SAML 2.0 IDP with OIDC client, can I have IDP initiated SSO?

0
votes

I am using Keycloak as a broker for my app which is protected with OIDC. I have some SAML 2.0 IDPs and they can authenticate fine when doing SP initiated SSO, but I would like to be able to also do IDP initiated SSO, for example launching from directly in Okta or GSuite. I realize this is possible if the client is a SAML 2.0 client, but mine is OIDC. So is SAML 2.0 IDP initiated SSO to an OIDC client in Keycloak possible?

I'll add, that I've read through the docs and read through mailing lists posts and came out with an ambiguous "maybe"

1
keycloak

1 Answers

1
votes

OpenID Connect (OIDC) does not support IDP-initiated-SSO in a similar way as SAML 2.0 does. What you can do is leverage 3rd-party initiated SSO which is not exactly the same as it doesn't directly send a user with an assertion to the IDP but allows you to start SP-initiated-SSO through a 3rd-party (which could be the IDP in your case).