---
title: "Get a Saml plugin"
method: GET
path: "/plugins/{PluginId}#Saml"
tags: ["Plugins"]
---

# Get a Saml plugin

`GET /plugins/{PluginId}#Saml`

Get a Saml plugin

## Response `200`

Saml plugin

- SamlPlugin
  - `config` object — The configuration properties for the Plugin which can be found on the plugins documentation page in the [Kong Hub](https://docs.konghq.com/hub/).
    - `anonymous` string — An optional string (consumer UUID or username) value to use as an “anonymous” consumer. If not set, a Kong Consumer must exist for the SAML IdP user credentials, mapping the username format to the Kong Consumer username.
    - `assertion_consumer_path` string — A string representing a URL path, such as /path/to/resource. Must start with a forward slash (/) and must not contain empty segments (i.e., two consecutive forward slashes).
    - `idp_certificate` string — The public certificate provided by the IdP. This is used to validate responses from the IdP. Only include the contents of the certificate. Do not include the header (`BEGIN CERTIFICATE`) and footer (`END CERTIFICATE`) lines.
    - `idp_sso_url` string — A string representing a URL, such as https://example.com/path/to/resource?q=search.
    - `issuer` string — The unique identifier of the IdP application. Formatted as a URL containing information about the IdP so the SP can validate that the SAML assertions it receives are issued from the correct IdP.
    - `nameid_format` 'Unspecified' | 'EmailAddress' | 'Persistent' | 'Transient' — The requested `NameId` format. Options available are: - `Unspecified` - `EmailAddress` - `Persistent` - `Transient`
    - `request_digest_algorithm` 'SHA256' | 'SHA1' — The digest algorithm for Authn requests: - `SHA256` - `SHA1`
    - `request_signature_algorithm` 'SHA256' | 'SHA384' | 'SHA512' — The signature algorithm for signing Authn requests. Options available are: - `SHA256` - `SHA384` - `SHA512`
    - `request_signing_certificate` string — The certificate for signing requests.
    - `request_signing_key` string — The private key for signing requests. If this parameter is set, requests sent to the IdP are signed. The `request_signing_certificate` parameter must be set as well.
    - `response_digest_algorithm` 'SHA256' | 'SHA1' — The algorithm for verifying digest in SAML responses: - `SHA256` - `SHA1`
    - `response_encryption_key` string — The private encryption key required to decrypt encrypted assertions.
    - `response_signature_algorithm` 'SHA256' | 'SHA384' | 'SHA512' — The algorithm for validating signatures in SAML responses. Options available are: - `SHA256` - `SHA384` - `SHA512`
    - `session_absolute_timeout` number — The session cookie absolute timeout in seconds. Specifies how long the session can be used until it is no longer valid.
    - `session_audience` string — The session audience, for example "my-application"
    - `session_cookie_domain` string — The session cookie domain flag.
    - `session_cookie_http_only` boolean — Forbids JavaScript from accessing the cookie, for example, through the `Document.cookie` property.
    - `session_cookie_name` string — The session cookie name.
    - `session_cookie_path` string — A string representing a URL path, such as /path/to/resource. Must start with a forward slash (/) and must not contain empty segments (i.e., two consecutive forward slashes).
    - `session_cookie_same_site` 'Strict' | 'Lax' | 'None' | 'Default' — Controls whether a cookie is sent with cross-origin requests, providing some protection against cross-site request forgery attacks.
    - `session_cookie_secure` boolean — The cookie is only sent to the server when a request is made with the https:scheme (except on localhost), and therefore is more resistant to man-in-the-middle attacks.
    - `session_enforce_same_subject` boolean — When set to `true`, audiences are forced to share the same subject.
    - `session_hash_storage_key` boolean — When set to `true`, the storage key (session ID) is hashed for extra security. Hashing the storage key means it is impossible to decrypt data from the storage without a cookie.
    - `session_hash_subject` boolean — When set to `true`, the value of subject is hashed before being stored. Only applies when `session_store_metadata` is enabled.
    - `session_idling_timeout` number — The session cookie idle time in seconds.
    - `session_memcached_host` string — The memcached host.
    - `session_memcached_port` integer — An integer representing a port number between 0 and 65535, inclusive.
    - `session_memcached_prefix` string — The memcached session key prefix.
    - `session_memcached_socket` string — The memcached unix socket path.
    - `session_redis_cluster_max_redirections` integer — The Redis cluster maximum redirects.
    - `session_redis_cluster_nodes` object[] — The Redis cluster node host. Takes an array of host records, with either `ip` or `host`, and `port` values.
      - `ip` string — A string representing a host name, such as example.com.
      - `port` integer — An integer representing a port number between 0 and 65535, inclusive.
    - `session_redis_connect_timeout` integer — The Redis connection timeout in milliseconds.
    - `session_redis_host` string — The Redis host IP.
    - `session_redis_password` string — Password to use for Redis connection when the `redis` session storage is defined. If undefined, no auth commands are sent to Redis. This value is pulled from
    - `session_redis_port` integer — An integer representing a port number between 0 and 65535, inclusive.
    - `session_redis_prefix` string — The Redis session key prefix.
    - `session_redis_read_timeout` integer — The Redis read timeout in milliseconds.
    - `session_redis_send_timeout` integer — The Redis send timeout in milliseconds.
    - `session_redis_server_name` string — The SNI used for connecting to the Redis server.
    - `session_redis_socket` string — The Redis unix socket path.
    - `session_redis_ssl` boolean — Use SSL/TLS for the Redis connection.
    - `session_redis_ssl_verify` boolean — Verify the Redis server certificate.
    - `session_redis_username` string — Redis username if the `redis` session storage is defined and ACL authentication is desired.If undefined, ACL authentication will not be performed. This requires Redis v6.0.0+. The username **cannot** be set to `default`.
    - `session_remember` boolean — Enables or disables persistent sessions
    - `session_remember_absolute_timeout` number — Persistent session absolute timeout in seconds.
    - `session_remember_cookie_name` string — Persistent session cookie name
    - `session_remember_rolling_timeout` number — Persistent session rolling timeout in seconds.
    - `session_request_headers` string[]
    - `session_response_headers` string[]
    - `session_rolling_timeout` number — The session cookie absolute timeout in seconds. Specifies how long the session can be used until it is no longer valid.
    - `session_secret` string — The session secret. This must be a random string of 32 characters from the base64 alphabet (letters, numbers, `/`, `_` and `+`). It is used as the secret key for encrypting session data as well as state information that is sent to the IdP in the authentication exchange.
    - `session_storage` 'cookie' | 'memcache' | 'memcached' | 'redis' — The session storage for session data: - `cookie`: stores session data with the session cookie. The session cannot be invalidated or revoked without changing the session secret, but is stateless, and doesn't require a database. - `memcached`: stores session data in memcached - `redis`: stores session data in Redis
    - `session_store_metadata` boolean — Configures whether or not session metadata should be stored. This includes information about the active sessions for the `specific_audience` belonging to a specific subject.
    - `validate_assertion_signature` boolean — Enable signature validation for SAML responses.
  - `created_at` integer — Unix epoch when the resource was created.
  - `enabled` boolean — Whether the plugin is applied.
  - `id` string
  - `instance_name` string
  - `name` 'saml' — The name of the Plugin that's going to be added. Currently, the Plugin must be installed in every Kong instance separately.
  - `ordering` object
  - `protocols` string[] — A list of the request protocols that will trigger this plugin. The default value, as well as the possible values allowed on this field, may change depending on the plugin type. For example, plugins that only work in stream mode will only support `"tcp"` and `"tls"`.
  - `tags` string[] — An optional set of strings associated with the Plugin for grouping and filtering.
  - `updated_at` integer — Unix epoch when the resource was last updated.
  - `consumer` object — If set, the plugin will activate only for requests where the specified has been authenticated. (Note that some plugins can not be restricted to consumers this way.). Leave unset for the plugin to activate regardless of the authenticated Consumer.
    - `id` string
  - `consumer_group` object
    - `id` string
  - `route` object — If set, the plugin will only activate when receiving requests via the specified route. Leave unset for the plugin to activate regardless of the Route being used.
    - `id` string
  - `service` object — If set, the plugin will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the plugin to activate regardless of the Service being matched.
    - `id` string

## Other responses

- `401` — Unauthorized
- `404` — Resource does not exist

---

[API](https://skmtc.dev/kong/apis/kong-enterprise-admin-api.md) · [All operations](https://skmtc.dev/kong/apis/kong-enterprise-admin-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/kong/kong-enterprise-admin-api/revisions/bac13851c993/schema)