# IDP initiated SAML SSO using keycloak as IDP

**URL:** <https://forum.keycloak.org/t/idp-initiated-saml-sso-using-keycloak-as-idp/26722>\
**Category:** Getting advice\
**Tags:** saml\
**Created:** [June 28, 2024, 9:17pm UTC](https://forum.keycloak.org/t/idp-initiated-saml-sso-using-keycloak-as-idp/26722 "2024-06-28T21:17:29Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![peter-kindlyhuman](https://avatars.discourse-cdn.com/v4/letter/p/b38774/32.png) [@peter-kindlyhuman](https://forum.keycloak.org/u/peter-kindlyhuman)\
**Post date:** [June 28, 2024, 9:17pm UTC](https://forum.keycloak.org/t/idp-initiated-saml-sso-using-keycloak-as-idp/26722/1 "2024-06-28T21:17:29Z")

</div>

Hello! I’m building a flow for our app which involves the following requirements:

1. allow our users to SSO into an app built by our partner, which is secured by Auth0 SP
2. users are already authenticated in our app (which is secured by Keycloak as IDP) and have an valid access\_token provided by logging in through Keycloak login page.
3. users click a tile in our app to SSO into the partner app.

- We want them to be SSO’d into the partner app without logging in again – that is, we want to leverage their existing access token, rather than provision a new one through subsequent authentication.

Basically this is an IDP-initiated SAML SSO flow, with Keycloak as the IDP. I’ve read the docs on IDP-initiated login and believe this flow is possible. But I’m confused about how to setup our Keycloak configuration to support this.

Users will already be authenticated with Keycloak because we’ve secured our frontend app using a public OIDC flow, so users will have a valid JWT by the time they click on the link that triggers the IDP-initiated SSO.

I’m wondering if anyone has advice on configuring my Keycloak instance to support this use case, or can point me towards examples / guides that implement something similar. I’ve found many examples / guides that solve similar problems, but none that implement this sort of IDP-initiated flow with Keycloak as IDP.

Thanks so much for your help!

---

<div class="post-metadata">

**Author:** ![peter-kindlyhuman](https://avatars.discourse-cdn.com/v4/letter/p/b38774/32.png) [@peter-kindlyhuman](https://forum.keycloak.org/u/peter-kindlyhuman)\
**Post date:** [July 15, 2024, 4:38pm UTC](https://forum.keycloak.org/t/idp-initiated-saml-sso-using-keycloak-as-idp/26722/2 "2024-07-15T16:38:55Z")

</div>

bumping post for visibility…

---

<div class="post-metadata">

**Author:** ![xgp](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/xgp/32/2589_2.png) [@xgp](https://forum.keycloak.org/u/xgp)\
**Post date:** [July 15, 2024, 7:36pm UTC](https://forum.keycloak.org/t/idp-initiated-saml-sso-using-keycloak-as-idp/26722/3 "2024-07-15T19:36:12Z")

</div>

> [@How to perform IDP initiated login in keycloak saml](https://forum.keycloak.org/t/how-to-perform-idp-initiated-login-in-keycloak-saml/20476/2):
>
> This post is somewhat old, but I have used it as a guide when implementing IdP initiated login. The example is specific to Okta SAML, but it shouldn’t be too hard to adapt it to other IdP types: [https://www.lisenet.com/2020/keycloak-with-okta-idp-initiated-sso-login/](https://www.lisenet.com/2020/keycloak-with-okta-idp-initiated-sso-login/) The Keycloak docs are here, but I’ve found them fairly hard to follow: [keycloak-documentation/idp-initiated-login.adoc at main · keycloak/keycloak-documentation · GitHub](https://github.com/keycloak/keycloak-documentation/blob/main/server_admin/topics/clients/saml/idp-initiated-login.adoc)