SSO in Pachca with Keycloak
The Pachca integration uses the OpenID Connect protocol.
Go to the realm you'll use for the Pachca integration. It can't be the master realm.
Create a new client and send us its name.
Under Valid redirect URIs, add:
- msauth.co.staply.pachca://auth
- com.pachca.app://oidc
- Your unique URL, which we'll send you
Client authentication must be turned on.
In Credentials, copy the Secret and send it to us.
Automatic logout from Pachca (Backchannel logout)
You can set up automatic session termination: when an employee logs out of their account in the SSO provider, their Pachca session ends too.
To do this, open the client you created for Pachca in Keycloak and, under Logout settings:
- Turn off Front channel logout.
- In the Backchannel logout URL field, enter
https://auth.pachca.com/realms/<your realm name>/protocol/openid-connect/logout/backchannel-logout. Pachca support will give you the exact URL. - Turn on Backchannel logout session required.
- Turn on Backchannel logout revoke offline sessions.
Once you're done, contact Pachca support, and we'll turn on Backchannel logout on our side.
Sync employee attributes to Pachca
To illustrate, we'll walk through passing an attribute from Windows ADFS to Pachca via Keycloak.
First, set up ADFS to pass attributes to Keycloak.
In AD FS Management, open the settings of the application you created for Pachca.
Click Edit… 👇
On the Issuance Transform Rules tab, click Edit Rule….
Fill in the table with the attributes you need.
For example, to pass an employee's groups, select the Is-Member-Of-DL field.
In Keycloak, go to Clients and open the client you created for Pachca.
Go to Client scopes.
Click the first item in the list, <client name>-dedicated.
Click Configure a new mapper.
Select User Attribute from the list 👇
Fill in the form with the required values. In this example, we pass the value of the groupTags attribute to Pachca.
For the integration between Pachca tags and Active Directory groups to work, the attribute must have this exact name.
And here's how to pass an employee's phone number to Pachca:
🎉 That's it. The next time an employee logs in with SSO, their new attribute values will be passed to Pachca.
To add other fields to an employee's Pachca profile, specify the attribute name in the mapping:
- Phone: phone_number
- Job title: title
- Department: department
- Group tags: group_tags
You can also pass any other text fields from your directory to Pachca, like an employee's manager or birthday. To do this:
- Create the field in Pachca: go to Members → Settings → Add field, then set a name and any type except File
- Specify the attribute name in the mapping, as described above for the standard profile fields
Once you've set up the mapping, let our support team know so we can connect it.