SAML profile

If you have multiple SAML applications that should have the same configuration, you can configure them to use a SAML SP profile.

Note, there are some properties that cannot be configured in a SAML profile and must be configured directly on the SAML SP application. These properties are url and path.

Note

When an application selects a profile, the profile's assertion_config replaces the application's assertion object. This does not replace the IdP's SP allowlist or all IdP-side settings. For example, send_failed_response remains controlled by the selected IdP entry, and re-authentication requirements are combined as described below.

See SAML application for the difference between an omitted assertion object and {}, and SAML IdP for trust when the IdP list is omitted or empty. In that mode, send_failed_response defaults to false.

Set assertion_config.force_re_auth to true to require a new authentication for every SAML application using the profile. The selected profile replaces the application-level assertion_config, but re-authentication requirements from the incoming AuthnRequest or SAML IdP are still combined using OR semantics and cannot be disabled by setting the profile value to false.

---

Below are the properties that can be configured for a SAML profile.

Properties

Name	Description	Default value	Mandatory
name	Used	N/A	true
assertion_pre_pipe	Overrides IDP default pre-pipe empty means NO pipe. IDP pipe is not used as fallback.	N/A	false
authorization	Optional app-specific authorization configuration. Use this to run an authorization pipe before the SAML response is issued. See the App-specific authorization section below for details.	N/A	false
belongs_to_idp	entity id of allowed IDP. Only use if configuring multiple IDP's	N/A	false
require_signed_auth_requests	If set, will only accept signed autn requests.	false	false
signature_algorithm	Algorithm used for signing.	ttp://www.w3.org/2001/04/xmldsig-more#rsa-sha256	false
digest_algorithm	Algorithm used for digest calculation.	http://www.w3.org/2001/04/xmlenc#sha256	false
app_tag	JsonArray containing strings used for filtering and similar operations.	N/A	false
assertion_config	Optional assertion settings object. Omission does not create an empty object; explicit {} selects profile assertion defaults. See Assertion configuration and IdP settings.	N/A (omitted)	false
assertion_config.force_re_auth	Require a new authentication for every SAML application using this profile. This value cannot disable an incoming ForceAuthn=true or a global/SP-specific IdP requirement.	false	false
assertion_config.encrypt	Whether the assertion should be encrypted. Requires encryption certificate in SP meta data	false	false
assertion_config.encryption_algorithm	Optional XML Encryption data encryption algorithm for encrypted assertions. If omitted, Access first uses a compatible EncryptionMethod from SP metadata when present, otherwise the built-in default is used. Use http://www.w3.org/2001/04/xmlenc#aes256-cbc when an SP requires AES-256-CBC.	N/A	false
assertion_config.include_session_information	Include session information in the assertion (trace id).	true	false
assertion_config.include_session_not_on_or_after	Include the SessionNotOnOrAfter attribute.	false	false
assertion_config.include_remote_address	Include the client’s IP address.	false	false
assertion_config.include_attribute_value_type	Include explicit XML Schema typing (xsi:type) on SAML AttributeValue elements. Set to false for service providers that require untyped attribute values.	true	false
assertion_config.sign_assertion	Whether the assertion itself should be signed.	true	false
assertion_config.sign_response	Whether the full response should be signed.	true	false
assertion_config.session_not_on_or_after_minutes	Session expiration time in minutes.	60	false
assertion_config.assertion_valid_for_no_of_minutes	Assertion validity period in minutes.	2	false
assertion_config.name_id	Configuration of the NameID element.	{}	false
assertion_config.name_id.format	NameID format	urn:oasis:names:tc:SAML:1.1:nameid-format:transient	false
assertion_config.name_id.from_parameter	State parameter containing value of Name ID	nameID	false
assertion_config.name_id.include_sp_name_qualifier	Whether to include SPNameQualifier.	false	false
assertion_config.name_id.include_name_qualifier	Whether to include NameQualifier.	false	false
assertion_config.attributes	Each entry in attributes describes one attribute in the assertion	N/A	false
			false
assertion_config.attributes.name	Attribute name (URN or custom identifier).	N/A	true
assertion_config.attributes.value	Name of the state attribute holding the value.	N/A	true
assertion_config.attributes.name_format	Format of the SAML attribute name.	urn:oasis:names:tc:SAML:2.0:attrname-format:uri	false
assertion_config.attributes.friendly_name	Human-readable (friendlyName) alias.	N/A	false
assertion_config.attributes.friendly_name.required	Indicates if the attribute is required. If true value may be empty	false	false
assertion_config.attributes.include_if_empty	Include the attribute even if the source value is missing value	false	false

When name_format is omitted from an attribute's JSON configuration, Access uses urn:oasis:names:tc:SAML:2.0:attrname-format:uri. To use unspecified, set name_format explicitly to urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified, as in the example below. The SAML rule for an omitted XML NameFormat treats that XML attribute as unspecified; it does not define the default for Access's JSON setting.

Example

{
    "name": "saml_profile_1",
    "display_name": "Example SAML Application Profile",
    "description": "Sample configuration for returning a SAML response",
    "assertion_pre_pipe": "validateUserAttributes",
    "belongs_to_idp": "https://idp.example.com",
    "signature_algorithm": "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256",
    "digest_algorithm": "http://www.w3.org/2001/04/xmlenc#sha256",
    "app_tag":["tag1","tag2"],
    "static_audience": "https://audience.example.com",
    "assertion_config": {
        "force_re_auth": true,
        "encrypt": true,
        "encryption_algorithm": "http://www.w3.org/2001/04/xmlenc#aes256-cbc",
        "name_id": {
            "format": "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress",
            "from_parameter": "userPrincipalName",
            "include_sp_name_qualifier": true,
            "include_name_qualifier": false
        },
        "include_session_information": true,
        "include_session_not_on_or_after": true,
        "include_remote_address": false,
        "include_attribute_value_type": true,
        "sign_assertion": true,
        "sign_response": true,
        "session_not_on_or_after_minutes": 120,
        "assertion_valid_for_no_of_minutes": 5,
        "attributes": [
            {
                "name": "givenName",
                "value": "first_name",
                "name_format": "urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified",
                "friendly_name": "First Name",
                "required": false
            },
            {
                "name": "sn",
                "value": "last_name",
                "name_format": "urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified",
                "friendly_name": "Last Name",
                "required": true
            },
            {
                "name": "mail",
                "value": "e-mail",
                "name_format": "urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified",
                "friendly_name": "Email"
            }
        ]
    }
}

App-specific authorization

You can configure app-specific authorization on the SAML profile. When a SAML application uses a profile, the profile configuration becomes the active source of truth, including the authorization settings.

If the authorization pipe succeeds, Access continues the flow as normal.

If the authorization pipe fails, Access can:

• redirect the user to a configured failure location
• redirect the user to a specific target based on the pipe failure message
• fall back to the standard SAML deny handling

Properties

Name	Description	Mandatory
pipe_id	Pipe used to evaluate whether the authenticated user is authorized for applications using this SAML profile. If the authorization object is present, this property is required.	true
fail_location	Fallback redirect target used when authorization fails and no failed_redirect entry matches the failure message.	false
failed_redirect	Array of pattern-based redirects. Each entry contains pattern and target. The first matching pattern is used.	false

Example

"authorization": {
    "pipe_id": "check_profile_authorization",
    "fail_location": "/login/no-access",
    "failed_redirect": [
        {
            "pattern": ".*missing_role.*",
            "target": "/login/missing-role"
        },
        {
            "pattern": ".*expired_contract.*",
            "target": "/login/contact-admin"
        }
    ]
}