SSO & Identity

Set up SAML SSO with Keycloak

If you self-host identity with Keycloak, DMARCS is just another SAML client in the realm. This assumes SSO is already on, from SAML setup.

Where to find it

Organization → Integrations → SSO

Who can use it

Organization Admin in DMARCS; an admin on the Keycloak realm you want to use

Time needed

10 minutes

You will need

Admin access to that Keycloak realm

Create the SAML client

1. Create the client

   In the Keycloak Admin Console, open the realm you want to use, go to Clients → Create client, and choose SAML as the client type.

Point it at DMARCS

Both the Valid Redirect URIs field and the Master SAML Processing URL field on the client's Settings page need the same ACS URL.

Map the email attribute

Keycloak's default Name ID Format is email for most realms; check the client's Advanced settings if your users don't sign in with their email address directly.

Give DMARCS Keycloak's details, then test

1. Get the metadata into DMARCS

   Download the realm's SAML IdP metadata from Realm settings → General → Endpoints, and upload it on DMARCS's SSO page with Upload Metadata, or copy the SSO endpoint and certificate by hand.

2. Check access

   Keycloak clients are open to all realm users by default; restrict it first if that's not what you want.

3. Enable and test

   Switch on Enable SSO on DMARCS's SSO page and save, then sign in from a private browser window.