authentication_flowstring uuid nullable
Flow used for authentication when the associated application is accessed by an un-authenticated user.
authorization_flowstring uuid required
Flow used when authorizing this provider.
invalidation_flowstring uuid required
Flow used ending the session from a provider.
property_mappingsstring[]
componentstring required
Get object component so that we know how to edit the object
assigned_application_slugstring nullable required
Internal application name, used in URLs.
assigned_application_namestring nullable required
Application's display Name.
assigned_backchannel_application_slugstring nullable required
Internal application name, used in URLs.
assigned_backchannel_application_namestring nullable required
Application's display Name.
verbose_namestring required
Return object's verbose_name
verbose_name_pluralstring required
Return object's plural verbose_name
meta_model_namestring required
Return internal model name
acs_urlstring uri required
sls_urlstring uri
Single Logout Service URL where the logout response should be sent.
audiencestring
Value of the audience restriction field of the assertion. When left empty, no audience restriction will be added.
issuer_overridestring
Also known as EntityID. Providing a value overrides the default issuer generated by authentik.
assertion_valid_not_beforestring
Assertion valid not before current time + this value (Format: hours=-1;minutes=-2;seconds=-3).
assertion_valid_not_on_or_afterstring
Assertion not valid on or after current time + this value (Format: hours=1;minutes=2;seconds=3).
session_valid_not_on_or_afterstring
Session not valid on or after current time + this value (Format: hours=1;minutes=2;seconds=3).
name_id_mappingstring uuid nullable
Configure how the NameID value will be created. When left empty, the NameIDPolicy of the incoming request will be considered
authn_context_class_ref_mappingstring uuid nullable
Configure how the AuthnContextClassRef value will be created. When left empty, the AuthnContextClassRef will be set based on which authentication methods the user used to authenticate.
digest_algorithm'http://www.w3.org/2000/09/xmldsig#sha1' | 'http://www.w3.org/2001/04/xmlenc#sha256' | 'http://www.w3.org/2001/04/xmldsig-more#sha384' | 'http://www.w3.org/2001/04/xmlenc#sha512'
signature_algorithm'http://www.w3.org/2000/09/xmldsig#rsa-sha1' | 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha256' | 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha384' | 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha512' | 'http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha1' | 'http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha256' | 'http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha384' | 'http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha512' | 'http://www.w3.org/2000/09/xmldsig#dsa-sha1'
signing_kpstring uuid nullable
Keypair used to sign outgoing Responses going to the Service Provider.
verification_kpstring uuid nullable
When selected, incoming assertion's Signatures will be validated against this certificate. To allow unsigned Requests, leave on default.
encryption_kpstring uuid nullable
When selected, incoming assertions are encrypted by the IdP using the public key of the encryption keypair. The assertion is decrypted by the SP using the the private key.
sign_logout_requestboolean
sign_logout_responseboolean
sp_binding'redirect' | 'post'
sls_binding'redirect' | 'post'
logout_method'frontchannel_iframe' | 'frontchannel_native' | 'backchannel'
default_relay_statestring
Default relay_state value for IDP-initiated logins
default_name_id_policy'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress' | 'urn:oasis:names:tc:SAML:2.0:nameid-format:persistent' | 'urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName' | 'urn:oasis:names:tc:SAML:2.0:nameid-format:WindowsDomainQualifiedName' | 'urn:oasis:names:tc:SAML:2.0:nameid-format:transient' | 'urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified'
url_download_metadatastring required
Get metadata download URL
url_issuerstring required
url_unifiedstring required
Get unified SAML endpoint URL (handles SSO and SLO)
url_unified_initstring required
Get IdP-initiated SAML URL
url_sso_poststring required
url_sso_redirectstring required
url_sso_initstring required
Get SSO IDP-Initiated URL
url_slo_poststring required
url_slo_redirectstring required