SAML v2 IdP Initiated Identity Provider
This feature is only available in an Essentials or Enterprise plan. Please visit our pricing page to learn more.
Available since 1.26.0
Using IdP initiated SSO with this Identity Provider is not recommended and is inherently less secure than a service provider initiated login.
In general FusionAuth does not recommend you utilize this type of login due to the inherent risks of accepting an unsolicited authentication response from a third-party identity provider.
If you must enable this feature to support a legacy integration or because the user experience is of the highest concern, then proceed.
This FusionAuth Identity Provider allows you to configure FusionAuth to accept a SAML request initiated by a SAMLv2 identity provider. With this Identity Provider, FusionAuth is acting as the SAMLv2 service provider (SP).
Typically, a SAML flow begins at a service provider such as FusionAuth. In a service provider initiated login, the SAML Authentication Response is returned to the service provider in response to an authentication request. FusionAuth can validate certain parameters and only accept a response for a request that FusionAuth initiated.
In contrast, during an identity provider initiated login, the third-party identity provider sends FusionAuth a SAML Authentication Response indicating a user has been authenticated. FusionAuth did not initiate this request so it is unexpected and FusionAuth does not have the full context. This limits what can be verified and requires FusionAuth to allow a cross site request from this third party.
We also provide specific examples for configuring SAML with some providers whose implementation requires unique configuration. If you’d like us to provide additional examples, please open a request on GitHub.
Once you have completed this configuration you will be able to log in to FusionAuth directly from a SAMLv2 IdP.
Create a SAML v2 IdP Initiated Identity Provider
To create an Identity Provider navigate toand click and select .
This will take you to thepanel. Here you will need to fill out the required fields.
- Enabled Required
Determines if this provider is enabled. If it is false then it will be disabled globally.
- Id Optional
An optional UUID. When this value is omitted a unique Id will be generated automatically.
- Name Required
A unique name to identify the identity provider. This name is for display purposes only and it can be modified later if desired.
- Issuer Required
The EntityId (unique identifier) of the SAML v2 identity provider. This value should be provided to you.
- Use NameId for email Optional
If this is enabled, FusionAuth will assume that the
NameIDin the SAML response contains the email address of the user.
- Email claim Required
The name of the email claim returned in the SAML response.
When Use NameId for email is enabled this field will not be displayed and will not be required.
- Verification key Required
The public key or certificate that you must import into FusionAuth’s KeyMaster. This is the public key provided to you by the identity provider.
- Reconcile lambda Optional
A lambda maps custom claims returned from the SAML response into the FusionAuth
Registration. To learn more about creating a lambda, view the SAML v2 Reconcile lambda documentation.
To configure a lambda, navigate to.
- Debug Optional
Some identity providers are not compliant with the SAML and XML signing specifications. This makes it challenging to get them working with FusionAuth.
If you are running into integration issues, toggle this setting on and FusionAuth will output debugging information into the Event Log during a SAML login. You can find the event log in.
After configuring the Identity Provider, FusionAuth will display values likely required by your SAML v2 Identity Provider to trust FusionAuth as a relying party. Do so by navigating toand click the green magnifying glass on your SAML provider.
When viewing the details, scroll to thesection. There you will find the necessary values to configure an integration with a SAMLv2 IdP.
SAML v2 Integration Details
- Callback URL (ACS)
An Assertion Consumer Service (or ACS) is the location at a service provider that accepts messages to establish a session based on the assertion.
By default the redirect URI will be the first Authorized redirect URI found in the FusionAuth Application OAuth configuration. To specify a redirect URI send the authorized URI in the
RelayStateparameter. Support for using the
RelayStatein this manner is supported in FusionAuth version greater than or equal to
1.41.0. In prior versions, append a query parameter named
redirect_urito the ACS in the IdP configuration.
The service provider EntityId. This is a URL.
- Metadata URL
The URL where the service provider metadata resides.
To complete the login request, the SAML v2 identity provider will make an HTTP
POST request to the callback URL in FusionAuth. In order for this request to be allowed through the CORS filter you will need to navigate to and add the SAML IdP origin as an Allowed Origin the CORS configuration.
To troubleshoot, turn on the Debug option and then navigate to .
Proceed through the SAML flow and review the Event log entries to see if there are any configuration issues.
How helpful was this page?
See a problem?
Have a question or comment to share?
Visit the FusionAuth community forum.