SamlSettings

View as Markdown

Fields

acsUrlsarray ofstringrequired
Exact assertion consumer service URLs (HTTP-POST binding), https (http only on loopback); the first is the default. A response only ever goes to one of these, never to a URL taken from a request.

format: uri
attributesarray ofobjectrequired
3 properties
- namestringrequired
  The attribute's Name, as the service provider expects it.
  
  maxLength: 256, minLength: 1
- valuestringrequired
  A template: literal text with ${user.id}, ${user.email}, ${user.name}, ${user.givenName}, ${user.familyName} or ${user.department}; or exactly ${user.groups}, one value per group (filtered by groupsFilter). A value that is a single variable the user has no value for is left out.
  
  maxLength: 1024, minLength: 1
- nameFormatoptionalunspecifiedoruriorbasic
  The attribute's NameFormat. Default unspecified.
defaultRelayStatestring | nullrequired
The RelayState sent with IdP-initiated sign-in (where the service provider lands).

maxLength: 1024
encryptAssertionsbooleanrequired
Encrypt the assertion to the service provider's encryption certificate. Default false.
encryptionAlgorithmaes128-gcmoraes256-cbcrequired
The content encryption (the key is transported with RSA-OAEP). Default aes128-gcm.
entityIdstringrequired
The service provider's entity ID: the assertion's audience, and the Issuer its AuthnRequests must carry.

maxLength: 1024, minLength: 1
groupsFilterassignedorallrequired
${user.groups}: only the groups assigned to the application (the default), or all of the user's groups.
idpobjectrequired
The directory's identity provider for this application, on its host.
6 properties
- certificatesarray ofobjectrequired
  9 properties
  activatesAtstringrequired
  format: date-time
  certificatestringrequired
  The X.509 certificate, base64 DER.
  
  fingerprintSha256stringrequired
  idstringrequired
  format: uuid
  notAfterstringrequired
  format: date-time
  notBeforestringrequired
  format: date-time
  statusactiveornextrequired
  active signs now; next is published and starts signing when the active certificate expires (made 90 days before).
  
  subjectstringrequired
  warnAtstringrequired
  60 days before notAfter: from then the console warns that service providers need the next certificate.
  
  format: date-time
- entityIdstringrequired
  The IdP's entity ID for this application (its metadata URL).
- initiateUrlstringrequired
  Opening it starts IdP-initiated sign-in (the portal tile), when idpInitiated is on.
  
  format: uri
- metadataUrlstringrequired
  format: uri
- sloUrlstringrequired
  Single logout, HTTP-Redirect and HTTP-POST bindings.
  
  format: uri
- ssoUrlstringrequired
  Single sign-on, HTTP-Redirect and HTTP-POST bindings.
  
  format: uri
idpInitiatedbooleanrequired
Allow IdP-initiated sign-in (a portal tile). Default true.
metadataImportedAtstring | nullrequired
format: date-time
metadataUrlstring | nullrequired
Where the service provider's metadata was imported from, if a URL.

format: uri
nameIdFormatemailorpersistentortransientrequired
email (the default), persistent (the user's ID) or transient (new for every assertion).
signAssertionbooleanrequired
Sign the Assertion. Default true. At least one of the two is signed.
signResponsebooleanrequired
Sign the Response. Default true.
sloBindingHTTP-RedirectorHTTP-POSTrequired
Default HTTP-Redirect.
sloUrlstring | nullrequired
The service provider's single logout endpoint, where logout responses go.

format: uri
spCertificatesarray ofobjectrequired
5 properties
- certificatestringrequired
  The X.509 certificate, base64 DER (PEM is accepted on input).
- usesigningorencryptionrequired
- fingerprintSha256optionalstring
  Read-only: the certificate's SHA-256 fingerprint, hex.
- notAfteroptionalstring
  Read-only.
  
  format: date-time
- subjectoptionalstring
  Read-only.