Sign in
providers

SAMLProvider Viewset

post/providers/saml/

Request body

namestring required
authentication_flowstring uuid nullable

Flow used for authentication when the associated application is accessed by an un-authenticated user.

authorization_flowstring uuid required

Flow used when authorizing this provider.

invalidation_flowstring uuid required

Flow used ending the session from a provider.

property_mappingsstring[]
acs_urlstring uri required
sls_urlstring uri

Single Logout Service URL where the logout response should be sent.

audiencestring

Value of the audience restriction field of the assertion. When left empty, no audience restriction will be added.

issuer_overridestring

Also known as EntityID. Providing a value overrides the default issuer generated by authentik.

assertion_valid_not_beforestring

Assertion valid not before current time + this value (Format: hours=-1;minutes=-2;seconds=-3).

assertion_valid_not_on_or_afterstring

Assertion not valid on or after current time + this value (Format: hours=1;minutes=2;seconds=3).

session_valid_not_on_or_afterstring

Session not valid on or after current time + this value (Format: hours=1;minutes=2;seconds=3).

name_id_mappingstring uuid nullable

Configure how the NameID value will be created. When left empty, the NameIDPolicy of the incoming request will be considered

authn_context_class_ref_mappingstring uuid nullable

Configure how the AuthnContextClassRef value will be created. When left empty, the AuthnContextClassRef will be set based on which authentication methods the user used to authenticate.

digest_algorithm'http://www.w3.org/2000/09/xmldsig#sha1' | 'http://www.w3.org/2001/04/xmlenc#sha256' | 'http://www.w3.org/2001/04/xmldsig-more#sha384' | 'http://www.w3.org/2001/04/xmlenc#sha512'
signature_algorithm'http://www.w3.org/2000/09/xmldsig#rsa-sha1' | 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha256' | 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha384' | 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha512' | 'http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha1' | 'http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha256' | 'http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha384' | 'http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha512' | 'http://www.w3.org/2000/09/xmldsig#dsa-sha1'
signing_kpstring uuid nullable

Keypair used to sign outgoing Responses going to the Service Provider.

verification_kpstring uuid nullable

When selected, incoming assertion's Signatures will be validated against this certificate. To allow unsigned Requests, leave on default.

encryption_kpstring uuid nullable

When selected, incoming assertions are encrypted by the IdP using the public key of the encryption keypair. The assertion is decrypted by the SP using the the private key.

sign_assertionboolean
sign_responseboolean
sign_logout_requestboolean
sign_logout_responseboolean
sp_binding'redirect' | 'post'
sls_binding'redirect' | 'post'
logout_method'frontchannel_iframe' | 'frontchannel_native' | 'backchannel'
default_relay_statestring

Default relay_state value for IDP-initiated logins

default_name_id_policy'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress' | 'urn:oasis:names:tc:SAML:2.0:nameid-format:persistent' | 'urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName' | 'urn:oasis:names:tc:SAML:2.0:nameid-format:WindowsDomainQualifiedName' | 'urn:oasis:names:tc:SAML:2.0:nameid-format:transient' | 'urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified'

Response

pkinteger required
namestring required
authentication_flowstring uuid nullable

Flow used for authentication when the associated application is accessed by an un-authenticated user.

authorization_flowstring uuid required

Flow used when authorizing this provider.

invalidation_flowstring uuid required

Flow used ending the session from a provider.

property_mappingsstring[]
componentstring required

Get object component so that we know how to edit the object

assigned_application_slugstring nullable required

Internal application name, used in URLs.

assigned_application_namestring nullable required

Application's display Name.

assigned_backchannel_application_slugstring nullable required

Internal application name, used in URLs.

assigned_backchannel_application_namestring nullable required

Application's display Name.

verbose_namestring required

Return object's verbose_name

verbose_name_pluralstring required

Return object's plural verbose_name

meta_model_namestring required

Return internal model name

acs_urlstring uri required
sls_urlstring uri

Single Logout Service URL where the logout response should be sent.

audiencestring

Value of the audience restriction field of the assertion. When left empty, no audience restriction will be added.

issuer_overridestring

Also known as EntityID. Providing a value overrides the default issuer generated by authentik.

assertion_valid_not_beforestring

Assertion valid not before current time + this value (Format: hours=-1;minutes=-2;seconds=-3).

assertion_valid_not_on_or_afterstring

Assertion not valid on or after current time + this value (Format: hours=1;minutes=2;seconds=3).

session_valid_not_on_or_afterstring

Session not valid on or after current time + this value (Format: hours=1;minutes=2;seconds=3).

name_id_mappingstring uuid nullable

Configure how the NameID value will be created. When left empty, the NameIDPolicy of the incoming request will be considered

authn_context_class_ref_mappingstring uuid nullable

Configure how the AuthnContextClassRef value will be created. When left empty, the AuthnContextClassRef will be set based on which authentication methods the user used to authenticate.

digest_algorithm'http://www.w3.org/2000/09/xmldsig#sha1' | 'http://www.w3.org/2001/04/xmlenc#sha256' | 'http://www.w3.org/2001/04/xmldsig-more#sha384' | 'http://www.w3.org/2001/04/xmlenc#sha512'
signature_algorithm'http://www.w3.org/2000/09/xmldsig#rsa-sha1' | 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha256' | 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha384' | 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha512' | 'http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha1' | 'http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha256' | 'http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha384' | 'http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha512' | 'http://www.w3.org/2000/09/xmldsig#dsa-sha1'
signing_kpstring uuid nullable

Keypair used to sign outgoing Responses going to the Service Provider.

verification_kpstring uuid nullable

When selected, incoming assertion's Signatures will be validated against this certificate. To allow unsigned Requests, leave on default.

encryption_kpstring uuid nullable

When selected, incoming assertions are encrypted by the IdP using the public key of the encryption keypair. The assertion is decrypted by the SP using the the private key.

sign_assertionboolean
sign_responseboolean
sign_logout_requestboolean
sign_logout_responseboolean
sp_binding'redirect' | 'post'
sls_binding'redirect' | 'post'
logout_method'frontchannel_iframe' | 'frontchannel_native' | 'backchannel'
default_relay_statestring

Default relay_state value for IDP-initiated logins

default_name_id_policy'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress' | 'urn:oasis:names:tc:SAML:2.0:nameid-format:persistent' | 'urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName' | 'urn:oasis:names:tc:SAML:2.0:nameid-format:WindowsDomainQualifiedName' | 'urn:oasis:names:tc:SAML:2.0:nameid-format:transient' | 'urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified'
url_download_metadatastring required

Get metadata download URL

url_issuerstring required

Get Issuer/EntityID URL

url_unifiedstring required

Get unified SAML endpoint URL (handles SSO and SLO)

url_unified_initstring required

Get IdP-initiated SAML URL

url_sso_poststring required

Get SSO Post URL

url_sso_redirectstring required

Get SSO Redirect URL

url_sso_initstring required

Get SSO IDP-Initiated URL

url_slo_poststring required

Get SLO POST URL

url_slo_redirectstring required

Get SLO redirect URL

Changes

No recorded changes to this endpoint across all 1 revision of this API.