Migration guide: SimpleSAMLphp/OpenID Connect Provider to Keycloak

• 1. Introduction
  • 1.1. Notes about UCS 5.2
  • 1.2. About this document
• 2. Limitations of the Keycloak app
  • 2.1. App authorization
  • 2.2. Customization of the login page
• 3. Migration procedure
  • 3.1. Prerequisites
  • 3.2. Migration of services using OIDC for authentication
  • 3.3. Migration of services using SAML for authentication
    • 3.3.1. Create LDAP attribute mappers
    • 3.3.2. Create a SAML client in Keycloak
    • 3.3.3. Configure user attributes for SAML response
    • 3.3.4. Configure SAML services to use Keycloak
    • 3.3.5. UCR variable differences
  • 3.4. Forward from legacy SimpleSAMLphp to Keycloak
  • 3.5. Kerberos
    • 3.5.1. Add Kerberos SPN to Samba on replicas
    • 3.5.2. Migrate the Kerberos filter-subnets settings to Keycloak
• 4. Samples for migration of SAML and OIDC services
  • 4.1. Services using SAML
    • 4.1.1. UCS Portal
    • 4.1.2. Nextcloud
    • 4.1.3. Google Workspace Connector
    • 4.1.4. Microsoft 365 Connector
  • 4.2. Services using OIDC
    • 4.2.1. ownCloud
• 5. Services validation and troubleshooting
  • 5.1. Log files
  • 5.2. Single sign-on settings
• 6. Prepare for the update to UCS 5.2
• 7. Bibliography