Add Keycloak SAML provider and Keycloak admin API clients - #705
Open
dasarinaidu wants to merge 1 commit into
Open
Add Keycloak SAML provider and Keycloak admin API clients#705dasarinaidu wants to merge 1 commit into
dasarinaidu wants to merge 1 commit into
Conversation
There was a problem hiding this comment.
🟡 Changes recommended
Several confirmed issues in the SAML flow helpers (relay state handling, form selection, URL construction) and a hard-coded Keycloak-only guard contradict the stated provider-parameterization goal and can break non-Keycloak or edge-case SAML logins.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Pull request overview
This PR introduces automation support for Rancher SAML authentication providers backed by Keycloak by adding (1) a Keycloak Admin REST API client and (2) Rancher SAML auth-provider clients plus low-level SAML/HTML helpers to drive the login + assertion flow.
Changes:
- Added
clients/keycloakto manage realms, clients, protocol mappers, groups, and users via Keycloak’s admin API. - Added
extensions/auth/samlandclients/rancher/auth/samlto initiate SAML logins, capture/submit assertions, manage Rancher SAML auth configs, and generate SP keypairs. - Extended the Rancher client/auth surfaces with
AsSAMLUser,Keycloakprovider client wiring, and a newdefaults.OneSecondTimeout.
File summaries
| File | Description |
|---|---|
| extensions/defaults/defaults.go | Adds a 1-second timeout constant used for SAML retry loops. |
| extensions/auth/saml/saml.go | Implements raw HTTP helpers for Rancher SAML login/test-and-enable, assertion submission, and session identity lookup. |
| extensions/auth/saml/metadata.go | Fetches and inspects Rancher-published SP metadata (cert matching). |
| extensions/auth/saml/loginform.go | Implements HTML login-form parsing and submission for IdP login flows. |
| extensions/auth/saml/diagnose.go | Adds diagnostic helpers to describe/dump IdP HTML responses when assertions are missing. |
| extensions/auth/saml/assertion.go | Parses IdP auto-submit forms and decodes SAML assertions (attributes + validity). |
| clients/rancher/client.go | Adds AsSAMLUser for session-cookie-based authentication via SAML. |
| clients/rancher/auth/saml/saml.go | Adds a Rancher SAML API client and IdP session handling to capture/submit assertions. |
| clients/rancher/auth/saml/provider.go | Adds a generic SAML provider lifecycle client (enable/disable/update + warmup/settling). |
| clients/rancher/auth/saml/keypair.go | Generates a self-signed SP keypair when Rancher requires one. |
| clients/rancher/auth/saml/config.go | Defines provider/config structs and user credential config helpers. |
| clients/rancher/auth/authprovider.go | Adds a Keycloak auth provider enum value. |
| clients/rancher/auth/auth.go | Wires SAML + Keycloak provider clients into the Rancher auth client. |
| clients/keycloak/client.go | Implements Keycloak admin REST client with token acquisition and authenticated requests. |
| clients/keycloak/config.go | Adds Keycloak client configuration + defaults. |
| clients/keycloak/realms.go | Adds realm CRUD/ensure operations. |
| clients/keycloak/clients.go | Adds client CRUD + protocol-mapper lookup/replace helpers. |
| clients/keycloak/groups.go | Adds group CRUD + child group helpers. |
| clients/keycloak/users.go | Adds user CRUD + group membership operations. |
| clients/keycloak/representations.go | Adds Keycloak representation structs used by the admin client. |
| clients/keycloak/metadata.go | Fetches public SAML IdP metadata descriptor for configuring Rancher trust. |
Review details
- Files reviewed: 21/21 changed files
- Comments generated: 4
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
dasarinaidu
force-pushed
the
keycloak-saml-automation
branch
3 times, most recently
from
September 3, 2026 16:35
705959b to
c603a79
Compare
There was a problem hiding this comment.
🟡 Changes recommended
The new Keycloak client currently does not normalize/validate the configured host URL scheme, which can cause runtime failures with common config inputs.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Review details
- Files reviewed: 21/21 changed files
- Comments generated: 3
- Review effort level: Lite
dasarinaidu
force-pushed
the
keycloak-saml-automation
branch
from
September 3, 2026 16:47
c603a79 to
8aa890d
Compare
There was a problem hiding this comment.
🟡 Changes recommended
It includes a real error-masking bug in SAML provider enable polling and generates an SP certificate with CA semantics that can cause validation/rejection in stricter SAML consumers.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Review details
- Files reviewed: 21/21 changed files
- Comments generated: 2
- Review effort level: Lite
dasarinaidu
force-pushed
the
keycloak-saml-automation
branch
from
September 3, 2026 17:01
8aa890d to
e8643f7
Compare
There was a problem hiding this comment.
🔵 Needs a closer look
It introduces new authentication flows and external-service clients where correctness/security depends heavily on real integration behavior and warrants final human review.
Review details
- Files reviewed: 21/21 changed files
- Comments generated: 2
- Review effort level: Lite
dasarinaidu
force-pushed
the
keycloak-saml-automation
branch
from
September 3, 2026 17:13
e8643f7 to
02b3e05
Compare
There was a problem hiding this comment.
🟡 Changes recommended
A timeout in the provider enable polling currently returns early and bypasses the intended detailed rejection diagnostics, which will make failures harder to debug and can change behavior on normal timeout paths.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Review details
- Files reviewed: 21/21 changed files
- Comments generated: 1
- Review effort level: Lite
Comment on lines
+115
to
+127
| if err != nil && !kwait.Interrupted(err) { | ||
| return err | ||
| } | ||
|
|
||
| if refused != nil { | ||
| return fmt.Errorf("Rancher did not accept the assertion that enables %s in %s, it answered %d "+ | ||
| "and redirected to %s%s%s", p.provider.Name, defaults.OneMinuteTimeout, refused.StatusCode, | ||
| refused.Location, rejectionHint(refused), warmDescription(warmErr)) | ||
| } | ||
|
|
||
| if err != nil { | ||
| return err | ||
| } |
Adds a Keycloak admin API client for realms, clients, protocol mappers, groups and users, and a SAML provider client that enables, disables and updates Rancher's SAML auth config. Also adds raw HTTP helpers under extensions/auth/saml for driving Rancher's SAML endpoints and for parsing the assertions an identity provider issues.
dasarinaidu
force-pushed
the
keycloak-saml-automation
branch
from
September 3, 2026 19:57
02b3e05 to
8ef40de
Compare
dasarinaidu
added a commit
to dasarinaidu/rancher-tests
that referenced
this pull request
Sep 3, 2026
Adds a Keycloak SAML validation suite matching the coverage of the existing OpenLDAP and Active Directory provider suites, along with the actions that drive it. - validation/auth/provider/keycloaksaml: the suite, gated behind the validation build tag like the other provider suites - actions/auth/keycloak.go: Keycloak realm and client setup, test account provisioning, and provider enable/disable workflows - actions/auth/authprovider.go, verify.go: Keycloak cases alongside the existing providers The provider config key is keycloaksaml so that keycloakoidc can be added later without a rename. Depends on rancher/shepherd#705. The replace directive pointing at the shepherd fork is temporary and comes out once that PR merges.
dasarinaidu
added a commit
to dasarinaidu/rancher-tests
that referenced
this pull request
Sep 3, 2026
Adds a Keycloak SAML validation suite matching the coverage of the existing OpenLDAP and Active Directory provider suites, along with the actions that drive it. - validation/auth/provider/keycloaksaml: the suite, gated behind the validation build tag like the other provider suites - actions/auth/keycloak.go: Keycloak realm and client setup, test account provisioning, and provider enable/disable workflows - actions/auth/authprovider.go, verify.go: Keycloak cases alongside the existing providers The provider config key is keycloaksaml so that keycloakoidc can be added later without a rename. Depends on rancher/shepherd#705. The replace directive pointing at the shepherd fork is temporary and comes out once that PR merges.
dasarinaidu
added a commit
to dasarinaidu/rancher-tests
that referenced
this pull request
Sep 3, 2026
Adds a Keycloak SAML validation suite matching the coverage of the existing OpenLDAP and Active Directory provider suites, along with the actions that drive it. - validation/auth/provider/keycloaksaml: the suite, gated behind the validation build tag like the other provider suites - actions/auth/keycloak.go: Keycloak realm and client setup, test account provisioning, and provider enable/disable workflows - actions/auth/authprovider.go, verify.go: Keycloak cases alongside the existing providers The provider config key is keycloaksaml so that keycloakoidc can be added later without a rename. Depends on rancher/shepherd#705. The replace directive pointing at the shepherd fork is temporary and comes out once that PR merges.
dasarinaidu
added a commit
to dasarinaidu/rancher-tests
that referenced
this pull request
Sep 3, 2026
Adds a Keycloak SAML validation suite matching the coverage of the existing OpenLDAP and Active Directory provider suites, along with the actions that drive it. - validation/auth/provider/keycloaksaml: the suite, gated behind the validation build tag like the other provider suites - actions/auth/keycloak.go: Keycloak realm and client setup, test account provisioning, and provider enable/disable workflows - actions/auth/authprovider.go, verify.go: Keycloak cases alongside the existing providers The provider config key is keycloaksaml so that keycloakoidc can be added later without a rename. Depends on rancher/shepherd#705. The replace directive pointing at the shepherd fork is temporary and comes out once that PR merges.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Shepherd has no client for Keycloak and no client for Rancher's SAML auth providers, so the Keycloak
SAML provider cannot be automated the way OpenLDAP and Active Directory already are.
Solution
clients/keycloak— admin API client for realms, clients, protocol mappers, groups and users.clients/rancher/auth/saml— enables, disables and updates a Rancher SAML auth config, andgenerates the service provider key pair that Rancher requires but does not create itself.
extensions/auth/saml— raw HTTP helpers for driving Rancher's SAML endpoints and for parsing theassertions an identity provider issues.
clients/rancher: addsAsSAMLUser. SAML cannot go throughAsAuthUser, because the login actionanswers with a redirect to the identity provider rather than a token.
extensions/defaults: addsOneSecondTimeout.The provider client is parameterised by a
Providervalue rather than hardcoded to Keycloak, so Oktaand the other SAML providers can be added by naming one and pointing it at its own config key.