Here at B1 Systems, we recently had the challenge to give all colleagues access to resources in the Microsoft Azure Public Cloud. Of course, we have an existing (OpenSource) authentication/authorization infrastructure, which is not Microsoft Azure, but consists of an OpenLDAP server for legacy applications and a Keycloak instance for “all things web”. If you have the same or a similar setup, this small howto might be interesting for you.
Out in the interwebs there are 100s of guides to use Microsoft Azure Directory (Azure AD) as an identify provider (IdP) in Keycloak. But we want it to be the other way around! Keycloak shall be a SAML federated IdP for Azure AD.