Skip to main content

Add FusionAuth as an identity provider

Use FusionAuth to give your organization users single sign-on (SSO) access to Aiven.

Prerequisite steps in Aiven Console

Add FusionAuth as an identity provider in the Console.

Configure SAML on FusionAuth

The setup on FusionAuth has three parts:

  • create an API key
  • generate a custom RSA certificate
  • create an application

Create an API Key in your FusionAuth instance:

  1. In FusionAuth, go to Settings > API Keys.

  2. Click the Add icon.

  3. Enter a description for the key. Example: Certificate generator.

  4. In the Endpoints list, find /api/key/import.

  5. Toggle on POST.

  6. Click the Save icon.

    Creating API Key.

  7. On the API Keys page, find your new key and click the value in the Key column.

  8. Copy the whole key. You'll use this for the script.

    Grabbing API Key.

  9. Clone the FusionAuth example scripts GitHub repository.

    git clone
    cd fusionauth-example-scripts/v3-certificate
  10. Run the generate-certificate script.

  11. Give the key a meaningful name (for example, "Aiven key").

  12. Copy the generated certificate that the script creates. You now have a certificate in the Key Master in your FusionAuth instance.

Create an application in your FusionAuth instance:

  1. In Applications, click the Add icon.

  2. Enter a name for the application (for example, "Aiven").

  3. On the SAML tab, and toggle on the Enabled switch.

  4. Paste the Metadata URL and ACS URL you copied from the Aiven Console to the Issuer and Authorized redirect URLs fields in your FusionAuth application, respectively.

    Metadata URLIssuer
    ACS URLAuthorized redirect URLs
  5. In the Authentication response section, change the Signing key to the API key you created.

  6. Click the Save icon to save your application.

  7. On the Applications page, click the magnifying glass.

  8. In the SAML v2 Integration details section, copy the Entity Id and Login URL.

Finish the configuration in Aiven

Go back to the Aiven Console to configure the IdP and complete the setup.