> For the complete documentation index, see [llms.txt](https://docs.fortifiedid.se/access/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.fortifiedid.se/access/key-components/modules/saml/saml-profile.md).

# SAML profile

This section explains how to add and configure an SAML profile.

If you have multiple SAML applications that should have the same configuration, you can configure them to use a **SAML SP profile**.

Note, there are some properties that **cannot** be configured in a SAML profile and must be configured directly on the SAML SP application. These properties are **url** and **path**.

{% hint style="info" %}
Settings for a SAML application can come from settings on the application itself, a profile, or on the IdP object.\
1\. If a profile is configured, the properties of the profile object will override everything else.\
2\. If a profile is not configured, the application settings will apply.\
3\. If nothing is configured on the application, the IdP settings will be used.\
Important! Settings are not merged but applied as a single source of truth.

The `assertion_config` object can be configured directly on the SAML application/trust or on a SAML profile. When a profile is configured on the application, the profile version of `assertion_config` becomes the active configuration.
{% endhint %}

Set `assertion_config.force_re_auth` to `true` to require a new authentication for every SAML application using the profile. The selected profile replaces the application-level `assertion_config`, but re-authentication requirements from the incoming AuthnRequest or SAML IdP are still combined using OR semantics and cannot be disabled by setting the profile value to `false`.

***

Below are the properties that can be configured for a SAML profile.

{% tabs %}
{% tab title="Properties" %}

<table data-full-width="true"><thead><tr><th>Name</th><th>Description</th><th>Default value</th><th data-type="checkbox">Mandatory</th></tr></thead><tbody><tr><td>name</td><td>Used</td><td>N/A</td><td>true</td></tr><tr><td><code>assertion_pre_pipe</code></td><td>Overrides IDP default pre-pipe empty means NO pipe. IDP pipe is not used as fallback.</td><td>N/A</td><td>false</td></tr><tr><td><code>authorization</code></td><td>Optional app-specific authorization configuration. Use this to run an authorization pipe before the SAML response is issued. See the <code>App-specific authorization</code> section below for details.</td><td>N/A</td><td>false</td></tr><tr><td><code>belongs_to_idp</code></td><td>entity id of allowed IDP. Only use if configuring multiple IDP's</td><td>N/A</td><td>false</td></tr><tr><td><code>require_signed_auth_requests</code></td><td>If set, will only accept signed autn requests.</td><td>false</td><td>false</td></tr><tr><td><code>signature_algorithm</code></td><td>Algorithm used for signing.</td><td>ttp://www.w3.org/2001/04/xmldsig-more#rsa-sha256</td><td>false</td></tr><tr><td><code>digest_algorithm</code></td><td>Algorithm used for digest calculation.</td><td><a href="http://www.w3.org/2001/04/xmlenc#sha256">http://www.w3.org/2001/04/xmlenc#sha256</a></td><td>false</td></tr><tr><td><code>app_tag</code></td><td>JsonArray containing strings used for filtering and similar operations.</td><td>N/A</td><td>false</td></tr><tr><td><code>assertion_config</code></td><td>Parent holder for assertion configuration.</td><td>{}</td><td>false</td></tr><tr><td><code>assertion_config.force_re_auth</code></td><td>Require a new authentication for every SAML application using this profile. This value cannot disable an incoming <code>ForceAuthn=true</code> or a global/SP-specific IdP requirement.</td><td><code>false</code></td><td>false</td></tr><tr><td><code>assertion_config.encrypt</code></td><td>Whether the assertion should be encrypted. Requires encryption certificate in SP meta data</td><td>false</td><td>false</td></tr><tr><td><code>assertion_config.encryption_algorithm</code></td><td>Optional XML Encryption data encryption algorithm for encrypted assertions. If omitted, Access first uses a compatible <code>EncryptionMethod</code> from SP metadata when present, otherwise the built-in default is used. Use <code>http://www.w3.org/2001/04/xmlenc#aes256-cbc</code> when an SP requires AES-256-CBC.</td><td>N/A</td><td>false</td></tr><tr><td><code>assertion_config.include_session_information</code></td><td>Include session information in the assertion (trace id).</td><td>true</td><td>false</td></tr><tr><td><code>assertion_config.include_session_not_on_or_after</code></td><td>Include the SessionNotOnOrAfter attribute.</td><td>false</td><td>false</td></tr><tr><td><code>assertion_config.include_remote_address</code></td><td>Include the client’s IP address.</td><td>false</td><td>false</td></tr><tr><td><code>assertion_config.include_attribute_value_type</code></td><td>Include explicit XML Schema typing (<code>xsi:type</code>) on SAML <code>AttributeValue</code> elements. Set to <code>false</code> for service providers that require untyped attribute values.</td><td>true</td><td>false</td></tr><tr><td><code>assertion_config.sign_assertion</code></td><td>Whether the assertion itself should be signed.</td><td>true</td><td>false</td></tr><tr><td><code>assertion_config.sign_response</code></td><td>Whether the full response should be signed.</td><td>true</td><td>false</td></tr><tr><td><code>assertion_config.session_not_on_or_after_minutes</code></td><td>Session expiration time in minutes.</td><td>60</td><td>false</td></tr><tr><td><code>assertion_config.assertion_valid_for_no_of_minutes</code></td><td>Assertion validity period in minutes.</td><td>2</td><td>false</td></tr><tr><td><code>assertion_config.name_id</code></td><td>Configuration of the NameID element.</td><td>{}</td><td>false</td></tr><tr><td><code>assertion_config.name_id.format</code></td><td>NameID format</td><td>urn:oasis:names:tc:SAML:1.1:nameid-format:transient</td><td>false</td></tr><tr><td><code>assertion_config.name_id.from_parameter</code></td><td>State parameter containing value of Name ID</td><td>nameID</td><td>false</td></tr><tr><td><pre><code>assertion_config.name_id.include_sp_name_qualifier
</code></pre></td><td>Whether to include SPNameQualifier.</td><td>false</td><td>false</td></tr><tr><td><pre><code>assertion_config.name_id.include_name_qualifier
</code></pre></td><td>Whether to include NameQualifier.</td><td>false</td><td>false</td></tr><tr><td><code>assertion_config.attributes</code></td><td>Each entry in attributes describes one attribute in the assertion</td><td>N/A</td><td>false</td></tr><tr><td></td><td></td><td></td><td>false</td></tr><tr><td><code>assertion_config.attributes.name</code></td><td>Attribute name (URN or custom identifier).</td><td>N/A</td><td>true</td></tr><tr><td><code>assertion_config.attributes.value</code></td><td>Name of the state attribute holding the value.</td><td>N/A</td><td>true</td></tr><tr><td><code>assertion_config.attributes.name_format</code></td><td>Attribute name format, usually unspecified.</td><td>urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified</td><td>false</td></tr><tr><td><code>assertion_config.attributes.friendly_name</code></td><td>Human-readable (friendlyName) alias.</td><td>N/A</td><td>false</td></tr><tr><td><code>assertion_config.attributes.friendly_name.required</code></td><td>Indicates if the attribute is required. If true value may be empty</td><td>false</td><td>false</td></tr><tr><td><code>assertion_config.attributes.include_if_empty</code></td><td>Include the attribute even if the source value is missing value</td><td>false</td><td>false</td></tr></tbody></table>
{% endtab %}

{% tab title="Example" %}

```json
{
    "name": "saml_profile_1",
    "display_name": "Example SAML Application Profile",
    "description": "Sample configuration for returning a SAML response",
    "assertion_pre_pipe": "validateUserAttributes",
    "belongs_to_idp": "https://idp.example.com",
    "signature_algorithm": "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256",
    "digest_algorithm": "http://www.w3.org/2001/04/xmlenc#sha256",
    "app_tag":["tag1","tag2"],
    "static_audience": "https://audience.example.com",
    "assertion_config": {
        "force_re_auth": true,
        "encrypt": true,
        "encryption_algorithm": "http://www.w3.org/2001/04/xmlenc#aes256-cbc",
        "name_id": {
            "format": "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress",
            "from_parameter": "userPrincipalName",
            "include_sp_name_qualifier": true,
            "include_name_qualifier": false
        },
        "include_session_information": true,
        "include_session_not_on_or_after": true,
        "include_remote_address": false,
        "include_attribute_value_type": true,
        "sign_assertion": true,
        "sign_response": true,
        "session_not_on_or_after_minutes": 120,
        "assertion_valid_for_no_of_minutes": 5,
        "attributes": [
            {
                "name": "givenName",
                "value": "first_name",
                "name_format": "urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified",
                "friendly_name": "First Name",
                "required": false
            },
            {
                "name": "sn",
                "value": "last_name",
                "name_format": "urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified",
                "friendly_name": "Last Name",
                "required": true
            },
            {
                "name": "mail",
                "value": "e-mail",
                "name_format": "urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified",
                "friendly_name": "Email"
            }
        ]
    }
}
```

{% endtab %}
{% endtabs %}

## App-specific authorization

You can configure app-specific authorization on the SAML profile. When a SAML application uses a profile, the profile configuration becomes the active source of truth, including the authorization settings.

If the authorization pipe succeeds, Access continues the flow as normal.

If the authorization pipe fails, Access can:

* redirect the user to a configured failure location
* redirect the user to a specific target based on the pipe failure message
* fall back to the standard SAML deny handling

{% tabs %}
{% tab title="Properties" %}

<table data-full-width="true"><thead><tr><th>Name</th><th>Description</th><th data-type="checkbox">Mandatory</th></tr></thead><tbody><tr><td><code>pipe_id</code></td><td>Pipe used to evaluate whether the authenticated user is authorized for applications using this SAML profile. If the <code>authorization</code> object is present, this property is required.</td><td>true</td></tr><tr><td><code>fail_location</code></td><td>Fallback redirect target used when authorization fails and no <code>failed_redirect</code> entry matches the failure message.</td><td>false</td></tr><tr><td><code>failed_redirect</code></td><td>Array of pattern-based redirects. Each entry contains <code>pattern</code> and <code>target</code>. The first matching pattern is used.</td><td>false</td></tr></tbody></table>
{% endtab %}

{% tab title="Example" %}

```json
"authorization": {
    "pipe_id": "check_profile_authorization",
    "fail_location": "/login/no-access",
    "failed_redirect": [
        {
            "pattern": ".*missing_role.*",
            "target": "/login/missing-role"
        },
        {
            "pattern": ".*expired_contract.*",
            "target": "/login/contact-admin"
        }
    ]
}
```

{% endtab %}
{% endtabs %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.fortifiedid.se/access/key-components/modules/saml/saml-profile.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.