Sign in to the Admin Console, navigate to Settings > Identity > Directories, and select Create Directory.
Last updated on
Oct 22, 2026
Set up KeyCloak as a SAML identity provider (IdP) so your users can sign in to Adobe apps and services with their organization credentials.
Before you begin
Ensure you have:
- System administrator role in Adobe Admin Console
- Administrator access to the KeyCloak realm that authenticates your Adobe users
- A domain you can verify and add to the directory
Tip
Ensure each user's email address belongs to a domain claimed in the Admin Console. KeyCloak uses the email address as the user identifier.
Create a directory and download Adobe metadata
Enter a directory name, select Federated ID, and then select Next.
Select Other SAML Providers, then Next.
On the Set up IdP screen, select Download Adobe Metadata file. Keep this screen open for the next step.
Import the Adobe client into KeyCloak
Sign in to the KeyCloak Admin Console and select the realm that authenticates your Adobe users.
Select Clients > Import client.
Under Resource file, select Browse and upload the Adobe metadata file. KeyCloak fills in Adobe’s entity ID, ACS URL, certificate, and other SAML settings from the file.
Note
Import the Adobe metadata file rather than creating the client manually. This ensures KeyCloak uses Adobe's exact SAML settings.
In Name, enter Adobe Identity Management – <your organization name>, and then select Save.
Verify the imported settings:
- Valid redirect URIs show the Adobe ACS URL.
- Name ID format is email.
- Signing is turned on under Signature and Encryption.
- The Keys tab shows Adobe’s certificate.
Map user attributes
Adobe requires the user’s email address, first name, and last name in the SAML assertion. Create a client scope that sends them.
In the navigation panel, select Client scopes > Create client scope.
Enter Adobe Identity Scope as the name, select SAML as the protocol, and then select Save.
On the Mappers tab, select Configure a new mapper (or Add mapper > By configuration), and then select User Attribute.
Enter the values for the first attribute in the following table. Leave SAML Attribute NameFormat as Unspecified and Aggregate attribute values off, and then select Save.
Repeat steps 3 and 4 for each attribute in the table.
Note
CountryCode isn’t a built-in KeyCloak attribute. To send it, first add a custom user attribute in Realm settings > User profile that stores a two-letter ISO 3166-1 country code.
Select Clients, select the Adobe client, and then select the Client scopes tab.
Select Add client scope, select Adobe Identity Scope, and then select Add > Default.
Upload KeyCloak metadata to Admin Console
In KeyCloak, navigate to Realm settings > General > Endpoints and select SAML 2.0 Identity Provider Metadata.
Save the XML that opens as a file, such as keycloak-idp-metadata.xml.
Return to the Set up IdP screen in Adobe Admin Console, upload the KeyCloak metadata file, and then select Next.
Leave automatic account creation turned on. If your organization provisions users manually, turn this setting off.
Under Attribute mappings, select a default country, and then select Done.
Next, verify domain ownership and add the domain to the directory, if you haven’t already.
Test single sign-on
In the Admin Console, navigate to Settings > Identity > Directories, then select your directory.
In the directory details panel, select Test.
Sign in as a KeyCloak user. Confirm that the IdP validation succeeded page lists the expected values for each attribute.
If an attribute is missing, check its mapper and confirm that Adobe Identity Scope is a default scope on the Adobe client. For other issues, see Resolve Federated ID (SSO) sign-in errors or perform a SAML trace. For help with your configuration, navigate to Admin Console > Support to contact Adobe Customer Care.
