Configuring SSO with Keycloak
Before performing SSO configuration, make sure that the value of the domain parameter in the config.ini configuration file is the current domain name of the Passwork server. This is necessary so that IDP can download the https://<your-passwork>/sso/metadata file from your server. Your server must be configured to run over HTTPS protocol. Example parameter in config.ini: domain = https://passwork.example.com
Go to the Clients and click Create

Download the export file with example settings and change the following values to match your host address

Import the export file on the Add client page


Go to Client scopes and click role_list

In the Mappers tab, select role_list

Set the SAML Attribute NameFormat parameter to Basic and enable Single Role Attribute

Open the Realm settings, copy the required values, and add them to the SSO configuration interface in Passwork



In the Realm settings, go to the Keys tab, click on Certificate, and copy its value into the corresponding field in the SSO settings in Passwork


Click the Log in with SSO on the Passwork login page and try to log in to test it

In case of errors, they will be recorded in the PHP log
1. The response from SSO cannot be correctly decrypted because the certificate fingerprint has been copied incorrectly or is the fingerprint of an incorrect certificate.
2. The current host value in the config.ini parameter domain is specified incorrectly.
3. The user lacks the attribute required for authentication.

