Configuring Keycloak for SAML Authentication

Please note: The instructions listed in this article are exclusively applicable to those who have had SAML Single Sign-On activated for their company by Aircall. To have SAML Single Sign-On activated for your company, please contact your Account Manager. Please note that, at this time, this functionality is only offered for a limited number of customers.

⚠️ IDP-initiated SAML sign-in is currently not supported. Once you have configured SAML on your Aircall account, please log in via the Aircall dashboard or app's login page using the "Sign-in with SSO" option.

Step 1: Create a new Client

1. Open Keycloak Administration Console

2. From the navigation menu on the left-hand side, under the Manage section, choose Clients

3. Click on Create Client

4. In the Create a new app integration modal, select SAML as the Client type

5. Enter urn:amazon:cognito:sp:us-west-2_hZkGBmIsz as Client ID

6. Enter AircallSSO as Name

7. Click on Next

8. Enter https://sso.aircall.io/saml2/idpresponse as Valid redirect URIs

9. Click on Save

Step 2: Configure your new SAML Client

1. Under Clients > Client details, select urn:amazon:cognito:sp:us-west-2_hZkGBmIsz

2. Select Keys tab from the top

3. Disable Client signature required

4. Select Client scopes tab from the top

5. Click on urn:amazon:cognito:sp:us-west-2_hZkGBmIsz-dedicated from the table

6. Click on Add predefined mapper

7. Select X500 email and click on Add

8. After X500 email is added to the table, click on it

9. Change SAML Attribute Name to http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress and Save

Step 3: Export the Metadata

1. Click on Real settings under the Configure section from the navigation menu on the left hand side

2. Find Endoints

3. Click on SAML 2.0 Identity Provider Metadata to open the XML file

4. Save the file as aircall-idp.xml

For more information on SAML, please read more here or contact your Account Manager.