Sentry SSO via SAML Keycloak does not work

Self-Hosted Version

23.10.1

CPU Architecture

x86_64

Docker Version

20.10.25

Docker Compose Version

2.23.0

Steps to Reproduce

Install and start Sentry Clone self-hosted sentry: git clone https://github.com/getsentry/self-hosted.git Switch branch: git checkout 23.10.1 Starting install script: ./install.sh Stop container and add system.url-prefix: 'http://localhost:9000' to config.yml Start sentry: docker-compose up -d

Start Keycloak My Keycloak image: quay.io/keycloak/keycloak:23.0.4 Keycloak starts with Docker

docker run -d --name keycloak \
    -e KEYCLOAK_ADMIN=admin \
    -e KEYCLOAK_ADMIN_PASSWORD=password \
    -e PROXY_ADDRESS_FORWARDING=true \
    -e KC_HOSTNAME_STRICT_BACKCHANNEL=false \
    -e KC_HOSTNAME_ADMIN_URL=https://auth0.example.com/ \
    -e KC_HOSTNAME_URL=https://auth0.example.com/ \
    -e KEYCLOAK_FRONTEND_URL=https://auth0.example.com/ \
    --link mysql:mysql \
    quay.io/keycloak/keycloak:23.0.4 start-dev \
    --db=mysql --features=token-exchange \
    --db-url=jdbc:mysql://mysql:3306/keycloak --db-username=root --db-password=password

Setup Keycloak Setting up a new client within Keycloak under the master realm Settings:
- Client ID: http://localhost:9000/saml/metadata/sentry/
- Sign Assertions: OFF
- Encrypt Assertions: OFF
- Client Signature Required: OFF
- Force POST Binding: ON
- Force Name ID Format: OFF
- Name ID Format: email
- Valid Redirect URIs: *
- Assertion Consumer Service POST Binding URL: http://localhost:9000/saml/acs/sentry
- Logout Service POST Binding URL: http://localhost:9000/saml/sls/sentry Mapping Settings:
- Add new X500 email mapper to this client
- Set SAML Attribute Name to user_email
Setup SAML2 within Sentry Use Metadata URL method：

Enter in the required field: user_email

After clicking Save Configuration, perform Keycloak SSO user verification. After successful verification, jump back to Sentry, and the following error message appears.

Eoor Msg: Authentication error: Single sign-on SAML SSO failed, There is no AttributeStatement on the Response

Expected Result

I expected that after successfully authenticating the Keycloak SSO user, it would jump to Sentry normally.Now I can't proceed with the next step of configuration~!

I Googled this error "There is no AttributeStatement on the Response" and found that Sentry expected to receive specific attributes (AttributeStatement) from the SAML response sent by Keycloak, but did not actually receive these attributes.

But I don’t know how to configure this. I also checked the sentry documentation library and found no corresponding error message.

And I also suspect that the keycloak is not carrying the firstName, lastName over, while I refer to issues: https://github.com/getsentry/self-hosted/issues/1571, configured the keycloak saml client mappers

Actual Result

I observed that keycloak has no error or warning logs.

As for the sentry saml2 auth authentication log, I don't know which container is responsible for processing and recording the log, because I haven't checked it. If possible, can you tell me how to check the saml2 auth authentication log? I will add the log as soon as possible

Event ID

No response

getsentry / self-hosted