docs/documentation/platform/sso/keycloak-saml.mdx
If you're using Infisical Cloud, then it is available under the **Pro Tier**. If you're self-hosting Infisical,
then you should contact [email protected] to purchase an enterprise license to use it.
Next, copy the **Valid redirect URI** and **SP Entity ID** to use when configuring the Keycloak SAML application.
<Info>
You don’t typically need to make a realm dedicated to Infisical. We recommend adding Infisical as a client to your primary realm.
</Info>
In the General Settings step, set **Client type** to **SAML**, the **Client ID** field to `https://app.infisical.com`, and the **Name** field to a friendly name like **Infisical**.
<Info>
If you’re self-hosting Infisical, then you will want to replace https://app.infisical.com with your own domain.
</Info>
Next, in the Login Settings step, set both the **Home URL** field and **Valid redirect URIs** field to the **Valid redirect URI** from step 1 and press **Save**.
2.2. Once you've created the client, under its **Settings** tab, make sure to set the following values:
- Under **SAML Capabilities**:
- Name ID format: email (or username).
- Force name ID format: On.
- Force POST binding: On.
- Include AuthnStatement: On.
- Under **Signature and Encryption**:
- Sign documents: On.
- Sign assertions: On.
- Signature algorithm: RSA_SHA256.
2.3. Next, navigate to the **Client scopes** tab select the client's dedicated scope.
Next click **Add predefined mapper**.
Select the **X500 email**, **X500 givenName**, and **X500 surname** attributes and click **Add**.
Now click on the **X500 email** mapper and set the **SAML Attribute Name** field to **email**.
Repeat the same for **X500 givenName** and **X500 surname** mappers, setting the **SAML Attribute Name** field to **firstName** and **lastName** respectively.
Next, back in the client scope's **Mappers**, click **Add mapper** and select **by configuration**.
Select **User Property**.
Set the the **Name** field to **Username**, the **Property** field to **username**, and the **SAML Attribute Name** to **username**.
Repeat the same for the `id` attribute, setting the **Name** field to **ID**, the **Property** field to **id**, and the **SAML Attribute Name** to **id**.
Once you've completed the above steps, the list of mappers should look like this:
Also, in the **Keys** tab, locate the RS256 key and copy the certificate to use when finishing configuring Keycloak SAML in Infisical.
Once you've done that, press **Update** to complete the required configuration.
To enforce SAML SSO, you're required to test out the SAML connection by successfully authenticating at least one Keycloak user with Infisical;
Once you've completed this requirement, you can toggle the **Enforce SAML SSO** button to enforce SAML SSO.
<Warning>
We recommend ensuring that your account is provisioned the application in Keycloak
prior to enforcing SAML SSO to prevent any unintended issues.
</Warning>
<Info>
In case of a lockout, an organization admin can use the [Admin Login Portal](https://infisical.com/docs/documentation/platform/sso/overview#admin-login-portal) in the `/login/admin` path e.g. https://app.infisical.com/login/admin.
</Info>