Configuring SSO with Keycloak
Before performing SSO configuration, make sure that the value of the domain parameter in the config.ini configuration file is the current domain name of the Passwork server. This is necessary so that IDP can download the https://<your-passwork>/sso/metadata file from your server. Your server must be configured to run over HTTPS protocol. Example parameter in config.ini: domain = https://passwork.example.com
Go to the Clients and click Create
Download the export file with example settings and change the following values to match your host address
Import the export file on the Add client page
Go to Client scopes and click role_list
In the Mappers tab, select role_list
Set the SAML Attribute NameFormat parameter to Basic and enable Single Role Attribute
Open the Realm settings, copy the required values, and add them to the SSO configuration interface in Passwork
In the Realm settings, go to the Keys tab, click on Certificate, and copy its value into the corresponding field in the SSO settings in Passwork
Click the Log in with SSO on the Passwork login page and try to log in to test it
In case of errors, they will be recorded in the PHP log
1. The response from SSO cannot be correctly decrypted because the certificate fingerprint has been copied incorrectly or is the fingerprint of an incorrect certificate.
2. The current host value in the config.ini parameter domain is specified incorrectly.
3. The user lacks the attribute required for authentication.
