> For the complete documentation index, see [llms.txt](https://docs.fortifiedid.se/access/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.fortifiedid.se/access/key-components/authenticators/protocol-managers/saml/saml-idp.md).

# SAML IdP

Configuration reference for the SAML identity provider authenticator in Fortified ID Access

To learn more about how Fortified ID Access supports SAML, please click [LINK](/access/key-components/modules/saml.md).

## Overview

**Fortified ID Access can acts as a SAML 2 Identity provider (IdP).** This is the first point of contact for a SAML SP. No identification is done by the SAML IdP, that is done by [credential validators](/access/key-components/authenticators/credential-validators.md) associated with the SAML IdP.

## Configuration

{% hint style="info" %}
**Authenticator type:** `SAMLIDP`
{% endhint %}

Common Authenticator configuration can be found [here](/access/key-components/authenticators/common-configuration.md).

Re-authentication is required when the incoming AuthnRequest has `ForceAuthn=true`, when the authenticator-level `force_re_auth` property is `true`, when `force_re_auth` is `true` in the IdP assertion configuration selected for the calling SP, or when the active [SAML application](/access/key-components/modules/saml/saml-application.md) or [SAML profile](/access/key-components/modules/saml/saml-profile.md) requires it. These settings use OR semantics, so a value of `false` cannot disable a requirement from another source. An exact IdP `target_sp` match takes precedence over the `"*"` wildcard configuration.

{% tabs %}
{% tab title="Properties" %}

<table data-full-width="true"><thead><tr><th>Name</th><th>Description</th><th>Default value</th><th data-type="checkbox">Mandatory</th></tr></thead><tbody><tr><td><code>force_re_auth</code></td><td>Require re-authentication for every SP handled by this IdP. An incoming <code>ForceAuthn=true</code> or an SP-specific requirement still applies when this property is <code>false</code>.</td><td><code>false</code></td><td>false</td></tr><tr><td><code>idp</code></td><td>Value of the entity id when issuing the assertion.</td><td>N/A</td><td>true</td></tr><tr><td><code>assertion_config</code></td><td>Section for when issuing assertion. Customized for one or more SP's. Assertion configuration may also be configured directly on the <a href="/access/key-components/modules/saml/saml-application.md">SAML app.</a> object.</td><td>N/A</td><td>true</td></tr><tr><td><code>unsolicited_target_sp</code></td><td>Entity id of SP used for unsolicited authentication.</td><td>N/A</td><td>false</td></tr></tbody></table>
{% endtab %}

{% tab title="Example" %}

```json
{
"id": "auth00",
"type": "SAMLIDP",
"config": {
    "context_path": "/test/authn/chain",
    "base_path": "/test/authn",
    "force_re_auth": false,
    "idp": "aandrenidp",
    "chain": [{
        "id": "auth01",
        "required": true
    }],
    "assertion_config": [{
        "target_sp": ["https://sp.example.org/shibboleth"],
        "force_re_auth": true,
        "pre_assertion_pipe": "auhtZPipe",
        "encrypt_assertion": true,
        "encryption_algorithm": "http://www.w3.org/2001/04/xmlenc#aes256-cbc",
        "sign_response": false,
        "sign_assertion": true,
        "send_failed_response": false,
        "name_id_format": "urn:oasis:names:tc:SAML:2.0:nameid-format:transient",
        "nameid_parameter": "givenName",
        "additional_attribute_parameter": ["givenName", "sn", "objectClass"],
        "auth_context_parameter": "AuthnContextClassRef"
    }, {
        "target_sp": ["*"],
        "force_re_auth": false
    }]
}
}
```

{% endtab %}
{% endtabs %}

### Assertion Configuration

{% tabs %}
{% tab title="Properties" %}

<table data-full-width="true"><thead><tr><th>Name</th><th>Description</th><th>Default value</th><th data-type="checkbox">Mandatory</th></tr></thead><tbody><tr><td><code>target_sp</code></td><td>Must include at least one SP entity id. The id must be loaded and known to the system. Use <code>"*"</code> to catch all SP entity ID's.</td><td>N/A</td><td>true</td></tr><tr><td><code>force_re_auth</code></td><td>Require re-authentication for SPs matched by this assertion configuration. An exact <code>target_sp</code> match takes precedence over the wildcard configuration. This value cannot disable global <code>force_re_auth</code> or incoming <code>ForceAuthn=true</code>.</td><td><code>false</code></td><td>false</td></tr><tr><td><code>pre_assertion_pipe</code></td><td>ID of pipe to execute before issuing assertion. Not required.</td><td>N/A</td><td>false</td></tr><tr><td><code>sign_response</code></td><td>Should SAML assertion be signed. Signing is performed using <a href="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256">http://www.w3.org/2001/04/xmldsig-more#rsa-sha256</a></td><td><code>true</code></td><td>false</td></tr><tr><td><code>sign_assertion</code></td><td>Should SAML assertion be signed. Signing is performed using <a href="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256">http://www.w3.org/2001/04/xmldsig-more#rsa-sha256</a></td><td><code>false</code></td><td>false</td></tr><tr><td><code>encrypt_assertion</code></td><td>Should assertion be encrypted. Requires encryption certificate in SP metadata.</td><td><code>false</code></td><td>false</td></tr><tr><td><code>encryption_algorithm</code></td><td>Optional XML Encryption data encryption algorithm for encrypted assertions. If omitted, Access first uses a compatible <code>EncryptionMethod</code> from SP metadata when present, otherwise the built-in default is used. Use <code>http://www.w3.org/2001/04/xmlenc#aes256-cbc</code> when an SP requires AES-256-CBC.</td><td>N/A</td><td>false</td></tr><tr><td><code>nameid_parameter</code></td><td>Attribute where value of nameID is located.</td><td>N/A</td><td>false</td></tr><tr><td><code>name_id_format</code></td><td>Format of nameID attribute.</td><td><code>"urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"</code></td><td>false</td></tr><tr><td><code>additional_attribute_parameter</code></td><td>List of parameter names where additional attributes is located.</td><td>N/A</td><td>false</td></tr><tr><td><code>auth_context_parameter</code></td><td>Attribute where value of auth context ref is located.</td><td><code>"AuthnContextClassRef"</code></td><td>false</td></tr><tr><td><code>hokap_parameter</code></td><td>Attribute where value of certificate is located. PEM format is expected. The public key is extracted from the certificate and added to the KeyValue element in the assertion. Only RSA public keys are supported.</td><td>N/A</td><td>false</td></tr><tr><td><code>send_failed_response</code></td><td>If pipe fails should a SAML response be sent back to the sp.</td><td><code>false</code></td><td>false</td></tr><tr><td><code>custom_identifier</code></td><td>Identifier used in event logging to differentiate event logg entries.</td><td>N/A</td><td>false</td></tr></tbody></table>
{% endtab %}

{% tab title="Example" %}

```json
"assertion_config": [{
    "target_sp": ["https://sp.example.org/shibboleth"],
    "force_re_auth": true
}, {
    "target_sp": ["*"],
    "force_re_auth": false
}]
```

{% endtab %}
{% endtabs %}

## Logging

On authentication request event is logged containing following:

* WEB\_100103("Received authentication request")
* IDENTIFIER (user traceid)
* AUTHENTICATOR\_ID (config id + display\_name if present)
* SOURCE\_SERVICE\_NAME (entity id calling SAML SP)
* SOURCE\_ADDRESS (user IP address)
* CUSTOMER\_IDENTIFIER (if configured)

On a successful authentication event is logged containing following:

* WEB\_100101
* IDENTIFIER (user traceid)
* AUTHENTICATOR\_ID (config id + display\_name if present)
* SOURCE\_SERVICE\_NAME (entity id of target SAML SP)
* SOURCE\_ADDRESS (user IP address)
* CUSTOMER\_IDENTIFIER (if configured)

On a failed authentication event is logged containing following:

* WEB\_100102
* IDENTIFIER (user traceid)
* AUTHENTICATOR\_ID (config id + display\_name if present)
* SOURCE\_SERVICE\_NAME (entity id of target SAML SP)
* SOURCE\_ADDRESS (user IP address)
* CUSTOMER\_IDENTIFIER (if configured)

## SLO - Single logout

By default saml slo endpoints are added to the metadata template. Both POST & Redirect bindings are supported and will be injected into the metadata when requested.

<mark style="color:red;">**Currently, only POST binding is supported for outbound request/reponse.**</mark>

## Data sent to PIPE

All data put into the shared authentication state along with the HTTP headers are exposed and sent into the pipe.

Data put into the state by this authenticator is:

* SAMLRequest - mainly for internal use
* requestedAuthnContextClassRefs - Multi value property of the "RequestedAuthnContext" -> "AuthnContextClassRef" if any.
* spEntityID - entityID of the "calling" SP .
* A subset of the sent request-headers from user-Agent.
* All data returned from the assertion pipe

## Expected data from PIPE

In order to use data from PIPE the response must contain one item. All data from that item will be available when creating SAML assertion.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.fortifiedid.se/access/key-components/authenticators/protocol-managers/saml/saml-idp.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.