SSO & Identity Federation

Presswerk uses Keycloak for authentication. Keycloak supports federating with external identity providers, so your users can sign in with their existing corporate credentials.

Supported Providers

Provider	Protocol	Notes
Microsoft Entra ID (Azure AD)	OIDC	Recommended for Microsoft environments
Google Workspace	OIDC	Via Google Cloud Identity
Okta	OIDC / SAML	Both protocols supported
Active Directory	LDAP	Direct user sync
LDAP (OpenLDAP, FreeIPA)	LDAP	Direct user sync
Any OIDC Provider	OIDC	Standard OpenID Connect
Any SAML Provider	SAML 2.0	Standard SAML federation

Microsoft Entra ID (Azure AD)

1. Register Application in Entra ID

1. Go to Azure Portal → Microsoft Entra ID → App registrations → New registration
2. Name: Presswerk
3. Redirect URI: https://auth.your-domain.com/realms/presswerk/broker/entra-id/endpoint
4. Copy the Application (client) ID and Directory (tenant) ID
5. Go to Certificates & secrets → New client secret, copy the value

2. Configure in Keycloak

1. Open https://auth.your-domain.com/admin
2. Select the presswerk realm
3. Go to Identity Providers → Add Provider → OpenID Connect
4. Configure:

Field	Value
Alias	entra-id
Display Name	Microsoft
Discovery URL	https://login.microsoftonline.com/{tenant-id}/v2.0/.well-known/openid-configuration
Client ID	Your application ID
Client Secret	Your client secret
Default Scopes	openid email profile

5. Save

3. Configure Attribute Mappers

Go to Identity Providers → entra-id → Mappers → Add mapper:

Name	Mapper Type	Claim	User Attribute
Email	Attribute Importer	email	email
First Name	Attribute Importer	given_name	firstName
Last Name	Attribute Importer	family_name	lastName

LDAP / Active Directory

1. Configure in Keycloak

1. Go to User Federation → Add Provider → LDAP
2. Configure:

Field	Value
Vendor	Active Directory (or Other for OpenLDAP)
Connection URL	ldap://your-dc.domain.com:389 (or ldaps:// for TLS)
Users DN	OU=Users,DC=domain,DC=com
Bind DN	CN=svc-presswerk,OU=Service Accounts,DC=domain,DC=com
Bind Credential	Service account password
Username LDAP attribute	sAMAccountName (AD) or uid (LDAP)
UUID LDAP attribute	objectGUID (AD) or entryUUID (LDAP)
Edit Mode	READ_ONLY (recommended)

3. Click Test connection and Test authentication
4. Save

2. Group-to-Role Mapping

To automatically assign the Presswerk admin role based on AD/LDAP group membership:

1. In the LDAP provider, go to Mappers → Add mapper
2. Type: group-ldap-mapper
3. Configure:

Field	Value
LDAP Groups DN	OU=Groups,DC=domain,DC=com
Group Name LDAP Attribute	cn
Membership LDAP Attribute	member
Mode	READ_ONLY

4. Create a Keycloak group (e.g. presswerk-admins) and assign the admin role to it
5. Map the LDAP group to the Keycloak group

3. LDAP over TLS

For LDAP over TLS (ldaps://), the Keycloak container must trust your internal CA. See TLS & Certificates for configuration.

SAML Federation

1. Go to Identity Providers → Add Provider → SAML v2.0
2. Configure with your IdP’s metadata URL or upload the metadata XML
3. Set the Service Provider Entity ID to https://auth.your-domain.com/realms/presswerk
4. Provide the Redirect URI to your IdP: https://auth.your-domain.com/realms/presswerk/broker/{alias}/endpoint

Role Mapping

Presswerk uses these roles:

Role	Description
admin	Tenant administrator — manages users, environments, data sources
(none)	Regular user — access controlled by folder permissions

Assign roles via:

• Keycloak admin console: Users → Role Mappings
• Group mapping: Assign roles to Keycloak groups, then map IdP groups to Keycloak groups
• IdP attribute mapping: Map an IdP claim to a Keycloak role