Create, validate and enable the federation binding
Step 3 of 4 in Federate wallet sign-in to Keycloak.
Create the binding below the hosted proxy, pointing at the external resource UUID. Set the requested
scopes, the mapping from Keycloak claims to the governed authentication targets, and the client
authentication method with its write-once credential. Set order (0 for the only upstream) and
create it with enabled: false.
Validation checks that both resources belong to the tenant, both are active, discovery is fresh, every requested scope is supported and the client authentication method is advertised.
With the proxy in FEDERATED_ONLY mode and one enabled binding, an authorization request now
redirects to Keycloak. Revalidate after any Keycloak discovery change.
Next
Continue with step 4, Bind the proxy to the issuer.