SSO in Pachca with Indeed IdP over SAML

1. Get the details from your Keycloak (SP) admin

Before you start, ask your Keycloak admin for the following:

• SP Entity ID (service provider ID)
  • Example: https://my-keycloak.company.com/auth/realms/my-realm
• Assertion Consumer Service (ACS) URL
  • Example: https://my-keycloak.company.com/auth/realms/my-realm/broker/saml/endpoint
• Single Logout (SLO) URL (if needed)
  • Example: https://my-keycloak.company.com/auth/realms/my-realm/broker/saml/endpoint

Note: In Keycloak, the SLO URL is often the same as the ACS URL.

2. Configure the Indeed settings file

Open your configuration file (app-settings.json) and make changes to the following sections.

You can see a sample configuration file here.

2.1. Add a new Service Provider

Find the SAML.Configurations section. It contains the PartnerServiceProviderConfigurations array. Add a new object for Keycloak to this array.

Sample object to add:

{
  "Name": "https://my-keycloak.company.com/auth/realms/my-realm",
  "SignSamlResponse": true,
  "ValidAssertionConsumerServiceUrls": ["http://localhost:8080"],
  "SingleLogoutServiceUrl": "https://my-keycloak.company.com/auth/realms/my-realm/broker/saml/endpoint"
}

Replace the sample URLs and Name with the real values you got in Step 1. Set SignSamlResponse to true so Indeed signs its responses.

2.2. Set the login format

Find the AuthenticationSettings.LoginFormats section. Add a new object to this array to specify which user attribute to use as the NameID for Keycloak.

Sample object to add:

{
  "ServiceProvider": "https://my-keycloak.company.com/auth/realms/my-realm",
  "InLoginFormat": "Name",
  "OutLoginFormat": "PrincipalName"
}

2.3. Set up user attribute mapping (required)

To work correctly, Keycloak needs to receive user details (email, first name and last name). Set up how these attributes are passed in the AuthenticationSettings.CustomAttributes section. Add a new object for Keycloak to this array.

Sample object to add:

{
  "ServiceProvider": "https://my-keycloak.company.com/auth/realms/my-realm",
  "Attributes": [
    {
      "Name": "email",
      "UserNameFormat": "email"
    },
    {
      "Name": "given_name",
      "UserNameFormat": "firstName"
    },
    {
      "Name": "family_name",
      "UserNameFormat": "lastName"
    },
    {
      "Name": "preferred_username",
      "UserNameFormat": "PrincipalName"
    }
  ]
}

This block maps Indeed's internal user fields (email, firstName and so on) to the attribute names sent in the SAML assertion. Share these attribute names (Name) with your Keycloak admin so they can set up Keycloak to accept them.

3. Share the details with your Keycloak admin

After you save the configuration and restart the Indeed service, give your Keycloak admin the following details about your IdP:

1. IdP Entity ID (Issuer)
   • urn:indeedid:saml_idp
2. Single Sign-On (SSO) URL
   • https://indeed.company.com/am/idp/Account/SsoService
3. SLO URL
   • https://indeed.company.com/am/idp/Account/SloService
4. Public certificate
   • Export the public part of the certificate (thumbprint 57CB4...) in .cer or .pem format

Once your Keycloak admin adds these details to their system, the integration is ready for testing.