Skip to main content Skip to complementary content
Qlik Resources
Loading SearchUnify's search If you need assistance with your product, please contact Qlik Support.
Qlik Customer Portal
Loading SearchUnify's search If you need assistance with your product, please contact Qlik Support.
Qlik Customer Portal

Linking Talend Administration Center in SP-initiated mode with Keycloak

Last updated: 10/9/2026
These steps are performed on Talend Administration Center Configuration > SSO tab.

About this task

Some screenshots in this article show the Keycloak admin console used when this procedure was created in June 2022. In later Keycloak releases, some labels and page locations can differ.

Procedure

  1. Follow the steps described in Configuring Talend Administration Center with Keycloak as Identity Provider.
  2. In the Service Provider Entity URL field, enter the Talend Administration Center SSO Service URL.
    To find this URL, go to your Keycloak realm account and open the Clients tab.
    IDP-initiated SSO URL name field
  3. In the Single Logout Service URL field, enter the value of the Location attribute from the SingleLogoutService element in the Keycloak metadata file.
    Information noteNote: To enable SAML logout with Keycloak, make sure the Keycloak metadata used by Talend Administration Center contains a SingleLogoutService element.

    Talend Administration Center uses the Location attribute from this element as the logout endpoint and sends the SAML logout request with HTTP-POST.

    If this field is empty, Talend Administration Center does not send a SAML logout request to Keycloak.
  4. If you want to sign the logout request, add the following properties to the configuration.properties file.
    Property Description Default/supported values
    sso.signature.key.name Defines the key identifier type used to sign the SAML logout request. Default value is NONE. Supported values are NONE and KEY_ID.
    sso.signature.key.path Specifies the path to the private key used to sign the SAML logout request. This property is empty by default.
    sso.signature.certificate.path Specifies the path to the certificate associated with the private key used to sign the SAML logout request. This property is empty by default.
    sso.signature.algorithm Specifies the signature algorithm used to sign the SAML logout request.

    Default value is http://www.w3.org/2001/04/xmldsig-more#rsa-sha256.

    Supported values are http://www.w3.org/2001/04/xmldsig-more#rsa-sha256, http://www.w3.org/2001/04/xmldsig-more#rsa-sha384, and http://www.w3.org/2001/04/xmldsig-more#rsa-sha512.
    The signature-related parameters must match the Keycloak configuration.
    Keys tab in Clients page in Keycloak.
    Signature and Encryption information in Keycloak.
  5. If you don't want to sign the logout request, you must toggle off the following settings from the Clients page in Keycloak.
    • Sign documents option under Signature and Encryption in the Settings tab
      Sign documents option.
    • Client signature required option under Signing keys config in the Keys tab
      Client signature required option.
    If these options are not disabled, the unsigned SAML logout request will fail.

Did this page help you?

If you find any issues with this page or its content – a typo, a missing step, or a technical error – please let us know!

Leave your feedback here