# HELP Setting up SAML with Keycloak

**URL:** <https://forums.rocket.chat/t/help-setting-up-saml-with-keycloak/1613>\
**Category:** Community Support\
**Created:** [July 18, 2018, 8:14am UTC](https://forums.rocket.chat/t/help-setting-up-saml-with-keycloak/1613 "2018-07-18T08:14:53Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ned\_Kelly](https://sea1.discourse-cdn.com/flex021/user_avatar/forums.rocket.chat/ned_kelly/32/429_2.png) [@Ned\_Kelly](https://forums.rocket.chat/u/Ned_Kelly)\
**Post date:** [July 18, 2018, 8:14am UTC](https://forums.rocket.chat/t/help-setting-up-saml-with-keycloak/1613/1 "2018-07-18T08:14:53Z")

</div>

Hey Guys,  
Need help setting up SAML  
I created a SAML client in keycloak, but as the keycloak SAML fields are named differently to rocketchats, **so im confused about what fields to setup in keycloak, and where to put them in rocketchat?**  
I have looked at the rocket chat documentation here:  
[https://rocket.chat/docs/administrator-guides/authentication/saml/](https://rocket.chat/docs/administrator-guides/authentication/saml/)

**These seem fields seem to be the main ones needed by rocket chat**

> Custom Entry Point ?  
> IDP SLO Redirec URL ?  
> Custom Issuer ?

Rocket chat admin requires certificate info (which ive worked out):

> Custom Certificate (public CA cert for keycloak site) **Correct?**  
> Public cert contents (Keycloak generated public key) **Correct?**  
> Private Key contents (keycloak generated private key) **Correct?**

In keycloak,  
**Should i turn on Sign Assertions?**  
**Should i turn on Encrypt Assertions ?**

I set a keycloak Master SAML Processing URL [https://mykeycloakdomain.com:8443/rockechat/saml](https://mykeycloakdomain.com:8443/rockechat/saml)  
Does that go in one of the required rocketchat fields?

In keycloak have NOT set:  
**Root URL**  
**Valid Redirect URIs**  
**Base URL**  
**IDP Initiated SSO URL Name**  
**IDP Initiated SSO Relay State**  
As i dont really know what to put…?

Everything else in keycloak is default.  
Do i need to do anything in keycloak client scopes?

Ive asked over at JBoss (keycloak developers) but unfortunately their community hasnt replied…  
Here’s a screenshot of the keycloak SAML admin page

 ![keycloak%20rocketchat](https://us1.discourse-cdn.com/flex021/uploads/rocketchat/original/1X/3201db953e0c5fbb9204613c0178a0d207d1334c.png)