Navigate to the Keycloak Admin Console

Log in to your Keycloak admin console and select your realm

Create a SAML Client

Navigate to Clients → Create Client

Select SAML as the client protocol

Set Client ID to the StackAI service provider entity ID (see below). It must match exactly, or Keycloak will not recognize the client.

Fill out general settings

Client ID: https://supabase.<tenant>.stack.ai/auth/v1/sso/saml/metadata

Name: Your Application Name

Description: Optional description

Click Save

Fill out SAML settings

Fill out the following values:

Home URL: https://<tenant>.stack.ai/

Valid redirect URIs: https://supabase.<tenant>.stack.ai/auth/v1/sso/saml/*

Master SAML Processing URL: https://supabase.<tenant>.stack.ai/auth/v1/sso/saml/acs

Name ID format: Email Address

Force Name ID Format: ON

Force POST Binding: ON

Include AuthnStatement: ON