Getting Started
- What is TestInvite?
- Build Your First Test
- Run Your First Assessment
- Taking the Assessment
- Viewing the Results
- Question Bank Overview
- Common Question Features
- Scoring
- Question Types
- Question Authoring
- Browsing Questions
- Content Blocks
- Media Library
- Metadata Rules & Schema
- Tests Overview
- My Tests
- Creating a Test
- The Test Editor
- Test Settings
- Sections & Pages
- Adding Questions
- Page Builders
- Test Profile
- Reporting
- Test Papers
- Analytics
- Publishing a Test
- Test Library
- Marketplace
- Tasks Overview
- Creating a Task
- Task Dashboard
- Steps
- Task Settings
- Candidates
- Test Sessions
- Sent Mails
- Proctoring
- Analytics
- Analytics Overview
- Test Analytics
- Question Analytics
- Per-Question Analytics
- Results Explorer
- Segment Analysis
Organization
Single Sign-On (SSO)
Set Up SSO with Keycloak
In Keycloak, TestInvite is a client in your realm: import TestInvite's SAML metadata to create a SAML client, or create an OpenID Connect client with client authentication on.
Published 2026/10/19
This guide uses the Keycloak admin console (version 19 and later). Replace <ORG-ID> with your TestInvite organization ID, sso.company.com with your Keycloak host and company with your realm.
Option A — SAML 2.0
- Select your realm → Clients → Import client → Resource file: TestInvite's metadata (from Download metadata) → Save. The client ID becomes TestInvite's Entity ID.
- Settings tab: Name ID format email, Force name ID format on; Sign documents on (or Sign assertions on).
- Keys tab: turn Client signature required off, unless you turn on Sign authentication requests in TestInvite.
- Client scopes → the dedicated scope → Add mapper → By configuration → User Property: property
email, SAML attribute nameemail; repeat forfirstNameandlastName.
In TestInvite, protocol SAML 2.0, metadata URL https://sso.company.com/realms/company/protocol/saml/descriptor → Import.
Option B — OpenID Connect
- Clients → Create client → type OpenID Connect, client ID
testinvite→ Next. - Client authentication on; Standard flow on; other flows off → Next.
- Valid redirect URIs:
https://www.testinvite.com/api/v1/auth/sso/<ORG-ID>/oidc/callback→ Save. - Credentials tab: copy the Client secret.
In TestInvite: Issuer URL https://sso.company.com/realms/company, client ID testinvite, the client secret, client authentication Basic, scopes openid email profile.