Keycloak SAML setup

​

Before you start

• A running Keycloak instance and access to its admin console
• A realm to host the CodeRabbit SAML client
• The email domain that should authenticate through CodeRabbit
• A way to reach your account team to request CodeRabbit’s service provider values and submit your final metadata

​

What CodeRabbit provides

• Assertion Consumer Service (ACS) URL
• SP Entity ID

​

What CodeRabbit needs from you

• Email domain: for example, yourcompany.com
• IdP metadata, in one of these forms (listed in order of preference):
  • Metadata URL: the realm SAML descriptor URL — https://<keycloak-host>/realms/<realm-name>/protocol/saml/descriptor
  • Metadata XML file: download the XML from the URL above and attach it — use this if your Keycloak is not reachable from the public internet
  • Manual values, if neither of the above is possible:
    • Sign-on URL: the Location attribute of the HTTP-POST SingleSignOnService element in the descriptor
    • Issuer: the entityID attribute of the EntityDescriptor element (typically https://<keycloak-host>/realms/<realm-name>)
    • Signing certificate: the contents of ds:X509Certificate, saved as a .pem file

​

Set up the Keycloak SAML client

1

Create the SAML client

Sign in to the Keycloak admin console, switch into the realm you want to use, then go to Clients -> Create client.On the General Settings screen:

• Client type: SAML
• Client ID: paste the SP Entity ID provided by CodeRabbit
• Name: CodeRabbit (display-only)

Click Next. On the Login Settings screen:

• Valid redirect URIs: paste CodeRabbit’s ACS URL
• Master SAML Processing URL: paste the same ACS URL
• Leave the remaining fields blank.

Click Save. You land on the client’s Settings tab.

2

Tune the SAML settings

On the client’s Settings tab, set the following values. Defaults for unlisted fields are fine.SAML capabilities

Field	Value
Name ID format	email
Force name ID format	On
Force POST binding	On
Include AuthnStatement	On

Signature and Encryption

Field	Value
Sign documents	On
Sign assertions	On
Signature algorithm	RSA_SHA256

Switch to the Keys tab and turn Client signature required Off.

This setting is required. CodeRabbit does not sign outgoing AuthnRequests — leaving Client signature required On causes Keycloak to reject the request with invalid_signature and blocks the sign-in flow entirely.

Save each change.

3

Add attribute mappers

CodeRabbit expects email, first name, and last name to be present in the SAML assertion under specific attribute names. Add three mappers so the assertion includes them.Open the client -> Client scopes tab -> click the row whose name ends in -dedicated (the dedicated client scope) -> switch to the Mappers tab.Click Configure a new mapper -> By configuration -> User Property. Add one mapper per row:

User Property	SAML Attribute Name	SAML Attribute NameFormat	Friendly Name
email	mail	Basic	Email
firstName	firstName	Basic	First name
lastName	lastName	Basic	Last name

The SAML Attribute Name column is what CodeRabbit reads from the assertion — the values must match the table exactly, including the mail spelling for email.

Each mapper form looks like this — confirm the Property, Friendly Name, SAML Attribute Name, and SAML Attribute NameFormat match the table above before saving.

Save each mapper.

4

Grant access to your users

Make sure the users who should sign in to CodeRabbit exist in this realm, with:

• An email that ends in the domain you registered with CodeRabbit
• First name and Last name populated — those flow into CodeRabbit via the mappers above

If your realm restricts client access via client-level roles or custom authentication flows, ensure the users you want to sign in have the appropriate access for this client. Users who cannot access the client in Keycloak cannot complete SSO login to CodeRabbit.

5

Send the metadata to CodeRabbit and validate access

Collect your IdP metadata URL:

https://<keycloak-host>/realms/<realm-name>/protocol/saml/descriptor

Open it in a browser to sanity-check. You should see an XML EntityDescriptor containing an IDPSSODescriptor, an HTTP-POST SingleSignOnService endpoint, and a ds:X509Certificate block.Send the following to your account team:

• Your organization’s email domain
• The metadata URL above — or, if Keycloak is not reachable publicly, the downloaded XML file or the manual values described in What CodeRabbit needs from you

After CodeRabbit confirms the configuration is enabled, test the sign-in flow with a user account whose email matches your configured domain. Assigned users are added to your CodeRabbit organization automatically on first SSO login.

​

What’s next