# How to Setup MS AD FS 3.0 as Brokered Identity Provider in Keycloak

DevFeed: [How to Setup MS AD FS 3.0 as Brokered Identity Provider in Keycloak](<https://devfeed.tech/articles/how-to-setup-ms-ad-fs-3-0-as-brokered-identity-provider-in-keycloak-31562.md>)

Original publisher: [Read original article](<https://www.keycloak.org/2017/03/how-to-setup-ms-ad-fs-30-as-brokered>)

Author: Hynek Mlnařík

Published: 2017-03-23T00:00:00Z

Content type: tutorial

Language: en

Sources: [Keycloak Blog](<https://devfeed.tech/sources/keycloak-blog.md>)

Topics: [Keycloak](<https://devfeed.tech/topics/keycloak.md>), [active directory](<https://devfeed.tech/topics/active-directory.md>), [saml](<https://devfeed.tech/topics/saml.md>), [Authentication](<https://devfeed.tech/topics/authentication.md>), [certificates](<https://devfeed.tech/topics/certificates.md>), [TLS (Transport Layer Security)](<https://devfeed.tech/topics/tls.md>), [Windows](<https://devfeed.tech/topics/windows.md>)

Tags: [active-directory](<https://devfeed.tech/tags/active-directory.md>), [authentication](<https://devfeed.tech/tags/authentication.md>), [certificates](<https://devfeed.tech/tags/certificates.md>), [idm](<https://devfeed.tech/tags/idm.md>), [installation](<https://devfeed.tech/tags/installation.md>), [kerberos](<https://devfeed.tech/tags/kerberos.md>), [keycloak](<https://devfeed.tech/tags/keycloak.md>), [ldap](<https://devfeed.tech/tags/ldap.md>), [openid-connect](<https://devfeed.tech/tags/openid-connect.md>), [saml](<https://devfeed.tech/tags/saml.md>), [sso](<https://devfeed.tech/tags/sso.md>), [tls](<https://devfeed.tech/tags/tls.md>), [windows](<https://devfeed.tech/tags/windows.md>)

## AI overview

A setup guide for configuring Microsoft Active Directory Federation Services 3.0 as a brokered SAML identity provider in Keycloak. It covers SSL/TLS prerequisites, certificate trust configuration, metadata import, signature settings, mapper configuration, and AD FS relying-party trust setup.

## Source excerpt

This document guides you through initial setup of Microsoft Active Directory Federation Services 3.0 as a brokered identity provider Keycloak. Prerequisites Two server hosts: Microsoft Windows Server 2012 with Active Directory Federation Services (AD FS) installed. The AD domain will be named DOMAIN.NAME in this post. Keycloak server. This can be generally placed anywhere but here it is expected to be running on separate host DNS setup: The Windows host name will be fs.domain.name in this post The Keycloak host name will be kc.domain.name in this post Setup Keycloak Server Keycloak server has configured for SSL/TLS transport - this is mandatory for AD FS to communicate with it. This comprises two steps: Setup keycloak for incoming HTTPS connections - steps are provided in Server Installation guide. Export AD FS certificate into a Java truststore to enable outgoing HTTPS connections: In the AD FS management console, go to Service -> Certificates node in the tree and export the Service communications certificate. Import the certificate into a Java truststore (JKS format) using Java keytool utility. Setup the truststore in Keycloak as described in Server Installation guide. Setup Identity Provider in Keycloak Setup Basic Properties of Brokered Identity Provider In the Identity Providers, create a new SAML v2.0 identity provider. In this post, the identity provider will be known under alias adfs-idp-alias. Now scroll to the bottom and enter the AD FS descriptor URL into Import from URL field. For AD FS 3.0, this URL is https://fs.domain.name/FederationMetadata/2007-06/FederationMetadata.xml. Once you click "Import", check the settings. Usually, you would at least enable Validate signature option. If the authentication requests sent to the AD FS instance are expected to be signed, which is also usually the case, you have to enable Want AuthnRequests Signed option. Importantly, then the SAML Signature Key Name field that shows after enabling the Want AuthnRequests Signed o