# SAML Bearer Assertion Flow - how to setup Keycloak to issue tokens based on SAML assertion

**URL:** <https://forum.keycloak.org/t/saml-bearer-assertion-flow-how-to-setup-keycloak-to-issue-tokens-based-on-saml-assertion/3983>\
**Category:** Configuring the server\
**Tags:** oidc, saml\
**Created:** [July 27, 2020, 6:11pm UTC](https://forum.keycloak.org/t/saml-bearer-assertion-flow-how-to-setup-keycloak-to-issue-tokens-based-on-saml-assertion/3983 "2020-07-27T18:11:08Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![trojanbug](https://avatars.discourse-cdn.com/v4/letter/t/e495f1/32.png) [@trojanbug](https://forum.keycloak.org/u/trojanbug)\
**Post date:** [July 27, 2020, 6:11pm UTC](https://forum.keycloak.org/t/saml-bearer-assertion-flow-how-to-setup-keycloak-to-issue-tokens-based-on-saml-assertion/3983/1 "2020-07-27T18:11:08Z")

</div>

Hello All,

I am struggling to find documentation or advice describing usage of SAML Bearer Assertion Flow with Keycloak. The grant type grant\_type=urn:ietf:params:oauth:grant-type:saml2-bearer. Alternatively, any information on configuring Token Exchange with Keycloak would be appreciated, as the flow seems similar enough (while rules of tusting the 3rd party token are surely different).

I would like Keycloak to verify presented SAML assertion in the OIDC / Oauth2 token endpoint, and issue corresponding access / id tokens, for the user the assertion was issued for. Any example workign configuration highly appreciated.

Regards,  
Chris

---

<div class="post-metadata">

**Author:** ![lgazo](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/lgazo/32/1496_2.png) [@lgazo](https://forum.keycloak.org/u/lgazo)\
**Post date:** [October 9, 2020, 1:14pm UTC](https://forum.keycloak.org/t/saml-bearer-assertion-flow-how-to-setup-keycloak-to-issue-tokens-based-on-saml-assertion/3983/2 "2020-10-09T13:14:48Z")

</div>

If I take a look on supported grant types in the introspection, saml2-bearer is not there. Is it even supported somehow?

---

<div class="post-metadata">

**Author:** ![ionm](https://avatars.discourse-cdn.com/v4/letter/i/f4b2a3/32.png) [@ionm](https://forum.keycloak.org/u/ionm)\
**Post date:** [February 16, 2021, 3:45pm UTC](https://forum.keycloak.org/t/saml-bearer-assertion-flow-how-to-setup-keycloak-to-issue-tokens-based-on-saml-assertion/3983/3 "2021-02-16T15:45:50Z")

</div>

I am looking for something similar, I have a angular client secured with SAML using a REST service, I would need to get the tokens to be able to authenticate against the REST based on the SAML assertion.

Any of you found the solution to this?  
Would be greatly appreciated.  
Thanks,  
Ion

---

<div class="post-metadata">

**Author:** ![nishanthreddy](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/nishanthreddy/32/4368_2.png) [@nishanthreddy](https://forum.keycloak.org/u/nishanthreddy)\
**Post date:** [November 17, 2021, 10:38am UTC](https://forum.keycloak.org/t/saml-bearer-assertion-flow-how-to-setup-keycloak-to-issue-tokens-based-on-saml-assertion/3983/4 "2021-11-17T10:38:35Z")

</div>

Hi All,

```
  Any of you found any solution to this? If yes, could you please share the details?

```

Thanks,  
Nishanth