
:guide-id: saml-galleon-layers
:guide-title: {project_name} SAML Galleon feature pack for WildFly and EAP
:guide-summary: Using {project_name} SAML Galleon feature pack to secure applications in WildFly and EAP.
:guide-priority: 60
:guide-tile-visible: true
:version: 26.2.4

include::../attributes.adoc[]

[[saml-galleon-layers]]
= {project_name} SAML Galleon feature pack for WildFly and EAP

ifeval::["" == "true"]
WARNING: This {section} is describing a feature which is currently in preview.
ifeval::["" == ""]
Please provide your feedback while we’re continuing to work on this.
endif::[]
ifeval::["" != ""]
Please provide your feedback by link:[joining this discussion] while we’re continuing to work on this.
endif::[]
endif::[]


The SAML adapter is distributed as a Galleon feature pack for wildfly 29 or newer. More details about the subject
in the https://docs.wildfly.org/32/WildFly_Elytron_Security.html#Keycloak_SAML_Integration[WildFly documentation].
The same option is provided for https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/8.0/html-single/using_single_sign-on_with_jboss_eap/index#securing-applications-with-saml_securing-applications-deployed-on-server-with-single-sign-on[JBoss EAP 8 GA].

For an example about how to integrate Keycloak with JakartaEE applications running on latest Wildfly/EAP, take a look at the `servlet-saml-service-provider` Jakarta folder in the https://github.com/keycloak/keycloak-quickstarts[Keycloak Quickstart GitHub Repository].

include::partials/saml/installation.adoc[]
[[_saml-general-config]]

== Configuration

The SAML client adapter is configured by a XML file `/WEB-INF/keycloak-saml.xml` placed inside the WAR deployment. The configuration might look like the following:

[source,xml,subs="attributes+"]
----
<keycloak-saml-adapter xmlns="urn:keycloak:saml:adapter"
                       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
                       xsi:schemaLocation="urn:keycloak:saml:adapter {saml_adapter_xsd_urn}">
    <SP entityID="http://localhost:8081/sales-post-sig/"
        sslPolicy="EXTERNAL"
        nameIDPolicyFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"
        logoutPage="/logout.jsp"
        forceAuthentication="false"
        isPassive="false"
        turnOffChangeSessionIdOnLogin="false"
        autodetectBearerOnly="false">
        <Keys>
            <Key signing="true" >
                <KeyStore resource="/WEB-INF/keystore.jks" password="store123">
                    <PrivateKey alias="http://localhost:8080/sales-post-sig/" password="test123"/>
                    <Certificate alias="http://localhost:8080/sales-post-sig/"/>
                </KeyStore>
            </Key>
        </Keys>
        <PrincipalNameMapping policy="FROM_NAME_ID"/>
        <RoleIdentifiers>
            <Attribute name="Role"/>
        </RoleIdentifiers>
        <RoleMappingsProvider id="properties-based-role-mapper">
            <Property name="properties.resource.location" value="/WEB-INF/role-mappings.properties"/>
        </RoleMappingsProvider>
        <IDP entityID="idp"
             signaturesRequired="true">
        <SingleSignOnService requestBinding="POST"
                             bindingUrl="http://localhost:8081{kc_realms_path}/demo/protocol/saml"
                    />

            <SingleLogoutService
                    requestBinding="POST"
                    responseBinding="POST"
                    postBindingUrl="http://localhost:8081{kc_realms_path}/demo/protocol/saml"
                    redirectBindingUrl="http://localhost:8081{kc_realms_path}/demo/protocol/saml"
                    />
            <Keys>
                <Key signing="true">
                    <KeyStore resource="/WEB-INF/keystore.jks" password="store123">
                        <Certificate alias="demo"/>
                    </KeyStore>
                </Key>
            </Keys>
        </IDP>
     </SP>
</keycloak-saml-adapter>
----    

You can use `${...}` enclosure as System property replacement. For example `${jboss.server.config.dir}`.
To get detailed information of the different elements in the XML configuration file see link:{links_securing-apps_saml-galleon-layers-detailed-config_url}[{links_securing-apps_saml-galleon-layers-detailed-config_name}].

include::partials/saml/required_per_war_configuration.adoc[]
include::partials/saml/securing_wars.adoc[]
include::partials/saml/jboss-adapter-samesite-setting.adoc[]
include::partials/saml/idp-registration.adoc[]
include::partials/saml/logout.adoc[]
include::partials/saml/assertion-api.adoc[]
include::partials/saml/error_handling.adoc[]
include::partials/saml/debugging.adoc[]
include::partials/saml/multi-tenancy.adoc[]
include::partials/saml/saml-errors.adoc[]


