keyCloak SAML login to aws managed grafana

Getting advice
1

I try to use keycloak as authentication into AWS managed grafana which only supports SAML.
Does anyone have a similar setup and can explain which fields to configure?
Whatever I do I either get “failed to save the SAML received information” when setting “sign assertions”=ON or I get “failed to determine the state of the SSO redirect” with “sign assertions=off”
I also do not know how to debug this since I cannot see which data is actually returned by keycloak to the AWS grafana workspace login page.

Any help would be appreciated.
kind regards,
Gert

2

I managed to get it working finally.
The main issue was I had to set “sign documents”=off and “sign assertions”=on + set SAML signature key name=CERT_SUBJECT.
I also had to add a predefined “role list” mapper to return keycloak roles to AWS + define an additional setting in AWS SAML with an editor role value set to the editor role I defined in keycloak.

Gert.