SAML

Phase 1 preview — pages render fixture data only; no changes are saved.
SAML is enabled. The saved configuration is complete. This is a preview: no sign-in uses it yet.

Identity provider

Enabled needs valid IdP metadata.
A metadata URL, or the pasted XML. It is validated when saved.
The assertion attribute holding the username. Blank uses the NameID. The user must already exist; none is created.

Behaviour

Redirects the login page to the identity provider. Add ?nosaml to the URL to reach the local form.
Signing out also ends the identity provider session.
key=value lines applied last, overriding anything (including security options). Values are never shown: they can carry key material. Enter new lines to replace them all. Currently set: security.requestedAuthnContext, strict.
Cancel Saving settings is not available in Phase 1 — this screen previews the current configuration.

Service provider details

Give these to the identity provider administrator.

Entity ID
https://assets.example.test
Assertion consumer service (ACS) URL
https://assets.example.test/saml/acs
Single logout service (SLS) URL
https://assets.example.test/saml/sls
Metadata URL
https://assets.example.test/saml/metadata
Service provider certificate
Present valid until 2033-03-14
Rollover certificate
None
Service provider private key
Configured never shown

Good to know

A service-provider key pair is generated automatically the first time settings are saved; there is no regenerate control.

Replayed assertions are rejected. People who don't match an existing active username can't sign in: SAML never creates users and maps no groups.