Keycloak

This article gives the steps to configure Keycloak as the identity provider for NocoDB.

NocoDB, Retrieve SAML SSO Configuration details

1. Go to Account Settings.
2. Select Authentication (SSO).
3. Click the New Provider button.
4. In the dialog, type a Display name for the provider. The login page shows the provider with this name.
5. Copy the Redirect URL & Audience / Entity ID. You need these values later to configure the identity provider.

Keycloak, Configure NocoDB as an Application

1. Sign in to your Keycloak account.
   • Go to the Clients menu.
   • Select the Clients list tab. Click the Create client button.
2. In the Create Client dialog, on the General Settings tab:
   • For the Client type, select SAML.
   • For the Client ID, enter the Audience/Entity ID from NocoDB.
   • Click Next.
3. In the Create Client dialog, on the Login Settings tab:
   • For the Valid Redirect URIs, enter the Redirect URL from NocoDB.
   • For the Valid post logout redirect URIs, enter the Redirect URL from NocoDB.
   • Click Save.
4. On the Client details page, on the Settings tab:
   • Go to the SAML Capabilities section.
   • Set Name ID format to email.
   • Enable Force Name ID Format and Force POST Binding.
   • Go to the Signature and Encryption section.
   • Enable Sign Assertions.
   • Click Save.
5. On the Client details page, on the Keys tab:
   • Disable Signing keys config > Client Signature Required.
6. Go to Realm Settings > Endpoints.
   • Copy the SAML 2.0 Identity Provider Metadata URL.

NocoDB, Configure Azure AD as an Identity Provider

1. Go to Account Settings > Authentication > SAMLKey
2. Enter the Metadata URL from the step above. You can also configure the XML directly.
3. Click Save.

Users now see the Sign in with <SSO> option on the sign-in page.

Availability

• SAML SSO is available on NocoDB Cloud (Business plan and above) and on licensed self-hosted deployments (Business plan and above). For access, reach out to sales team.
• On the Business plan, the SSO configuration menu is in the workspace sidebar, at Settings > Single Sign-On (SSO). For more details, refer here.
• Domain Verification Required for Cloud Plans: Verify your domain in NocoDB before you configure SAML SSO. Cloud Business and Enterprise plans both need this. Only users with email addresses from verified domains can sign in with SSO. For details, see Domain Verification.