Integrate a SAML 2.0 service provider

AuthGuard is a SAML 2.0 identity provider. This article sums up what a service provider (SP) needs to integrate.

Identity provider details

<organization> is the organization's internal identifier (Tenant ID).

Request rules

• The AssertionConsumerServiceURL (or its index) must exactly match a registered ACS (https). Protection lies in the exact registration: AuthnRequest signatures are not verified.
• Responses always go by HTTP-POST; Artifact and Redirect are not supported.
• ForceAuthn forces a new confirmation; IsPassive without a usable single sign-on session returns NoPassive.
• RelayState is returned as received.

The response

• RSA-SHA256 signature of the response, the assertion or both (configurable).
• Assertion lifetime of 60 to 600 seconds (default 300).
• NameID: email, pairwise random identifier (persistent), user UUID or directory user name.
• Up to 32 attributes: email, user_id, groups, directory_username, role or constants.

Error statuses

Not supported

SAML Single Logout, encrypted assertions and account creation at the SP (no outbound SCIM).