---
title: 'Tutorial: Manage the SAML Authentication Method from the Command-line Interface'
canonical: https://openvpn.net/as-docs/tutorials/tutorial--saml-command-line/
product: Access Server Docs
description: Configure SAML authentication in OpenVPN Access Server using the CLI. Learn how to use IdP metadata or manual settings, enable SMAL, and verify your configuration.
---

# Tutorial: Manage the SAML Authentication Method from the Command-line Interface

## Overview

This tutorial shows how to configure SAML authentication in Access Server using the command-line interface (CLI).

With SAML, users sign in through an external identity provider (IdP), such as Entra ID, Okta, or Google Workspace.

You can configure SAML in two ways:

- **Recommended:** Use IdP metadata (simpler and faster).
- **Manual:** Define each setting individually.

## Prerequisites

- Root privileges on your Access Server's console.
- A configured SAML IdP.
- IdP metadata file or URL (recommended), or manual configuration details.

## Step 1: Set authentication mode to SAML

1. Connect to the console and get root privileges.
2. Set the authentication mode to SAML:

   ```
   sacli --key "auth.module.type" --value "saml" ConfigPut
   sacli start
   ```

## Step 2: Configure SAML using IdP metadata (recommended)

Use one of the following methods:

### Option A: Use metadata file

1. Specify the IdP metadata file:

   ```
   sacli --value_file="<PATH_TO_FILE_NAME>" SamlConfigureFromMetadata
   ```

   The `<PATH_TO_FILE_NAME>` needs to be a full path like **"/root/idp-metadata.xml"**.

   > **Tip**
   >
   > Using metadata automatically configures the entity ID, endpoints, and certificate.

### Option B: Use metadata URL

1. Specify the IdP metadata URL:

   ```
   sacli --url="<IDP_METADATA_URL>" SamlConfigureFromMetadata
   ```

> **Tip**
>
> Using metadata automatically configures the entity ID, endpoints, and certificate.

## Step 3: (Alternative) Configure SAML manually

Use this method only if metadata isn't available.

1. Define the IdP entity ID:

   ```
   sacli --key "auth.saml.0.idp_entityid" --value <IDP ENTITY ID> ConfigPut
   ```
2. Define the IdP sign-on endpoint:

   ```
   sacli --key "auth.saml.0.idp_signon_endpoint" --value <IDP SIGNON ENDPOINT> ConfigPut
   ```
3. Define the IdP certificate:

   ```
   sacli --key "auth.saml.0.idp_cert" --value_file "<PATH_TO_FILE_NAME>" ConfigPut
   ```

   The `<PATH_TO_FILE_NAME>` needs to be a full path like **"/root/idp-cert.pem"**.

## Step 5: Enable SAML authentication and apply the configuration

1. Enable SAML authentication:

   ```
   sacli --key "auth.saml.0.enable" --value "true" ConfigPut
   ```
2. Apply the configuration:

   ```
   sacli start
   ```

## Step 6: Verify SAML authentication

1. Open the Client Web UI.
2. Attempt to sign in.
3. Confirm:
   - You're redirected to your IdP.
   - Authentication completes successfully.
   - You're redirected back to the Client Web UI.

   > **Tip**
   >
   > If authentication fails, check `/var/log/openvpnas.log` for SAML-related messages.

## Optional configuration commands

These settings aren't required for most deployments.

- Enable sending ForceAuthn (default is false):

  ```
  sacli --key "auth.saml.0.forceauthn" --value "true" ConfigPut
  ```
- Enable sending AuthnContexts (default is true):

  ```
  sacli --key "auth.saml.0.requestauthncontext" --value "true" ConfigPut
  ```
- Define AuthnContexts to be included in the AuthNRequest (default is PasswordProtectedTransport):

  ```
  sacli --key "auth.saml.0.authncontexts" --value "PasswordProtectedTransport" ConfigPut
  ```

  - To add multiple values, use space-separated values. Example:

    ```
    sacli --key "auth.saml.0.authncontexts" --value "PasswordProtectedTransport X509" ConfigPut
    ```
- Set the SAML timeout in seconds (default is 180):

  ```
  sacli --key "auth.saml.0.timeout" --value "180" ConfigPut
  ```
- Specify the IdP log-out endpoint:

  ```
  sacli --key "auth.saml.0.idp_logout_endpoint" --value <IDP LOGOUT ENDPOINT> ConfigPut
  ```

## Related tutorials

- [Tutorial: How to Configure SAML with Entra ID](https://openvpn.net/as-docs/tutorials/saml-entra-id.md)
- [Tutorial: How to Configure SAML with Google Workspace](https://openvpn.net/as-docs/tutorials/saml-google-workspace.md)
- [Tutorial: How to Configure SAML with OneLogin](https://openvpn.net/as-docs/tutorials/saml-onelogin.md)
- [Tutorial: How to Configure SAML with Keycloak](https://openvpn.net/as-docs/tutorials/saml-keycloak.md)
- [Tutorial: How to Configure SAML with Okta](https://openvpn.net/as-docs/tutorials/saml-okta.md)
- [Tutorial: How to Configure SAML with JumpCloud](https://openvpn.net/as-docs/tutorials/saml-jumpcloud.md)
- [Tutorial: How to Configure SAML with AWS](https://openvpn.net/as-docs/tutorials/saml-aws.md)
- [Tutorial: How to Configure SAML with Auth0](https://openvpn.net/as-docs/tutorials/saml-auth0.md)
- [Tutorial: How to Configure SAML with PingOne SSO](https://openvpn.net/as-docs/tutorials/saml-pingone.md)

---

Prev: [Tutorial: How to Enforce Specific Authentication Context for SAML Logins](https://openvpn.net/as-docs/tutorials/authncontext.md)
Next: [PAM Authentication](https://openvpn.net/as-docs/tutorials/pam.md)
Index: https://openvpn.net/as-docs/llms.txt