.509 certificate from Keycloak must be correctly formatted and uploaded to Google Workspace.
• 😀 Google Admin Console SSO profile should be assigned to a specific Organizational Unit for testing and deployment.
• 😀 Keycloak client settings like Name ID format, Force POST binding, and client signature are critical for successful SAML integration.
• -
• 😀 Testing SSO should be done in an incognito window to verify proper redirection and login functionality.
• -
• 😀 The video encourages users to like, subscribe, and reference GitHub for downloadable configuration files and examples.

Q & A

What is the main purpose of the video?

The video demonstrates how to integrate Keycloak with Google Workspace to enable Single Sign-On (SSO) using Active Directory credentials.

What is Keycloak, and why is it used in this integration?

Keycloak is an open-source identity and access management solution. It is used here to authenticate users from Active Directory and provide SSO capabilities for Google Workspace.

What is a Keycloak 'realm' and how is it relevant in this setup?

A realm in Keycloak is a space that manages a set of users, credentials, roles, and groups. In this setup, a realm (e.g., 'coinsSP') is used to store users and configure SAML integration with Google Workspace.

What information is needed from the Keycloak metadata to configure Google SSO?

The information includes the IdP Entity ID, Sign-in Page URL, Sign-out Page URL (or OpenID Connect logout URL), Change Password URL, and the X.509 verification certificate.

Why is it necessary to prepend and append 'BEGIN CERTIFICATE' and 'END CERTIFICATE' to the X.509 certificate?

These lines are required to format the certificate correctly so that Google Admin Console can read and validate it during SAML configuration.

Which URL should be used for the Sign-out Page to avoid errors?

The OpenID Connect logout URL should be used instead of the default SAML logout URL from Keycloak to prevent errors during logout.

What settings must be configured in Keycloak for the SAML client for Google?

Keycloak SAML client settings should include Name ID Format as email, Force Name ID Format on, Force POST Binding on, Include Authn Statement on, Sign Assertions on, and Client Signature Required off.

How do you assign the SSO profile to specific users in Google Workspace?

In the Google Admin Console, go to 'Security → SSO with third-party IdP', select the SSO profile, choose the desired organizational unit (OU), and save the changes.

Why is it recommended to test SSO in an incognito window?

Using an incognito window ensures there are no cached credentials or sessions, providing a clean environment to verify that the Keycloak SSO login redirects properly to Google Workspace.

What precautions should be taken when copying the X.509 certificate?

The certificate should be copied using a plain text editor to avoid unwanted formatting, line breaks, or extra characters that could invalidate it.

Can the Keycloak client profile be reused or exported?

Yes, the client profile can be exported from Keycloak and uploaded or referenced later, which simplifies replication or troubleshooting of the SSO setup.

What is the role of the Change Password URL in Google SSO configuration?

The Change Password URL points to the Keycloak accounts page, allowing users to manage and change their passwords directly within Keycloak while using Google Workspace SSO.