Tutorial: Manage the SAML Authentication Method from the Command-line Interface⁠

Overview⁠

This tutorial shows how to configure SAML authentication in Access Server using the command-line interface (CLI).

With SAML, users sign in through an external identity provider (IdP), such as Entra ID, Okta, or Google Workspace.

You can configure SAML in two ways:

Use one of the following methods:

Specify the IdP metadata URL:

sacli --url="<IDP_METADATA_URL>" SamlConfigureFromMetadata

Use this method only if metadata isn't available.

Define the IdP entity ID:

sacli --key "auth.saml.0.idp_entityid" --value <IDP ENTITY ID> ConfigPut

Define the IdP sign-on endpoint:

sacli --key "auth.saml.0.idp_signon_endpoint" --value <IDP SIGNON ENDPOINT> ConfigPut

Define the IdP certificate:
```
sacli --key "auth.saml.0.idp_cert" --value_file "<PATH_TO_FILE_NAME>" ConfigPut
```
1. The <PATH_TO_FILE_NAME> needs to be a full path like "/root/idp-cert.pem".

These settings aren't required for most deployments.

Enable sending ForceAuthn (default is false):

sacli --key "auth.saml.0.forceauthn" --value "true" ConfigPut

Enable sending AuthnContexts (default is true):

sacli --key "auth.saml.0.requestauthncontext" --value "true" ConfigPut

Define AuthnContexts to be included in the AuthNRequest (default is PasswordProtectedTransport):

sacli --key "auth.saml.0.authncontexts" --value "PasswordProtectedTransport" ConfigPut

To add multiple values, use space-separated values. Example:

sacli --key "auth.saml.0.authncontexts" --value "PasswordProtectedTransport X509" ConfigPut

Set the SAML timeout in seconds (default is 180):

sacli --key "auth.saml.0.timeout" --value "180" ConfigPut

Specify the IdP log-out endpoint:

sacli --key "auth.saml.0.idp_logout_endpoint" --value <IDP LOGOUT ENDPOINT> ConfigPut

Can't find what you're looking for?

Our support team will be happy to assist you.