# SUSE Multi-Linux Manager 5.2: integrate SSO with Keycloak, SAML and MFA Source: https://forgeone.solutions/en/tech/suse-multi-linux-manager-5-2-integrate-sso-keycloak-saml-mfa Language: en Published: 2026-09-15 Updated: 2026-10-16 Keycloak SAML SSO for SUSE Multi-Linux Manager: client, metadata, ACS, certificates, MFA, roles, break-glass and acceptance checks. SUSE Multi-Linux Manager is a central administration system. In production, login belongs into the enterprise identity model: central users, MFA, roles, auditability and controlled offboarding. The relevant integration path is SAML. Keycloak authenticates users as identity provider. SUSE Multi-Linux Manager remains the service provider and still controls local roles and permissions. [![SUSE Multi-Linux Manager dashboard after the base installation.](https://forgeone.solutions/media/suse-mlm-5-2-07-manager-dashboard.png)](https://forgeone.solutions/media/suse-mlm-5-2-07-manager-dashboard.png) ## Target model The admin opens https://mlm01.example.test. The Manager redirects to Keycloak. Keycloak validates user, password, MFA and policies. The user returns to the Manager and receives only explicitly assigned roles. SSO does not mean administrator rights. Authentication identifies the person. Authorization decides what that person may do. ## Prepare Keycloak Create a dedicated realm or a clearly separated client in an existing realm. Redirect URIs must be strict, MFA should be enforced through realm, group or conditional policies, and private test accounts must not become the production admin path. ```yaml manager_url: https://mlm01.example.test realm: forgeone-operations client: suse-multi-linux-manager protocol: SAML mfa_policy: required for administrators ``` ## Create the SAML client The SAML client uses the Manager metadata endpoint as Client ID. The Assertion Consumer Service URL points to the Manager ACS endpoint. Use the real Manager FQDN, not localhost, not an SSH tunnel and not a temporary port. ```ini Client ID=https://mlm01.example.test/rhn/manager/sso/metadata Valid redirect URI=https://mlm01.example.test/rhn/manager/sso/acs Name ID format=persistent or username-based Force POST binding=enable according to IdP policy ``` ## Mappers, certificate and metadata Stable mappers for username, display name and email are enough for the first path. The Manager must trust the public SAML certificate of the identity provider. Private keys never belong in screenshots, tickets, Git or public articles. ```bash curl -k https://mlm01.example.test/rhn/manager/sso/metadata # Export Keycloak metadata through secured admin access # Add the public IdP certificate to the Manager by supported procedure ``` ## Configure the Manager Manager configuration connects Keycloak metadata with the local role model. Treat this as a production change: maintenance window, rollback, break-glass admin, browser test and audit check. ```bash mgrctl status mgrctl exec -- bash -lc 'spacewalk-service status' # Apply SSO configuration # Reload or restart Manager services in a controlled way mgrctl status ``` ## Test MFA and roles Test an administrator, a read-only user, a user without roles and a disabled user. MFA must be enforced in Keycloak. The Manager must not derive unintended privileges from successful authentication. ```yaml acceptance: login_with_keycloak: verified mfa_required: verified disabled_user_blocked: verified user_without_role_blocked: verified read_only_user_cannot_patch: verified admin_user_can_open_reports: verified local_break_glass_admin_available: verified ``` ## Reports and audit After SSO integration, reports must remain attributable. Check user lists, system access, scheduled actions and audit data. Security teams need central login and clear user attribution for Manager actions. ```bash spacewalk-report users spacewalk-report users-systems spacewalk-report actions spacewalk-report system-history ``` ## Support model and limits SUSE documents Keycloak as an example for SAML SSO. In production, clarify which parts are owned by SUSE support, the identity team and operations before go-live. ## Identity lifecycle and offboarding SSO is most valuable when users should not be maintained manually in several administration systems. New administrators are enabled through the identity process, roles become traceable and offboarding does not depend on remembering every local account. The Manager remains a security-critical system. Keycloak groups must not automatically grant superuser permissions. Authentication, group mapping and Manager roles are deliberately separated. ## MFA for privileged accounts MFA should be mandatory for administrators. A good policy covers all Manager administrators and often read-only access to security-relevant reports as well. Emergency accounts need separate rules: strong password, vault storage, documented access and regular tests. ## Attribute and naming strategy The username arriving at the Manager must be stable. If an organization uses email addresses as login, name changes must be handled. For long-lived admin identities, a stable technical username is often better than a changing mail address. ```yaml identity_mapping: login_name: preferred_username display_name: name mail: email group_source: keycloak_groups manager_roles: assigned deliberately inside SUSE Multi-Linux Manager ``` ## Test permissions A good test does not end with successful login. Verify that a read-only user can read reports but cannot trigger patch actions. Verify that a user without the right group authenticates but receives no Manager access. Verify that a disabled Keycloak user is blocked immediately. ## Operations documentation Operations documentation contains realm, client ID, ACS URL, certificate lifetime, MFA policy, responsible teams, break-glass procedure and rollback. Private keys, passwords and tokens never belong into that documentation. ## Why SSO matters for Multi-Linux Multi-Linux Manager handles systems from different distributions. More teams therefore need access to reports or actions: Linux operations, security, networking, platform teams, purchasing and partners. SSO makes access controllable without maintaining local accounts for every team. ## Step sequence for Keycloak integration First decide which user groups may open the Manager at all. Then define which groups can only read reports, which may schedule patch actions and which people receive real administrator rights. This decision comes before technical SAML configuration. Next create the Keycloak client. Client ID and ACS URL must exactly match the production Manager FQDN. If the Manager will later be reached through another name, load balancer or reverse proxy, that target architecture must be clear first. Then configure mappers. The most important value is the stable login name. Display name and email are useful, but the technical identity must stay unique over time. This prevents problems during name changes or role reviews. After that, add the public certificate of the identity provider to the Manager. Run the first login test with a normal user, not directly with a full administrator. That shows whether authentication and role assignment are separated correctly. Only then finalize MFA policies, admin roles and break-glass procedures. Local emergency access remains separate from SSO so Keycloak or certificate issues do not lock everyone out of the Manager. ## Checks after go-live After activation, test several scenarios: successful login, wrong password, missing second factor, disabled user, user without role, read-only user and administrator. Also verify that actions, reports and user access remain auditable. ## Why SSO is more than convenience Multi-Linux Manager controls patches, compliance, inventory and system actions. These rights are security-relevant. SSO with MFA makes admin access follow the same enterprise rules as other critical platforms and improves operations, security and traceability. For ForgeOne projects, SSO is an architecture topic. It connects Linux operations, identity management, security audit and customer operations. The technical login is only one part; roles, reports and responsibilities must match cleanly. ## Evidence from the tested manager environment The following sections do more than list commands. They show real state from the tested SUSE Multi-Linux Manager 5.2 environment: registered clients, channel assignment, package and patch counts, scheduled actions and the current audit state. access data, registration codes and internal infrastructure are deliberately not visible. SSO is not a cosmetic login topic. For a production manager, it separates admin identity, MFA, role model and traceability from local individual accounts. This tested manager series therefore treats SSO as an operations building block alongside patching, reporting and audit. [![SUSE Multi-Linux Manager 5.2 with managed SLES, Debian, Ubuntu, Rocky and AlmaLinux systems.](https://forgeone.solutions/media/01-all-systems-multidistro-1.png)](https://forgeone.solutions/media/01-all-systems-multidistro-1.png) ## Final technical acceptance: SSO and MFA This section documents the final live rollout state for part 8. It is based on the passed lab with SUSE Multi-Linux Manager 5.2, mgradm 5.2.16, mgrctl 5.2.16, Keycloak 26.7.3, the suse-mlm-lab realm, SAML, uid mapping, TOTP and Playwright end-to-end tests. ### Architecture of the tested SSO flow The tested path is deliberately simple: SUSE Multi-Linux Manager redirects the user to Keycloak via SAML. Keycloak authenticates the user, enforces TOTP when the policy is enabled and then sends the SAML response back to the Manager. The uid mapper ensures that user mapping uses the expected login name. ### Configuration verified in the lab - Keycloak realm suse-mlm-lab with a SAML client for SUSE Multi-Linux Manager. - SP/entity and ACS values matched to the Manager FQDN, without internal test URLs in the public article. - uid mapper enabled so the SAML NameID/attribute value matches the Manager user. - TOTP enabled as an MFA step and verified with a required action in the login path. - Logout and return to the signed-out state verified. ### Basic SSO test The basic test opens the Manager, follows the SAML redirect to Keycloak, signs in the user and returns to the Manager. The test only counts as passed when the Manager UI is reachable after the redirect. [![SUSE Multi-Linux Manager shows the SSO entry point before redirecting to Keycloak.](https://forgeone.solutions/media/01-mlm-sso-entry-2.png)](https://forgeone.solutions/media/01-mlm-sso-entry-2.png) [![Keycloak login in the suse-mlm-lab realm for the SAML test.](https://forgeone.solutions/media/02-keycloak-login.png)](https://forgeone.solutions/media/02-keycloak-login.png) [![SUSE Multi-Linux Manager after successful SAML SSO.](https://forgeone.solutions/media/04-mlm-after-sso.png)](https://forgeone.solutions/media/04-mlm-after-sso.png) [![Signed-out SUSE Multi-Linux Manager session after the logout test.](https://forgeone.solutions/media/05-logout.png)](https://forgeone.solutions/media/05-logout.png) ### MFA test with TOTP The enrollment step was executed, but the QR code and TOTP secret are not published. Only safe steps are documented publicly: password, TOTP validation, negative tests and successful login. [![Negative test with a wrong password in the Keycloak login.](https://forgeone.solutions/media/01-wrong-password.png)](https://forgeone.solutions/media/01-wrong-password.png) [![Negative test with a missing TOTP code.](https://forgeone.solutions/media/02-missing-totp.png)](https://forgeone.solutions/media/02-missing-totp.png) [![Negative test with a wrong TOTP code.](https://forgeone.solutions/media/03-wrong-totp.png)](https://forgeone.solutions/media/03-wrong-totp.png) [![Successful MFA login after entering the correct TOTP code.](https://forgeone.solutions/media/04-correct-totp.png)](https://forgeone.solutions/media/04-correct-totp.png) [![SUSE Multi-Linux Manager after successful MFA login.](https://forgeone.solutions/media/04-mlm-after-mfa.png)](https://forgeone.solutions/media/04-mlm-after-mfa.png) ### Negative tests The acceptance checked a wrong password, missing TOTP code and wrong TOTP code. Only the correct MFA step returned to the Manager. ### Typical failure modes - Redirect or ACS errors: verify entity ID, ACS URL and external Manager URL consistently. - User is not mapped: compare uid mapper and Manager username. - MFA is not requested: check required action, realm flow and user state in Keycloak. - Login succeeds but return fails: check SAML response, certificates, time drift and browser cookies. ### Technical acceptance checklist | Area | Check | Result | | --- | --- | --- | | Versions | MLM 5.2, mgradm 5.2.16, mgrctl 5.2.16, Keycloak 26.7.3 | PASS | | SAML | Redirect from Manager to Keycloak and back | PASS | | Mapping | uid mapper for user assignment | PASS | | MFA | TOTP is requested and validated correctly | PASS | | Negative tests | Wrong password, missing and wrong TOTP code | PASS | | Logout | Session ends and login is required again | PASS | | Secrets | No TOTP QR code and no secret in the public article | PASS | ## Hero image [![SUSE Multi-Linux Manager dashboard after the base installation.](https://forgeone.solutions/media/suse-mlm-5-2-07-manager-dashboard.png)](https://forgeone.solutions/media/suse-mlm-5-2-07-manager-dashboard.png) ## Author Mathias Rumbold ## Category - [Enterprise Linux](https://forgeone.solutions/en/tech/suse-multi-linux-manager-5-2-integrate-sso-keycloak-saml-mfa?category=enterprise-linux) - [Linux Lifecycle Management](https://forgeone.solutions/en/tech/suse-multi-linux-manager-5-2-integrate-sso-keycloak-saml-mfa?category=linux-lifecycle-management) ## Tags - [SUSE](https://forgeone.solutions/en/tech/suse-multi-linux-manager-5-2-integrate-sso-keycloak-saml-mfa?tags=suse) - [SUSE Multi-Linux Manager](https://forgeone.solutions/en/tech/suse-multi-linux-manager-5-2-integrate-sso-keycloak-saml-mfa?tags=suse-multi-linux-manager) - [SSO](https://forgeone.solutions/en/tech/suse-multi-linux-manager-5-2-integrate-sso-keycloak-saml-mfa?tags=sso) - [Keycloak](https://forgeone.solutions/en/tech/suse-multi-linux-manager-5-2-integrate-sso-keycloak-saml-mfa?tags=keycloak) - [Hardening](https://forgeone.solutions/en/tech/suse-multi-linux-manager-5-2-integrate-sso-keycloak-saml-mfa?tags=hardening) ## SUSE Enterprise Linux & Multi-Linux Manager Schritt für Schritt Die Serie verbindet SLES 16 Grundlagen mit dem produktiven Aufbau von SUSE Multi-Linux Manager 5.2. Bestehende URLs bleiben unverändert. 1. [Install SLES 16 for production: from ISO to manageable Linux server](https://forgeone.solutions/en/tech/install-sles-16) 2. [SLES 16 and Enterprise Linux: How Different Is Day-to-Day Administration?](https://forgeone.solutions/en/tech/sles-16-enterprise-linux-rhel-rocky-almalinux-comparison) 3. [Hardening and auditing SLES 16: OpenSCAP, CIS context and SUSE Multi-Linux Manager](https://forgeone.solutions/en/tech/sles-16-hardening-openscap-cis-mlm) 4. [Install SUSE Multi-Linux Manager 5.2 for production: SL Micro, storage and first channel sync](https://forgeone.solutions/en/tech/install-suse-multi-linux-manager-5-2-sl-micro) 5. [SUSE Multi-Linux Manager 5.2: onboard first Linux clients for production](https://forgeone.solutions/en/tech/suse-multi-linux-manager-5-2-onboard-linux-clients) 6. [SUSE Multi-Linux Manager 5.2: build production patch and lifecycle management](https://forgeone.solutions/en/tech/suse-multi-linux-manager-5-2-patch-lifecycle-management) 7. [SUSE Multi-Linux Manager 5.2: manage mixed Linux estates in production](https://forgeone.solutions/en/tech/suse-multi-linux-manager-5-2-manage-mixed-linux) 8. [SUSE Multi-Linux Manager 5.2: use OpenSCAP, compliance and audit in production](https://forgeone.solutions/en/tech/suse-multi-linux-manager-5-2-openscap-compliance-audit) 9. [SUSE Multi-Linux Manager 5.2: build proxies for sites and distributed Linux estates](https://forgeone.solutions/en/tech/suse-multi-linux-manager-5-2-build-proxies-for-sites) 10. [SUSE Multi-Linux Manager 5.2: integrate SSO with Keycloak, SAML and MFA (current part)](https://forgeone.solutions/en/tech/suse-multi-linux-manager-5-2-integrate-sso-keycloak-saml-mfa) 11. [SUSE Multi-Linux Manager 5.2: use Ansible next to Salt in production](https://forgeone.solutions/en/tech/suse-multi-linux-manager-5-2-ansible-next-to-salt) 12. [SUSE Multi-Linux Manager 5.2: build reporting, inventory and subscription audit](https://forgeone.solutions/en/tech/suse-multi-linux-manager-5-2-reporting-inventory-subscription-audit) 13. [Operate and harden SUSE Multi-Linux Manager 5.2 in production](https://forgeone.solutions/en/tech/operate-harden-suse-multi-linux-manager-5-2-production) ## Further content - [Identity & Access with Open Source and Enterprise Platforms](https://forgeone.solutions/en/products/identity-access) - [Keycloak](https://forgeone.solutions/en/products/keycloak) - [Single Sign-On (SSO)](https://forgeone.solutions/en/single-sign-on-sso)