> ## Documentation Index
> Fetch the complete documentation index at: https://docs.flashduty.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Keycloak
> Configure SAML2.0 or OIDC protocol via Keycloak for single sign-on
Keycloak is an open-source identity and access management solution that provides a comprehensive set of tools and features to help developers quickly implement secure user authentication and authorization mechanisms.
This article does not cover deployment or explanation of Keycloak. For more information, please refer to the [official documentation](https://www.keycloak.org/).
## Protocol Configuration
### 1. Get ACS URL
Login to Flashduty console and obtain the ACS URL (needed in subsequent steps).
Path: **Access Control => Single Sign-On => Settings => SAML2.0 Protocol => Flashduty Service Provider Info => Assertion Consumer Service URL**
### 2. Create Client
Login to Keycloak console, path: **Clients => Create client**
* **Client Type**: Select SAML protocol
* **Client ID**: Enter `flashcat.cloud` (fixed value, cannot be changed)
**Valid redirect URIs**: Enter the ACS URL obtained from Flashduty
### 3. Configure Client Information
Change **Name ID format** to email type:
Set **Client signature required** to disabled:
**Create Client scope**:
Before creating, delete the previous OpenID Connect protocol user first, then set it as Default after creation.
Create email/phone/username types as shown:
Completed result:
**Add users to the Client**:
**Configure email/phone/username mappers** (using email as example, configure others similarly):
### 4. Download XML File
The downloaded file is a compressed package. After extracting locally, there will be two xml files; only the `idp-metadata.xml` file is needed.
Download locally from **Client => Action**:
Upload the XML file to Flashduty's single sign-on configuration:
### 5. Create User and Test Login
Create user (must bind an email address):
**Login test**: Visit `console.flashcat.cloud`, select SSO login, enter the login domain prefix from single sign-on configuration in the domain field.
### 1. Get Redirect URL
Login to Flashduty console and obtain the Redirect URL (needed in subsequent steps).
Path: **Access Control => Single Sign-On => Settings => OIDC Protocol => Flashduty Service Provider Info => Redirect URL**
### 2. Create Client
Login to Keycloak console, create new Client:
* **Client Type**: Select OIDC protocol
* **Client ID**: No special requirements
**Client authentication**: Keep enabled
**Valid redirect URIs**: Enter the Redirect URL obtained in step 1
### 3. Get Client Information
* **Client ID**: The ID entered when creating the Client
* **Client Secret**: View in **Client Details => Credentials** card
* **Issuer**: View in **Realm settings => Endpoints => OpenID Endpoint Configuration**
### 4. Configure Flashduty Single Sign-On
Enter the above information into Flashduty single sign-on configuration:
After configuration, refer to step 5 of the SAML2.0 protocol for login testing.