Cbioportal: Keycloak No Longer Exposes IDPSSODescriptor config

[Luke-Sikina]

The documentation for setting up cBioportal with Keycloak read as follows:

Next, navigate to the Installation tab for the same client.
Select SAML Metadata IDPSSODescriptor as the Format Option and click the Download button.

This format option is not exposed any more. I found a solution here. You can still find the xml at http://{KEYCLOAK-URL}/auth/realms/{REALM-NAME}/protocol/saml/descriptor, but I'm not sure if we want to recommend something that keycloak seems to want to hide.

[pieterlukasse]

@Luke-Sikina this looks like either a bug in keycloak or the wrong screen in keycloak. The list you show contains SPSOO.... which I would not expect to be an export option in case Keycloak is the IDP. It could be an option in case Keycloak is a SP for a central IDP, or if one is trying to register a new SP in Keycloak by importing a file.

[khzhu]

which version of Keycloak are you using? PM is using version 4.8 and the SAML Metadata IDPSSODescriptor is still available from the dropdown menu (please see attached).

[Luke-Sikina]

@khzhu I talked to Pim about this. The conclusion I've come to is that our documentation silently supports keycloak 4.8 without outright saying that it does. I found this issue on 7.0.1.

I sent an email to keycloak asking them about this. It may be that I'm just doing something wrong. It may also be that they are going to deprecate IDPSSODescriptor. I'll update this ticket once I hear back from them.

[stale[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[krnbr]

hi guys any news/ update on this one?

[vikas027]

hey @Luke-Sikina , Did you find a solution for the same? It looks IDPSSODescriptor has been removed in this PR but not sure what is the alternative.

[krnbr]

@vikas027 , @jjgao & @Luke-Sikina

this will be the format for the descriptor url for keycloak

http(s)://<your_host_domain>/auth/realms/<your-realm-name>/protocol/saml/descriptor

replace your_host_domain with the actual host name of your Keycloak instance

& your-realm-name with the realm you must have configured in the Keycloak

[vikas027]

Thanks, @krnbr . I figured it out yesterday from another resource. Additionally, to make things work in AWS, I had to replace

<EntityDescriptor entityID="https://<your_host_domain>/auth/realms/<your-realm-name>">

with

<EntityDescriptor entityID="https://<your_host_domain>/auth/realms/<your-realm-name>"
        xmlns="urn:oasis:names:tc:SAML:2.0:metadata"
        xmlns:dsig="http://www.w3.org/2000/09/xmldsig#"
        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">

NOTE: This was tested on Keycloak v10.0.2

[stale[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.