Tutorial: Manage the SAML Authentication Method from the Command-Line Interface
Overview
This tutorial shows how to configure SAML authentication in Access Server using the command-line interface (CLI).
With SAML, users sign in through an external identity provider (IdP), such as Entra ID, Okta, or Google Workspace.
You can configure SAML in two ways:
Recommended: Use IdP metadata (simpler and faster).
Manual: Define each setting individually.
Root privileges on your Access Server's console.
A configured SAML IdP.
IdP metadata file or URL (recommended), or manual configuration details.
Connect to the console and get root privileges.
Set the authentication mode to SAML:
sacli --key "auth.module.type" --value "saml" ConfigPut sacli start
Use one of the following methods:
Option A: Use metadata file
Specify the IdP metadata file:
sacli --value_file="<PATH_TO_FILE_NAME>" SamlConfigureFromMetadataThe
<PATH_TO_FILE_NAME>needs to be a full path like "/root/idp-metadata.xml".
Option B: Use metadata URL
Specify the IdP metadata URL:
sacli --url="<IDP_METADATA_URL>" SamlConfigureFromMetadata
Use this method only if metadata isn't available.
Define the IdP entity ID:
sacli --key "auth.saml.0.idp_entityid" --value <IDP ENTITY ID> ConfigPutDefine the IdP sign-on endpoint:
sacli --key "auth.saml.0.idp_signon_endpoint" --value <IDP SIGNON ENDPOINT> ConfigPutDefine the IdP certificate:
sacli --key "auth.saml.0.idp_cert" --value_file "<PATH_TO_FILE_NAME>" ConfigPutThe
<PATH_TO_FILE_NAME>needs to be a full path like "/root/idp-cert.pem".
Use this if you want SAML authentication to use a different hostname than your Admin Web UI or Client Web UI.
Run:
sacli --key "auth.saml.0.sp_hostname" --value <HOSTNAME> ConfigPut
Enable SAML authentication:
sacli --key "auth.saml.0.enable" --value "true" ConfigPutApply the configuration:
sacli start
Open the Client Web UI.
Attempt to sign in.
Confirm:
You're redirected to your IdP.
Authentication completes successfully.
You're redirected back to the Client Web UI.
These settings aren't required for most deployments.
Enable sending ForceAuthn (default is false):
sacli --key "auth.saml.0.forceauthn" --value "true" ConfigPutEnable sending AuthnContexts (default is true):
sacli --key "auth.saml.0.requestauthncontext" --value "true" ConfigPutDefine AuthnContexts to be included in the AuthNRequest (default is PasswordProtectedTransport):
sacli --key "auth.saml.0.authncontexts" --value "PasswordProtectedTransport" ConfigPutTo add multiple values, use space-separated values. Example:
sacli --key "auth.saml.0.authncontexts" --value "PasswordProtectedTransport X509" ConfigPut
Set the SAML timeout in seconds (default is 180):
sacli --key "auth.saml.0.timeout" --value "180" ConfigPutSpecify the IdP log-out endpoint:
sacli --key "auth.saml.0.idp_logout_endpoint" --value <IDP LOGOUT ENDPOINT> ConfigPut