Access applications
Configuration behavior for Access SAML and OIDC applications in Management Center
Management Center provides guided configuration for SAML and OIDC applications managed by Access. This page describes defaults, inheritance, validation, and the machine-to-machine setup flow.
SAML application and profile defaults
Section titled “SAML application and profile defaults”New SAML SP applications and SAML Profiles store only settings that are required or explicitly selected. Optional assertion, NameID, description, and similar settings are not silently added by the form.
This keeps newly created objects predictable and avoids enabling behavior such as assertion encryption unless the administrator selects it.
AttributeValue type information
Section titled “AttributeValue type information”Both SAML Application and SAML Profile assertion settings include Include attribute value type (xsi:type). The setting maps to include_attribute_value_type.
Enabled, which is the default, includes explicit XML Schema type information on SAML AttributeValue elements.
Disabled emits untyped AttributeValue elements for service providers that require that format.
Existing configurations that do not set the property retain the enabled default.
App tags
Section titled “App tags”When editing app tags, Management Center suggests tags already used by other applications and profiles. An administrator can select an existing tag or enter a new one.
SAML Profile inheritance
Section titled “SAML Profile inheritance”When a SAML Application uses a SAML Profile, the App tag field shows whether its effective value is inherited or overridden:
Inherited shows the profile's tags as read-only values.
Override stores editable app tags on the application and gives them precedence over the profile.
Enable Use own app tags to start an override. The application is initially seeded with the profile tags so they can be adjusted. Disable the switch to remove the application value and return to profile inheritance.
OIDC claims from the selected provider
Section titled “OIDC claims from the selected provider”Claim choices on an OIDC RP are based on the scopes and claims exposed by the selected OP. The rule applies separately to ID token, access token, and UserInfo claims.
If an existing RP refers to claims that the selected OP no longer exposes, Management Center keeps them visible, marks them as unavailable, and reports all affected token sections when validation fails. Update the OP definition or remove the unsupported RP claims before saving.
OIDC machine-to-machine setup
Section titled “OIDC machine-to-machine setup”Select the OIDC machine-to-machine or client-credentials provider type when creating an OIDC provider to configure a client_credentials flow. The guide:
Create the relying party
Section titled “Create the relying party”Creates the relying party and generated client credentials.
Link the managed pipe
Section titled “Link the managed pipe”Creates and links a managed client_credentials pipe.
Update discovery metadata
Section titled “Update discovery metadata”Adds client_credentials to the provider discovery metadata.
Select the token type
Section titled “Select the token type”Lets the administrator choose a JWT or opaque access token.
Removing the guided relying party also removes its managed client-credentials pipe.
Default Access listener
Section titled “Default Access listener”On a fresh installation, the Access Default listener is created with fingerprint.enabled set to false. Fingerprinting remains available and can be enabled explicitly on a listener when the connected clients support it.