This repository contains a keycloak extension which adds support for the SAML v2.0 dialect of the eIDAS nodes. It provides an identity provider extension which allows keycloak to be setup as an "identity broker".
Keycloak is an open source Identity and Access Management system for modern applications.
eIDAS-Nodes are operated from EU member states according to the eIDAS Regulation in order to ensure that people and businesses can use their own national eIDs (electronic identification schemes) to access public services available online in other countries.
The eIDAS Nodes use an extended version of SAML v2.0 which defines a number of SAML elements and attribute definitions which are not supported by default in standard SAML implementations. This extension provides support for these extensions, by offering a custom IdP which can use this extended dialect.
See eIDAS+eID+Profile and the following documents for the v1.2 technical specifications:
Download the latest release jar from the releases page. Then deploy it in keycloak by copying it at folder
KEYCLOAK_HOME/standalone/deployments/
. See the keycloak documentation for the directory structure of the keycloak server.
Extension version | Keycloak version |
---|---|
0.5 | 15.0.2 - 18.0.2 |
0.6 | 18.0.2, 19.0.2 (partial admin UI) |
0.7 | 20.0.2 (partial admin UI) |
0.8 | 21.0.1 (partial admin UI) |
0.9 | 22.0.3 (partial admin UI) |
0.10 | 23.0.2 (partial admin UI) |
0.11 | 24.0.4 |
Depending on the version of keycloak (between 18 and 23) the admin UI might not show the extra attributes and you might need to configure the extension by editing the configuration inside the DB. Another possibility is to import your realm from json and thus be able to configure the extension. See this example for an example.
The extension provides the following components which are needed in order to connect to an eIDAS node using the extended definitions of the eIDAS technical specifications:
${ALIAS}.${ATTRIBUTE.PersonIdentifier}
and target BROKER_ID
.
You can also adjust the username in a similar fashion. You can find a very simple howto guide at howto/README.md.
Build the project using maven
mvn install
You can find the jar under target/keycloak-eidas-idp-x.x.x.jar
.
Apache License, Version 2.0