SSO Security and Validation Settings

The Security & Validation section controls how instellix synchronizes users and validates authentication data received from your Identity Provider.

Sync Mode

The Sync Mode determines how user information received from the Identity Provider is synchronized with instellix. This is particularly relevant for role mapping.

This includes all data managed by configured identity provider mappers, such as:

First name and last name
Email address
User attributes
Role mappings

Sync Mode	Description	Recommended when	Effect on Changes
Import	Imports user information and role mappings when the user signs in through SSO for the first time. Later changes in the identity provider are not synchronized automatically.	Local user data may be modified after the initial import.	Changes in the identity provider are not synchronized automatically. Local changes remain unchanged.
Force	Synchronizes user information and role mappings every time the user signs in. The identity provider remains the authoritative source for mapped data.	User information and role assignments should always reflect the current state of the identity provider.	Changes in the identity provider are applied during every login. Depending on the mapper, local changes may be overwritten and roles may be added or removed.
Legacy	Uses the synchronization behavior of older Keycloak versions. The exact behavior depends on the configured mapper and is intended for backward compatibility.	Existing Keycloak configurations that rely on the previous synchronization behavior.	Uses Keycloak's legacy synchronization behavior. Not recommended for new configurations.
Inherit	Uses the Sync Mode configured for the identity provider. The mapper follows the provider's synchronization behavior instead of defining its own.	Individual mappers should follow the provider-wide synchronization settings.	The behavior depends entirely on the Sync Mode configured for the identity provider (for example Import or Force).

Note: The Sync Mode only determines when identity provider mappers are executed. Which user information is synchronized depends on the configured mapper.

Role Mappings

Role mappings behave differently depending on the selected Sync Mode.

Import applies role mappings only when a brokered user is created during the first login.
Force evaluates role mappings during every login, allowing roles to be added or removed based on the current claims provided by the identity provider.

Recommendation: Use Force if the identity provider should remain the authoritative source for user roles.

Trust Email

Determines whether email addresses received from the identity provider are considered verified.

Enabled

The email address provided by the identity provider is trusted.
Users do not need to verify their email address again, even if email verification is generally enabled.
If supported by the identity provider, the email_verified claim is also respected.

Use this option only if the identity provider reliably verifies user email addresses.

Disabled

Email addresses are not automatically trusted.
If email verification is enabled, users may still need to verify their email address after their first login.

Validate Signatures

Determines whether ID Tokens received from the identity provider are cryptographically verified.

Enabled

The received ID Token is validated to ensure that it:

was issued by the configured identity provider,
has not been modified,
was signed using a trusted key.

This is the recommended setting for production environments.

Disabled

The signature of the received ID Token is not validated.

This reduces the ability to verify the authenticity and integrity of the token and should only be used for testing or in special scenarios where signature validation is intentionally disabled.

Use JWKS URL

Determines how the public keys used for signature validation are obtained.

This setting is only relevant when Validate Signatures is enabled.

Enabled

The public keys are automatically downloaded from the configured JWKS URL.

JWKS (JSON Web Key Set) is a standard endpoint that publishes the public signing keys of the identity provider.

Benefits include:

automatic retrieval of signing keys,
automatic support for key rotation,
reduced administrative effort.

This is the recommended configuration whenever the identity provider provides a JWKS endpoint.

Disabled

The public key or certificate must be configured manually.

If the identity provider changes its signing key, the configured key must also be updated manually. Otherwise, newly issued tokens can no longer be validated and authentication will fail.

Recommended Configuration

For most OpenID Connect integrations, the following configuration is recommended:

Setting	Recommendation
Sync Mode	Force if the identity provider manages users and roles centrally; otherwise Import
Trust Email	Enable only if the identity provider verifies email addresses
Validate Signatures	Enabled
Use JWKS URL	Enabled whenever a JWKS endpoint is available
JWKS URL	Configure the JWKS endpoint provided by your identity provider