Overview
The Beta SAML Identity Provider (IdP) API implements configuration, metadata, authentication, and assertion-generation paths for SAML Service Providers. It is intended for products such as Salesforce, AWS Console, and Google Workspace, but public interoperability results for those products have not yet been published; validate the exact provider and workflow before deployment.
The implementation is based on SAML 2.0 and includes XML-DSIG signing, application-level private-key encryption, configurable attribute mapping, and SP-initiated and IdP-initiated paths. This is not a SAML conformance or certification claim. See the current project status.
Key Features
- SAML assertion paths: Implemented assertion and response generation for documented flows
- XML-DSIG Signatures: RSA-SHA256 signing of assertions and responses for security
- Encrypted Key Storage: Private keys encrypted at rest with AES-GCM encryption
- Attribute Mapping: Configurable mapping of user attributes to SAML attributes
- Multiple Bindings: Support for HTTP-POST and HTTP-Redirect bindings
- SP-Initiated SSO: Standard SAML flow where Service Provider initiates authentication
- IdP-Initiated SSO: Direct login from IdP dashboard to Service Provider
- Single Logout (SLO): Implemented SLO paths with documented service-level boundaries
- Certificate rollover: One active signer plus a seven-day, metadata-only window for at most two previous certificates; external rollover evidence is still incomplete
- MFA Integration: Seamless integration with multi-factor authentication
- Relay State Preservation: Maintains SP state throughout authentication flow
Endpoints Summary
| Method | Path | Description |
|---|---|---|
POST |
/api/organizations/:org_slug/services/:service_slug/saml |
Configure SAML IdP settings |
GET |
/api/organizations/:org_slug/services/:service_slug/saml |
Get SAML configuration |
DELETE |
/api/organizations/:org_slug/services/:service_slug/saml |
Delete SAML configuration |
POST |
/api/organizations/:org_slug/services/:service_slug/saml/certificate |
Generate signing certificate |
GET |
/api/organizations/:org_slug/services/:service_slug/saml/certificate |
Get active certificate |
DELETE |
/api/organizations/:org_slug/services/:service_slug/saml/certificate/overlap |
Retire all previous metadata certificates immediately |
GET |
/api/organizations/:org_slug/services/:service_slug/saml/login |
IdP-initiated SSO |
GET |
/saml/:org_slug/:service_slug/metadata |
SAML IdP metadata XML |
GET/POST |
/saml/:org_slug/:service_slug/sso |
SAML SSO endpoint (SP-initiated) |
GET/POST |
/saml/:org_slug/:service_slug/slo |
SAML Single Logout (SLO) endpoint |
GET |
/saml/:org_slug/:service_slug/authenticate |
SAML authentication page |
Choose a SAML task
| Need | Focused reference |
|---|---|
| Create, inspect, or remove an IdP configuration | Configuration |
| Generate, inspect, or rotate signing certificates | Certificate rotation |
| Publish metadata or run SP-initiated and IdP-initiated SSO | Metadata and SSO |
| Implement and validate Single Logout | Single Logout |
| Follow an end-to-end workflow or provider recipe | Integration recipes |
| Review security boundaries and deployment limitations | Security and limitations |
| Diagnose failures or inspect audit events | Troubleshooting |
Published-anchor compatibility
The SAML overview remains the stable published route. These headings preserve the original fragment identifiers and direct existing links to the focused references.
SAML Configuration Management
POST /api/organizations/:org_slug/services/:service_slug/saml
GET /api/organizations/:org_slug/services/:service_slug/saml
DELETE /api/organizations/:org_slug/services/:service_slug/saml
Certificate Management
Continue in certificate rotation.
POST /api/organizations/:org_slug/services/:service_slug/saml/certificate
Generate or rotate a certificate.
GET /api/organizations/:org_slug/services/:service_slug/saml/certificate
Retrieve the active certificate.
DELETE /api/organizations/:org_slug/services/:service_slug/saml/certificate/overlap
SAML SSO Endpoints
GET /saml/:org_slug/:service_slug/metadata
GET/POST /saml/:org_slug/:service_slug/sso
GET/POST /saml/:org_slug/:service_slug/slo
GET /saml/:org_slug/:service_slug/authenticate
Open the authentication page reference.
GET /api/organizations/:org_slug/services/:service_slug/saml/login
Complete SAML Integration Workflow
Continue in integration recipes.
Step 1: Configure SAML IdP
Step 2: Configure Service Provider
Configure the Service Provider.
Step 3: Test Authentication
Step 4: Monitor and Maintain
Service Provider Integration Examples
Salesforce Integration
AWS IAM Integration
Google Workspace Integration
Open the Google Workspace recipe.