You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@cloudstack.apache.org by "chunkyen (via GitHub)" <gi...@apache.org> on 2026/03/11 08:49:29 UTC
[D] Saml with Keycloak, signing and encryption confusion [cloudstack]
GitHub user chunkyen created a discussion: Saml with Keycloak, signing and encryption confusion
Hi, I have configured my Cloudstack 4.22 to integrate with Keycloak 26.5.5 via Saml.
I have read [https://github.com/apache/cloudstack/issues/4519](url) and it seems to imply that Cloudstack supports both signing and encryption for the payload for Saml.
However, to get my Keycloak to work, I need to turn off encryption of the assertions. Else, I will get "Failed to find admin configured username attribute in the SAML Response. Please ask your administrator to check SAML user attribute name." which I think is because Cloudstack is not able to decrypt the payload from Keycloak. I am using the Key that is provided from the getSPMetadata.
For the signing, there is a Global configuration named "saml2.check.signature". However, even with this turned on, I can still sign in using Saml when "Client signature required" setting is tured OFF. So I am not sure if the Cloudstack "saml2.check.signature" settings is actually enforcing signature checking requirement.
GitHub link: https://github.com/apache/cloudstack/discussions/12788
----
This is an automatically sent email for users@cloudstack.apache.org.
To unsubscribe, please send an email to: users-unsubscribe@cloudstack.apache.org
Re: [D] Saml with Keycloak, signing and encryption confusion [cloudstack]
Posted by "chunkyen (via GitHub)" <gi...@apache.org>.
GitHub user chunkyen edited a discussion: Saml with Keycloak, signing and encryption confusion
Hi, I have configured my Cloudstack 4.22 to integrate with Keycloak 26.5.5 via Saml.
I have read [#4519](https://github.com/apache/cloudstack/issues/4519) and it seems to imply that Cloudstack supports both signing and encryption for the payload for Saml.
However, to get my Keycloak to work, I need to turn off encryption of the assertions. Else, I will get "Failed to find admin configured username attribute in the SAML Response. Please ask your administrator to check SAML user attribute name." which I think is because Cloudstack is not able to decrypt the payload from Keycloak. I am using the Key that is provided from the getSPMetadata for both the signing and encryption in Keycloak.
For the signing, there is a Global configuration named "saml2.check.signature". However, even with this turned on, I can still sign in using Saml when "Client signature required" setting is turned OFF in Keycloak. So I am not sure if the Cloudstack "saml2.check.signature" settings is actually enforcing signature checking requirement.
GitHub link: https://github.com/apache/cloudstack/discussions/12788
----
This is an automatically sent email for users@cloudstack.apache.org.
To unsubscribe, please send an email to: users-unsubscribe@cloudstack.apache.org
Re: [D] Saml with Keycloak, signing and encryption confusion [cloudstack]
Posted by "kiranchavala (via GitHub)" <gi...@apache.org>.
GitHub user kiranchavala added a comment to the discussion: Saml with Keycloak, signing and encryption confusion
@chunkyen
Are you using a http or a https enabled cloudstack setup ?
GitHub link: https://github.com/apache/cloudstack/discussions/12788#discussioncomment-16155009
----
This is an automatically sent email for users@cloudstack.apache.org.
To unsubscribe, please send an email to: users-unsubscribe@cloudstack.apache.org
Re: [D] Saml with Keycloak, signing and encryption confusion [cloudstack]
Posted by "chunkyen (via GitHub)" <gi...@apache.org>.
GitHub user chunkyen edited a discussion: Saml with Keycloak, signing and encryption confusion
Hi, I have configured my Cloudstack 4.22 to integrate with Keycloak 26.5.5 via Saml.
I have read [#4519](https://github.com/apache/cloudstack/issues/4519) and it seems to imply that Cloudstack supports both signing and encryption for the payload for Saml.
However, to get my Keycloak to work, I need to turn off encryption of the assertions. Else, I will get "Failed to find admin configured username attribute in the SAML Response. Please ask your administrator to check SAML user attribute name." which I think is because Cloudstack is not able to decrypt the payload from Keycloak. I am using the Key that is provided from the getSPMetadata for both the signing and encryption in Keycloak.
For the signing, there is a Global configuration named "saml2.check.signature". However, even with this turned on, I can still sign in using Saml when "Client signature required" setting is turned OFF in Keycloak. So I am not sure if the Cloudstack "saml2.check.signature" settings is actually enforcing signature checking requirement.
Edit, there are 2 settings in Keycloak for signature Sign Documents and Sign assertions, Sign Documents also include both Sign assertions. So with Sign Documents disabled and saml2.check.signature enabled, I am not able to sign in **which is the correct behaviour** (see error screen below). Sign assertions will have no impact to Saml when integrating with cloudstack
<img width="689" height="167" alt="image" src="https://github.com/user-attachments/assets/4adb3fbe-bb16-43d4-b925-d35c5fae4bd5" />
GitHub link: https://github.com/apache/cloudstack/discussions/12788
----
This is an automatically sent email for users@cloudstack.apache.org.
To unsubscribe, please send an email to: users-unsubscribe@cloudstack.apache.org
Re: [D] Saml with Keycloak, signing and encryption confusion [cloudstack]
Posted by "chunkyen (via GitHub)" <gi...@apache.org>.
GitHub user chunkyen added a comment to the discussion: Saml with Keycloak, signing and encryption confusion
Https with self signed cert on cloudstack and keycloak.
GitHub link: https://github.com/apache/cloudstack/discussions/12788#discussioncomment-16173324
----
This is an automatically sent email for users@cloudstack.apache.org.
To unsubscribe, please send an email to: users-unsubscribe@cloudstack.apache.org
Re: [D] Saml with Keycloak, signing and encryption confusion [cloudstack]
Posted by "chunkyen (via GitHub)" <gi...@apache.org>.
GitHub user chunkyen added a comment to the discussion: Saml with Keycloak, signing and encryption confusion
Apologies, I have forgotten my config. Although Cloudstack uses https, Keycloak is using http. I am also not able to use the https cloudstack endpoint as a redirect url, so I have also switched it to http. How will this affect the signing and encryption in SAML @kiranchavala ?
GitHub link: https://github.com/apache/cloudstack/discussions/12788#discussioncomment-16218704
----
This is an automatically sent email for users@cloudstack.apache.org.
To unsubscribe, please send an email to: users-unsubscribe@cloudstack.apache.org
Re: [D] Saml with Keycloak, signing and encryption confusion [cloudstack]
Posted by "chunkyen (via GitHub)" <gi...@apache.org>.
GitHub user chunkyen edited a discussion: Saml with Keycloak, signing and encryption confusion
Hi, I have configured my Cloudstack 4.22 to integrate with Keycloak 26.5.5 via Saml.
I have read [https://github.com/apache/cloudstack/issues/4519](url) and it seems to imply that Cloudstack supports both signing and encryption for the payload for Saml.
However, to get my Keycloak to work, I need to turn off encryption of the assertions. Else, I will get "Failed to find admin configured username attribute in the SAML Response. Please ask your administrator to check SAML user attribute name." which I think is because Cloudstack is not able to decrypt the payload from Keycloak. I am using the Key that is provided from the getSPMetadata for both the signing and encryption in Keycloak.
For the signing, there is a Global configuration named "saml2.check.signature". However, even with this turned on, I can still sign in using Saml when "Client signature required" setting is turned OFF in Keycloak. So I am not sure if the Cloudstack "saml2.check.signature" settings is actually enforcing signature checking requirement.
GitHub link: https://github.com/apache/cloudstack/discussions/12788
----
This is an automatically sent email for users@cloudstack.apache.org.
To unsubscribe, please send an email to: users-unsubscribe@cloudstack.apache.org
Re: [D] Saml with Keycloak, signing and encryption confusion [cloudstack]
Posted by "chunkyen (via GitHub)" <gi...@apache.org>.
GitHub user chunkyen edited a discussion: Saml with Keycloak, signing and encryption confusion
Hi, I have configured my Cloudstack 4.22 to integrate with Keycloak 26.5.5 via Saml.
I have read [https://github.com/apache/cloudstack/issues/4519](url) and it seems to imply that Cloudstack supports both signing and encryption for the payload for Saml.
However, to get my Keycloak to work, I need to turn off encryption of the assertions. Else, I will get "Failed to find admin configured username attribute in the SAML Response. Please ask your administrator to check SAML user attribute name." which I think is because Cloudstack is not able to decrypt the payload from Keycloak. I am using the Key that is provided from the getSPMetadata for both the signing and encryption in Keycloak.
For the signing, there is a Global configuration named "saml2.check.signature". However, even with this turned on, I can still sign in using Saml when "Client signature required" setting is tured OFF. So I am not sure if the Cloudstack "saml2.check.signature" settings is actually enforcing signature checking requirement.
GitHub link: https://github.com/apache/cloudstack/discussions/12788
----
This is an automatically sent email for users@cloudstack.apache.org.
To unsubscribe, please send an email to: users-unsubscribe@cloudstack.apache.org
Re: [D] Saml with Keycloak, signing and encryption confusion [cloudstack]
Posted by "gpordeus (via GitHub)" <gi...@apache.org>.
GitHub user gpordeus added a comment to the discussion: Saml with Keycloak, signing and encryption confusion
@chunkyen are you using Keycloak's default metadata URL? Could you check if there is only one KeyDescriptor and if it has the `use=signing` attribute? If so, try [this](https://github.com/apache/cloudstack/issues/12831#issuecomment-4158078385).
GitHub link: https://github.com/apache/cloudstack/discussions/12788#discussioncomment-16395424
----
This is an automatically sent email for users@cloudstack.apache.org.
To unsubscribe, please send an email to: users-unsubscribe@cloudstack.apache.org
Re: [D] Saml with Keycloak, signing and encryption confusion [cloudstack]
Posted by "chunkyen (via GitHub)" <gi...@apache.org>.
GitHub user chunkyen edited a discussion: Saml with Keycloak, signing and encryption confusion
Hi, I have configured my Cloudstack 4.22 to integrate with Keycloak 26.5.5 via Saml.
I have read [#4519](https://github.com/apache/cloudstack/issues/4519) and it seems to imply that Cloudstack supports both signing and encryption for the payload for Saml.
However, to get my Keycloak to work, I need to turn off encryption of the assertions. Else, I will get "Failed to find admin configured username attribute in the SAML Response. Please ask your administrator to check SAML user attribute name." which I think is because Cloudstack is not able to decrypt the payload from Keycloak. I am using the Key that is provided from the getSPMetadata for both the signing and encryption in Keycloak.
For the signing, there is a Global configuration named "saml2.check.signature". However, even with this turned on, I can still sign in using Saml when "Client signature required" setting is turned OFF in Keycloak. So I am not sure if the Cloudstack "saml2.check.signature" settings is actually enforcing signature checking requirement.
Edit, there are 2 settings in Keycloak for signature Sign Documents and Sign assertions, Sign Documents also include Sign assertions. So with Sign Documents disabled and saml2.check.signature enabled, I am not able to sign in **which is the correct behaviour** (see error screen below). Sign assertions will have no impact to Saml when integrating with cloudstack
<img width="689" height="167" alt="image" src="https://github.com/user-attachments/assets/4adb3fbe-bb16-43d4-b925-d35c5fae4bd5" />
GitHub link: https://github.com/apache/cloudstack/discussions/12788
----
This is an automatically sent email for users@cloudstack.apache.org.
To unsubscribe, please send an email to: users-unsubscribe@cloudstack.apache.org