---
title: "SamlSettings"
---

> Documentation Index
> Fetch the complete documentation index at: https://docs.ezghcloud.com/llms.txt
> Use this file to discover all available pages before exploring further.

Path: EZGH SSO API

## Fields

- `SamlSettings.acsUrls` (array<string>, required) — Exact assertion consumer service URLs (HTTP-POST binding), https (http only on loopback); the first is the default. A response only ever goes to one of these, never to a URL taken from a request.
  - format `uri`
- `SamlSettings.attributes` (array<object>, required)
  - `SamlSettings.attributes.name` (string, required) — The attribute's Name, as the service provider expects it.
    - minLength 1; maxLength 256
  - `SamlSettings.attributes.value` (string, required) — A template: literal text with ${user.id}, ${user.email}, ${user.name}, ${user.givenName}, ${user.familyName} or ${user.department}; or exactly ${user.groups}, one value per group (filtered by groupsFilter). A value that is a single variable the user has no value for is left out.
    - minLength 1; maxLength 1024
  - `SamlSettings.attributes.nameFormat` (string, optional) — The attribute's NameFormat. Default unspecified.
    - one of `"unspecified"`, `"uri"`, `"basic"`
- `SamlSettings.defaultRelayState` (string | null, required) — The RelayState sent with IdP-initiated sign-in (where the service provider lands).
  - maxLength 1024
- `SamlSettings.encryptAssertions` (boolean, required) — Encrypt the assertion to the service provider's encryption certificate. Default false.
- `SamlSettings.encryptionAlgorithm` (string, required) — The content encryption (the key is transported with RSA-OAEP). Default aes128-gcm.
  - one of `"aes128-gcm"`, `"aes256-cbc"`
- `SamlSettings.entityId` (string, required) — The service provider's entity ID: the assertion's audience, and the Issuer its AuthnRequests must carry.
  - minLength 1; maxLength 1024
- `SamlSettings.groupsFilter` (string, required) — ${user.groups}: only the groups assigned to the application (the default), or all of the user's groups.
  - one of `"assigned"`, `"all"`
- `SamlSettings.idp` (object, required) — The directory's identity provider for this application, on its host.
  - `SamlSettings.idp.certificates` (array<object>, required)
    - `SamlSettings.idp.certificates.activatesAt` (string, required)
      - format `date-time`
    - `SamlSettings.idp.certificates.certificate` (string, required) — The X.509 certificate, base64 DER.
    - `SamlSettings.idp.certificates.fingerprintSha256` (string, required)
    - `SamlSettings.idp.certificates.id` (string, required)
      - format `uuid`
    - `SamlSettings.idp.certificates.notAfter` (string, required)
      - format `date-time`
    - `SamlSettings.idp.certificates.notBefore` (string, required)
      - format `date-time`
    - `SamlSettings.idp.certificates.status` (string, required) — active signs now; next is published and starts signing when the active certificate expires (made 90 days before).
      - one of `"active"`, `"next"`
    - `SamlSettings.idp.certificates.subject` (string, required)
    - `SamlSettings.idp.certificates.warnAt` (string, required) — 60 days before notAfter: from then the console warns that service providers need the next certificate.
      - format `date-time`
  - `SamlSettings.idp.entityId` (string, required) — The IdP's entity ID for this application (its metadata URL).
  - `SamlSettings.idp.initiateUrl` (string, required) — Opening it starts IdP-initiated sign-in (the portal tile), when idpInitiated is on.
    - format `uri`
  - `SamlSettings.idp.metadataUrl` (string, required)
    - format `uri`
  - `SamlSettings.idp.sloUrl` (string, required) — Single logout, HTTP-Redirect and HTTP-POST bindings.
    - format `uri`
  - `SamlSettings.idp.ssoUrl` (string, required) — Single sign-on, HTTP-Redirect and HTTP-POST bindings.
    - format `uri`
- `SamlSettings.idpInitiated` (boolean, required) — Allow IdP-initiated sign-in (a portal tile). Default true.
- `SamlSettings.metadataImportedAt` (string | null, required)
  - format `date-time`
- `SamlSettings.metadataUrl` (string | null, required) — Where the service provider's metadata was imported from, if a URL.
  - format `uri`
- `SamlSettings.nameIdFormat` (string, required) — email (the default), persistent (the user's ID) or transient (new for every assertion).
  - one of `"email"`, `"persistent"`, `"transient"`
- `SamlSettings.signAssertion` (boolean, required) — Sign the Assertion. Default true. At least one of the two is signed.
- `SamlSettings.signResponse` (boolean, required) — Sign the Response. Default true.
- `SamlSettings.sloBinding` (string, required) — Default HTTP-Redirect.
  - one of `"HTTP-Redirect"`, `"HTTP-POST"`
- `SamlSettings.sloUrl` (string | null, required) — The service provider's single logout endpoint, where logout responses go.
  - format `uri`
- `SamlSettings.spCertificates` (array<object>, required)
  - `SamlSettings.spCertificates.certificate` (string, required) — The X.509 certificate, base64 DER (PEM is accepted on input).
  - `SamlSettings.spCertificates.use` (string, required)
    - one of `"signing"`, `"encryption"`
  - `SamlSettings.spCertificates.fingerprintSha256` (string, optional) — Read-only: the certificate's SHA-256 fingerprint, hex.
  - `SamlSettings.spCertificates.notAfter` (string, optional) — Read-only.
    - format `date-time`
  - `SamlSettings.spCertificates.subject` (string, optional) — Read-only.


Source: https://docs.ezghcloud.com/sso-api/schemas/SamlSettings/index.md