idp-metadata-template.xml

<?xml version="1.0" encoding="UTF-8"?>
<EntitiesDescriptor Name="urn:keycloak"
	xmlns="urn:oasis:names:tc:SAML:2.0:metadata"
	xmlns:ds="http://www.w3.org/2000/09/xmldsig#" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
	<EntityDescriptor entityID="${idp.entityID}">
		<IDPSSODescriptor WantAuthnRequestsSigned="true"
			protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
			<NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</NameIDFormat>
			<NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</NameIDFormat>
			<NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</NameIDFormat>

			<SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
				Location="${idp.sso.HTTP-POST}" />
			<SingleSignOnService
				Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
				Location="${idp.sso.HTTP-Redirect}" />
			<SingleLogoutService
				Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
				Location="${idp.sls.HTTP-POST}" />
            <KeyDescriptor use="signing">
                <dsig:KeyInfo xmlns:dsig="http://www.w3.org/2000/09/xmldsig#">
                    <dsig:X509Data>
                        <dsig:X509Certificate>
                            ${idp.signing.certificate}
                        </dsig:X509Certificate>
                    </dsig:X509Data>
                </dsig:KeyInfo>
            </KeyDescriptor>
		</IDPSSODescriptor>
	</EntityDescriptor>
</EntitiesDescriptor>