I want to setup a SSO solution using Keycloak 10.0.2 as the Identity Provider. The first application I want to setup is AWS.

I followed this tutorial to enable Keycloak to sign me in using SAML. I noticed, that this tutorial is guiding me to download the “SAML Metadata IDPSSODescriptor” from the client's "Installation"-Tab. However, I can only choose "SAML Metadata SPSSODescriptor".

In AWS, I entered the name of my realm as "Provider Name" and imported the SPSSODescriptor. This led to the following error: SAML Providers must reference at least one SAML assertion issuer.

2 Answers 2


In downloaded xml file change SPSSODescriptor to IDPSSODescriptor for both opening and closing tags. Also entityID should be "https://KEYCLOAK-URL/auth/realms/YOUR-REALMS-NAME"


Use the command:

wget https://KEYCLOAK-URL/auth/realms/YOUR-REALMS-NAME/protocol/saml/descriptor 


upload descripter

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .