Using Keycloak as IdP for Azure AD

Securing applications
21

Thanks for the effort!

Grace and peace,
William Hatcher
Owner, Mr. Translate
https://mrtranslate.bot/

22

I don’t know if there is better guide somewhere - that I could not find, but this thread helped me to finally setup MS Office 365 login via Keycloak. I want to confirm that hits/guides here worked for me on January 2023 with Keycloak 20.0.3.
More than few posts here are pure gold. Thank you all!

1 Like
23

Thank you so much for all your helps; I was able to get working following this guide.

(The question I previously added was not really related in this thread that I remove.
For those who goes to the office main portal, not the started app like teams or ppt etc, check the RelayState)

25

This was great, thank you. Got it working without a single hitch.

Now I can create a user in FreeIPA, have it synced to Keycloak and use it to login to Microsoft 365.

I think I’ll need to disable Azure’s “Security Defaults” to make it a more seamless experience, and integrate PrivacyIDEA for a better MFA experience, but it’s getting there!

26

Hello to all
I know this is an older post,
I am trying to setup a similar configuration, I succesfully set up sso for a single, manually created user, but I am not sure I understand how the user sync should be done for consequent users added to KC.
Using the [astachowski] provided [keycloak-sync.ps1] PowerShell script would be a solution but it needs a windows server to be executed, scheduled, etc.
Is there any other way to sync Keycloak users to Entra ID? Anything like Entra ID Connect or Cloud sync?

27

Hi there,

I’ve created and tested my powershell script on a linux vm.

If could always create an ADFS service if you already have a domain controller.
Tough I never liked the syncing of password hashes into Entra AD - hence this Keycloak based flow.

You could always develop your own application facilitating Microsoft Graph and doing a group check in your own IdM to rollout an Entra ID account.

28

Does anybody knows how is this ImmutableId generated, and by which system (MS or Keycloak)?

I would like to automate user migration and new user creation, but I am not sure if I can somehow generate those strings. Are they just some kind of random UUID values or there is any additional restriction?

Edit: I read now that it was mentioned that ImmutableId can be anything, so I will try with some generated ID.