Federate an Identity Provider
A 5-step recipe with Keycloak. We can help you get access.
Recipe · 5 steps
Federate an Identity Provider
with Keycloak · Identity & Access Management
Create or update a federated identity provider and confirm its configuration.
- Probe the alias directly. Both 200 and 404 count as a successful probe here: the status code is the branch signal, and a 404 is the expected answer for a provider that has not been federated yet.
- Update the federated provider in place, keyed by its alias. Jumps to the read-back so the create branch is not also executed.
- Federate the provider for the first time. Keycloak answers 201 with no response body, so the stored configuration is resolved by the read-back step that follows.
- Read the provider back to confirm the stored configuration and the internal id Keycloak generated. Secrets in the config map are not echoed, so this verifies the wiring rather than the credential.
- List every identity provider in the realm, so the caller ends with the full federation picture rather than just the provider that was touched.
What you'll need to have ready
- realm: The name of the realm to federate the provider into.
- alias: The unique alias for the identity provider (e.g. "corp-okta"). This is the identifier the provider is addressed by and appears in the broker redirect URI.
- displayName: The name shown on the login page button.
- providerId: The identity provider type, such as oidc, saml, google, github, or facebook.
- config: Provider-specific configuration as a map of string values, such as clientId, clientSecret, authorizationUrl, and tokenUrl for an OIDC provider.
- trustEmail: When true, emails from this provider are treated as verified. Only enable for providers that genuinely verify email.
- firstBrokerLoginFlowAlias: The authentication flow to run on a user's first login through this provider.
For your developer
Arazzo workflow keycloak:federate-identity-provider, 5 operations: getIdentityProvider → updateIdentityProvider → createIdentityProvider → getIdentityProvider → getIdentityProviders. Specs on APIs.io.