Host a SAML v2 Identity Provider

This is the issuer string that the service provider will send in the SAML request to FusionAuth. FusionAuth uses this issuer value to look up this FusionAuth application in order to start the SAML login process.

The issuer string is used by service providers (e.g. Google, Zendesk, etc.) to identify themselves to FusionAuth's SAML identity provider. Often you cannot set this to a custom value in the service provider and need to read their documentation or test the integration and use the error messages to determine the correct value.

Some service providers, such as Zendesk, require a different audience in the SAML response than the Issuer set above. If you are configuring a service provider that requires a different audience, enter the audience name, otherwise leave it blank.

If this isn't specified, FusionAuth will set the audience to the same value as the Issuer .

One or more URLs that FusionAuth may redirect to after the user has successfully logged in.

This is also known as the Assertion Consumer Service URL or ACS.

The URL used to perform the 302 redirect as the response from the /samlv2/logout endpoint. If this value is omitted, the tenant configured logout URL will be used. See the Logout URL under the Tenant -> Your Tenant -> OAuth tab.

Usually this is the starting location of the application.

Many service providers are not compliant with the SAML and XML signing specifications. This makes it challenging to get them working with FusionAuth.

If you are running into integration issues, toggle this setting on and FusionAuth will output debugging information into the Event Log during a SAML login. You can find the event log in System -> Event Log .

Enable to require the SAML v2 Service Provider to sign the SAML v2 authentication request. When this is enabled, if a signature is omitted the request will be rejected.

The default key used to verify the signature if the public key cannot be determined by the KeyInfo element when using POST bindings, or the key used to verify the signature when using HTTP Redirect bindings.

If a Require signature is not enabled, this field is optional.

When enabled, FusionAuth will accept a username or email address as a login hint on a custom HTTP request parameter.

The name of the login hint parameter provided by the service provider on an AuthnRequest. If this parameter is present, its value will be used to pre-populate the username field on the FusionAuth login form.

For example, suppose Enable login hint is enabled and Login hint parameter name has the value login_name. When FusionAuth is set up as an IdP, the SP can send a request which includes the parameter login_name=richard@example.com, and FusionAuth will pre-populate richard@example.com into the login form the end user sees.

Note that this setting names an HTTP query parameter, not an element in the SAML AuthnRequest XML.

In order to properly sign the SAML responses, FusionAuth requires a key pair from Key Master. You can either select an existing key here or select the first option to have FusionAuth generate a key pair to use. If no choice is selected, a new key will be automatically created and assigned.

To add, manage or import your key, navigate to Settings -> Key Master .

This sets the XML signature canonicalization method that FusionAuth will use when signing the SAML response. This method is also used when FusionAuth creates a message digest in the SAML response.

This option is usually the first thing to change if a service provider is rejecting the SAML response from FusionAuth. Many service providers are not compliant with the full XML signature specification and require a fixed canonicalization method. Your best bet is to try all four values until a login succeeds.

Some service providers may require the signature in a specific location. When Assertion is selected the signature element will be a child of the assertion. When Response is selected the signature will be placed at the top level of the response.

This specifies a lambda that FusionAuth will invoke prior to sending the SAML response to the service provider. This allows you to write a lambda to populate additional information into the SAML response. In most cases, your lambda will add an Attribute, or more than one, to the response.

The complete documentation for this lambda can be found on the SAML v2 response populate lambda documentation page.

When enabled, FusionAuth will be able to initiate a login request to a SAML v2 Service Provider.

Once enabled, open the View dialog or this application to view the integration URI. You will find this value in the view dialog in the SAML v2 Integration details, and the value will be named Initiate login URL: .

The NameId format to send in the AuthN response to the SAML v2 Service Provider. There are two valid values:

• Persistent - The urn:oasis:names:tc:SAML:2.0:nameid-format:persistent NameID format will be used.
• Email - The urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress NameID format will be used.

Enable to require the SAML v2 Service Provider to sign the SAML v2 Logout request. When this is enabled, if a signature is omitted the request will be rejected.

The default key used to verify the signature if the public key cannot be determined by the KeyInfo element when using POST bindings, or the key used to verify the signature when using HTTP Redirect bindings.

If a Require signature is not enabled, this field is optional.

When set to All session participants, each session participant that has Enable single logout set to true will be sent a Logout Request.

When set to Only Originator, no other session participants will be notified when a logout request is sent for this application.

This configuration is functionally equivalent to the Logout Behavior found in the OAuth2 configuration.

Enable Single Logout behavior. When enabled, this application will receive LogoutRequests from any other application in this tenant receives one.

The URL which you want to receive the LogoutRequest from FusionAuth.

If Enable single logout is not enabled, this field is optional.

In order to properly sign the SAML Single Logout responses, FusionAuth requires a key pair from Key Master. You can either select an existing key here or select the first option to have FusionAuth use the authentication response signing key.

To add, manage or import your key, navigate to Settings -> Key Master .

This sets the XML signature canonicalization method that FusionAuth will use when signing the SAML Single Logout response.

This option is usually the first thing to change if a service provider is rejecting the SAML Single Logout response from FusionAuth. Many service providers are not compliant with the full XML signature specification and require a fixed canonicalization method. Your best bet is to try all four values until a logout succeeds.

In order to properly sign the SAML Logout responses, FusionAuth requires a key pair from Key Master. You can either select an existing key here or select the first option to have FusionAuth use the authentication response signing key.

To add, manage or import your key, navigate to Settings -> Key Master .

This sets the XML signature canonicalization method that FusionAuth will use when signing the SAML Logout response.

This option is usually the first thing to change if a service provider is rejecting the SAML Logout response from FusionAuth. Many service providers are not compliant with the full XML signature specification and require a fixed canonicalization method. Your best bet is to try all four values until a logout succeeds.

When enabled, assertions in SAML responses will be encrypted.

The symmetric key encryption algorithm used to encrypt the SAML assertion.

The location that the encrypted symmetric key information will be placed in the SAML response in relation to the EncryptedData element containing the encrypted assertion value.

The encryption algorithm used to encrypt the symmetric key for transport in the SAML response.

The message digest algorithm to use when encrypting the symmetric key for transport.

The mask generation function and hash function to use for the Optimal Asymmetric Encryption Padding when encrypting a symmetric key for transport. This configuration is only available when Key transport algorithm is set to RSA OAEP with MGF1.

The RSA certificate from Key Master that will be used to encrypt the SAML assertion encryption symmetric key for transport.

This field is required when SAML assertion encryption is enabled.