Security Assertion Markup Language (SAML) allows you to access multiple web-based applications using a single set of authentication credentials. It is possible to configure Keycloak to access a SAML server via a preconfigured proxy in situations where Keycloak’s host doesn’t have direct access to the internet.

  1. Open a terminal and log in to your instance of Package Security Manager as an admin.

  2. Open your installer file, where the docker-compose.yml file is located by running the command:

    # Replace <INSTALLER_LOCATION> with the location of your installer file (where the ``docker-compose.yml`` file is)
cd <INSTALLER_LOCATION>

    You can see all the files contained in your current directory location by running the command ls -la in the terminal. You can look for the docker-compose.yml file this way, if necessary.

  3. Open your docker-compose.yml file using your preferred file editor.

  4. Find the Keycloak service section of the file, and under environment:, add the following lines:

    # Replace <PROXY_SITE_URL> with the URL of your SAML proxy
HTTP_PROXY: <PROXY_SITE_URL>
HTTPS_PROXY: <PROXY_SITE_URL>

  5. Save your work and close the file. To verify your changes were saved, you can run the command:

    cat docker-compose.yml

    Here is an excerpt from a docker-compose.yml file to show you what your Keycloak section might look like.

    keycloak:
  image: ${DOCKER_REGISTRY}keycloak:${VERSION}
  environment:
  - KEYCLOAK_IMPORT=true
  - KC_DB_URL_HOST=${POSTGRES_HOST}
  - KC_DB_URL_PORT=5432
  - KC_DB_URL_DATABASE=keycloak
  - KC_DB_USERNAME=keycloak
  - KC_DB_PASSWORD=keycloak
  - KC_HOSTNAME=${DOMAIN}
  - KC_PROXY=edge
  - KC_HOSTNAME_STRICT_HTTPS=false
  - KC_HTTP_ENABLED=true
  - HTTP_PROXY: <PROXY_IP>:<PROXY_PORT>
  - HTTPS_PROXY: <PROXY_IP>:<PROXY_PORT>

  6. Restart your instance of Package Security Manager.

    docker compose down
docker compose up --detach