![SSO in Pachca with Keycloak](https://pachca.com/help/sso7.jpg)

# SSO in Pachca with Keycloak

> Set up single sign-on (SSO) with Keycloak in the Pachca team chat app: integrate with an open-source IdP over OpenID Connect

Источник: https://pachca.com/en/help-center/administration/sso-v-pachke-s-keycloak

The Pachca integration uses the OpenID Connect protocol.

Go to the realm you'll use for the Pachca integration. It can't be the master realm.

Create a new client and send us its name.

![Creating a client in Keycloak](https://pachca.com/help/sso-v-pachke-s-keycloak-1.avif)

Under **Valid redirect URIs**, add:

- msauth.co.staply.pachca://auth
- com.pachca.app://oidc
- Your unique URL, which we'll send you

![Valid redirect URIs in the Keycloak client settings](https://pachca.com/help/sso-v-pachke-s-keycloak-2.avif)

**Client authentication** must be turned on.

In **Credentials**, copy the **Secret** and send it to us.

### Automatic logout from Pachca (Backchannel logout)

You can set up automatic session termination: when an employee logs out of their account in the SSO provider, their Pachca session ends too.

To do this, open the client you created for Pachca in Keycloak and, under **Logout settings**:

1.  Turn off **Front channel logout**.
2.  In the **Backchannel logout URL** field, enter `https://auth.pachca.com/realms/<your realm name>/protocol/openid-connect/logout/backchannel-logout`. Pachca support will give you the exact URL.
3.  Turn on **Backchannel logout session required**.
4.  Turn on **Backchannel logout revoke offline sessions**.

**Once you're done, contact Pachca support, and we'll turn on Backchannel logout on our side.**

### Sync employee attributes to Pachca

> To illustrate, we'll walk through passing an attribute from Windows ADFS to Pachca via Keycloak.

First, set up ADFS to pass attributes to Keycloak.

In AD FS Management, open the settings of the application you created for Pachca.

![Pachca application settings in AD FS Management](https://pachca.com/help/sso-v-pachke-s-keycloak-3.avif)

Click **Edit…** 👇

![Edit button in AD FS Management](https://pachca.com/help/sso-v-pachke-s-keycloak-4.avif)

On the **Issuance Transform Rules** tab, click **Edit Rule…**.

Fill in the table with the attributes you need.

![Attribute table in the ADFS claim rule](https://pachca.com/help/sso-v-pachke-s-keycloak-5.avif)

For example, to pass an employee's groups, select the **Is-Member-Of-DL** field.

In Keycloak, go to **Clients** and open the client you created for Pachca.

![Pachca client in the Keycloak client list](https://pachca.com/help/sso-v-pachke-s-keycloak-6.avif)

Go to **Client scopes**.

Click the first item in the list, **<client name>-dedicated**.

Click **Configure a new mapper**.

![Configure a new mapper button in Keycloak](https://pachca.com/help/sso-v-pachke-s-keycloak-7.avif)

Select **User Attribute** from the list 👇

![User Attribute mapper type in Keycloak](https://pachca.com/help/sso-v-pachke-s-keycloak-8.webp)

Fill in the form with the required values. In this example, we pass the value of the **groupTags** attribute to Pachca.

For the integration between Pachca tags and Active Directory groups to work, the attribute must have this exact name.

![User Attribute mapper for group tags in Keycloak](https://pachca.com/help/sso-v-pachke-s-keycloak-9.avif)

And here's how to pass an employee's phone number to Pachca:

![User Attribute mapper for a phone number in Keycloak](https://pachca.com/help/sso-v-pachke-s-keycloak-10.avif)

🎉 That's it. The next time an employee logs in with SSO, their new attribute values will be passed to Pachca.

To add other fields to an employee's Pachca profile, specify the attribute name in the mapping:

- Phone: phone\_number
- Job title: title
- Department: department
- [Group tags](https://pachca.com/en/help-center/administration/tags-team-members): group\_tags

You can also pass any other text fields from your directory to Pachca, like an employee's manager or birthday. To do this:

1.  Create the field in Pachca: go to **Members** → **Settings** → **Add field**, then set a name and any type except **File**
2.  Specify the attribute name in the mapping, as described above for the standard profile fields

**Once you've set up the mapping, let our support team know so we can connect it.**

Updated: February 17, 2025