This article does not cover deployment or explanation of Keycloak. For more information, please refer to the official documentation.
Protocol Configuration
- SAML2.0 Protocol
- OIDC Protocol
1. Get ACS URL
Login to Flashduty console and obtain the ACS URL (needed in subsequent steps).Path: Access Control => Single Sign-On => SAML2.0 Protocol => Flashduty Service Provider Info => Assertion Consumer Service URL
2. Create Client
Login to Keycloak console, path: Clients => Create client- Client Type: Select SAML protocol
- Client ID: Enter
flashcat.cloud(fixed value, cannot be changed)
Valid redirect URIs: Enter the ACS URL obtained from Flashduty
3. Configure Client Information
Change Name ID format to email type:
Set Client signature required to disabled:
Create Client scope:Create email/phone/username types as shown:
Completed result:
Add users to the Client:
Configure email/phone/username mappers (using email as example, configure others similarly):
4. Download XML File
The downloaded file is a compressed package. After extracting locally, there will be two xml files; only the
idp-metadata.xml file is needed.
Upload the XML file to Flashduty’s single sign-on configuration:
5. Create User and Test Login
Create user (must bind an email address):
Login test: Visit console.flashcat.cloud and select SSO login. The SSO sign-in page defaults to business email sign-in — enter your business email to locate your organization and enter its authentication flow. If you only know the company domain, click Sign in with company domain to switch to the domain input, then enter your organization’s login domain (configured on the Platform Management → Organization → Organization Information → Organization Profile page). You can also initiate single sign-on directly at {domain}.sso.flashcat.cloud.
