# Single Sign-On (SSO) in yCrash
yCrash supports SAML-based Single Sign-On (SSO), enabling seamless and secure login using your organization’s identity provider (IdP). This allows users to authenticate through enterprise platforms like Okta, OneLogin, Microsoft Entra ID (Azure AD), PingIdentity, Google Workspace, and others.
# Steps to Enable SAML SSO
# 1. Download the SAML Template
Start by downloading the saml.xml configuration file. This file contains placeholder fields for your identity provider settings. Alternatively, you can expand the saml.xml section below and copy the content directly into your own saml.xml file.
saml.xml
<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<!DOCTYPE properties SYSTEM "http://java.sun.com/dtd/properties.dtd">
<properties>
<comment>SAML Configurations</comment>
<entry key="auth.saml">true</entry>
<!--
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Identity Provider (IdP) Configuration
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
These values are provided by the Identity Provider (IdP)
(e.g. Ping Identity, Okta, ADFS, Azure AD, etc.).
They tell the Service Provider (your app) where to send
SAML AuthnRequests and how to validate responses.
-->
<!--
Unique identifier (Entity ID) of the IdP.
Must be exactly as configured in the IdP metadata.
Example: https://idp.example.com/metadata
-->
<entry key="onelogin.saml2.idp.entityid">${IDP_ENTITY_ID}</entry>
<!--
Single Sign-On (SSO) endpoint of the IdP.
SP will redirect authentication requests here.
Example: https://idp.example.com/sso
-->
<entry key="onelogin.saml2.idp.single_sign_on_service.url">${IDP_SSO_URL}</entry>
<!--
Logout endpoint of the IdP.
The SP will send logout requests here.
Example: https://idp.example.com/slo
-->
<entry key="onelogin.saml2.idp.single_logout_service.url">${IDP_SLO_URL}</entry>
<!--
Public x509 certificate of the IdP.
Used to verify SAML responses from the IdP.
Copy the Base64 content of the certificate here.
-->
<entry key="onelogin.saml2.idp.x509cert">${IDP_X509_CERT}</entry>
<!--
Alternative to x509cert: Fingerprint of the IdP cert.
Example: onelogin.saml2.idp.certfingerprint=11:22:33:...
If used, specify the fingerprint algorithm as well (sha1, sha256, etc.).
-->
<!--<entry key="onelogin.saml2.idp.certfingerprint"></entry>-->
<!-- <entry key="onelogin.saml2.idp.certfingerprint_algorithm">sha256</entry> -->
<!--
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Service Provider (SP) Configuration
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
These values configure how your application (the SP)
identifies itself to the IdP and where it expects responses.
-->
<!--
Unique identifier (Entity ID) of your Service Provider.
This must match what you register in the IdP.
Example: https://<YCRASH_HOST>/saml-metadata.jsp
-->
<entry key="onelogin.saml2.sp.entityid"></entry>
<!--
Assertion Consumer Service (ACS) endpoint.
The IdP will send authentication responses here.
Example: https://<YCRASH_HOST>/saml-acs.jsp
-->
<entry key="onelogin.saml2.sp.assertion_consumer_service.url"></entry>
<!--
Logout endpoint of Service Provider.
The IdP will send logout responses here.
Example: https://<YCRASH_HOST>/saml-slo
-->
<entry key="onelogin.saml2.sp.single_logout_service.url"></entry>
<!--
Optional:
This property controls whether the Service Provider (SP) will cryptographically sign
the <samlp:LogoutRequest> messages it sends to the Identity Provider (IdP).
- true → The SP will sign all LogoutRequest messages using its private key.
- false → The SP will send LogoutRequest messages without a signature.
Note: Some IdPs require signed LogoutRequest, so check with your IdP setup.
-->
<entry key="onelogin.saml2.security.logoutrequest_signed">false</entry>
<!--
Optional:
This property controls whether the Service Provider (SP) will cryptographically sign
the <samlp:LogoutResonse> messages it sends to the Identity Provider (IdP).
- true → The SP will sign all LogoutResonse messages using its private key.
- false → The SP will send LogoutResonse messages without a signature.
Note: Some IdPs require signed LogoutResonse, so check with your IdP setup.
-->
<entry key="onelogin.saml2.security.logoutresponse_signed">false</entry>
<!--
Optional:
Service Provider (SP) private key in PKCS#8 format.
Required if signing of AuthnRequests or LogoutRequests is enabled.
Value is the Base64-encoded private key (sp.key).
To genrate private key you can run the below command:
> openssl genrsa -out sp_private_key.key 2048
Copy the "sp.key" file content and pass it to the below property.
-->
<entry key="onelogin.saml2.sp.privatekey"></entry>
<!--
Optional:
Service Provider (SP) public x509 certificate.
Used to sign requests (e.g. LogoutRequest) and encrypt assertions if required.
Value is the Base64-encoded certificate (sp.crt).
To genrate private key you can run the below command:
> openssl req -new -x509 -key sp_private_key.key -out sp_cert.crt -days 365
Copy the "sp_cert.crt" file content and pass it to the below property.
-->
<entry key="onelogin.saml2.sp.x509cert"></entry>
</properties>
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
For convenience, you can refer to the SAML Templates for Common Identity Providers section below, which includes preconfigured examples for popular platforms such as Okta, Azure AD, Auth0, and others.
# 2. Configure Identity Provider Settings
Open the saml.xml and update the values with your IdP details. These include:
- Entity ID
- SSO login URL
- SLO logout URL
- X.509 certificate
Your SAML/IT administrator will provide these values.
# 3. Set yCrash URLs in Your IdP
Ask your SAML administrator to configure the following URLs in the Identity Provider (IdP):
| Setting | Value |
|---|---|
| Audience URL | https://<YC_HOST>/saml-metadata.jsp |
| ACS (Consumer) URL | https://<YC_HOST>/saml-acs.jsp |
Example: If your yCrash host is ycrash.com, the URLs would be:
https://ycrash.com/saml-metadata.jsp (opens new window) and https://ycrash.com/saml-acs.jsp (opens new window)
# 4. Place the Configuration File
Save the updated saml.xml file in your yCrash upload directory (opens new window).
If using remote storage like AWS S3, place it in the root directory of the S3 bucket.
# 5. Install JCE Policy Files (Optional for Java 6/7 only)
If you're using Java 6 or 7, download and install the Java Cryptography Extension (JCE) (opens new window) policy files. Java 8 and above do not require this.
# 6. Restart yCrash Server
After making the above changes, restart your yCrash server to apply the new SSO configuration
# SAML Templates for Common Identity Providers
For convenience, you can download preconfigured SAML files for popular IdPs:
Okta
<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<!DOCTYPE properties SYSTEM "http://java.sun.com/dtd/properties.dtd">
<properties>
<comment>SAML Configurations</comment>
<entry key="auth.saml">true</entry>
<!--
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Identity Provider (IdP) Configuration
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
These values are provided by the Identity Provider (IdP)
(e.g. Ping Identity, Okta, ADFS, Azure AD, etc.).
They tell the Service Provider (your app) where to send
SAML AuthnRequests and how to validate responses.
-->
<!--
Unique identifier (Entity ID) of the IdP.
Must be exactly as configured in the IdP metadata.
Example: https://idp.example.com/metadata
-->
<entry key="onelogin.saml2.idp.entityid">https://${OKTA_ORG}.okta.com/app/${APP_ID}/sso/saml</entry>
<!--
Single Sign-On (SSO) endpoint of the IdP.
SP will redirect authentication requests here.
Example: https://idp.example.com/sso
-->
<entry key="onelogin.saml2.idp.single_sign_on_service.url">https://${OKTA_ORG}.okta.com/app/${APP_ID}/sso/saml</entry>
<!--
Logout endpoint of the IdP.
The SP will send logout requests here.
Example: https://idp.example.com/slo
-->
<entry key="onelogin.saml2.idp.single_logout_service.url">https://${OKTA_ORG}.okta.com/app/${APP_ID}/slo/saml</entry>
<!--
Public x509 certificate of the IdP.
Used to verify SAML responses from the IdP.
Copy the Base64 content of the certificate here.
-->
<entry key="onelogin.saml2.idp.x509cert">${IDP_X509_CERT}</entry>
<!--
Alternative to x509cert: Fingerprint of the IdP cert.
Example: onelogin.saml2.idp.certfingerprint=11:22:33:...
If used, specify the fingerprint algorithm as well (sha1, sha256, etc.).
-->
<!--<entry key="onelogin.saml2.idp.certfingerprint"></entry>-->
<!-- <entry key="onelogin.saml2.idp.certfingerprint_algorithm">sha256</entry> -->
<!--
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Service Provider (SP) Configuration
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
These values configure how your application (the SP)
identifies itself to the IdP and where it expects responses.
-->
<!--
Unique identifier (Entity ID) of your Service Provider.
This must match what you register in the IdP.
Example: https://<YCRASH_HOST>/saml-metadata.jsp
-->
<entry key="onelogin.saml2.sp.entityid"></entry>
<!--
Assertion Consumer Service (ACS) endpoint.
The IdP will send authentication responses here.
Example: https://<YCRASH_HOST>/saml-acs.jsp
-->
<entry key="onelogin.saml2.sp.assertion_consumer_service.url"></entry>
<!--
Logout endpoint of Service Provider.
The IdP will send logout responses here.
Example: https://<YCRASH_HOST>/saml-slo
-->
<entry key="onelogin.saml2.sp.single_logout_service.url"></entry>
<!--
Optional:
This property controls whether the Service Provider (SP) will cryptographically sign
the <samlp:LogoutRequest> messages it sends to the Identity Provider (IdP).
- true → The SP will sign all LogoutRequest messages using its private key.
- false → The SP will send LogoutRequest messages without a signature.
Note: Some IdPs require signed LogoutRequest, so check with your IdP setup.
-->
<entry key="onelogin.saml2.security.logoutrequest_signed">false</entry>
<!--
Optional:
This property controls whether the Service Provider (SP) will cryptographically sign
the <samlp:LogoutResonse> messages it sends to the Identity Provider (IdP).
- true → The SP will sign all LogoutResonse messages using its private key.
- false → The SP will send LogoutResonse messages without a signature.
Note: Some IdPs require signed LogoutResonse, so check with your IdP setup.
-->
<entry key="onelogin.saml2.security.logoutresponse_signed">false</entry>
<!--
Optional:
Service Provider (SP) private key in PKCS#8 format.
Required if signing of AuthnRequests or LogoutRequests is enabled.
Value is the Base64-encoded private key (sp.key).
To genrate private key you can run the below command:
> openssl genrsa -out sp_private_key.key 2048
Copy the "sp.key" file content and pass it to the below property.
-->
<entry key="onelogin.saml2.sp.privatekey"></entry>
<!--
Optional:
Service Provider (SP) public x509 certificate.
Used to sign requests (e.g. LogoutRequest) and encrypt assertions if required.
Value is the Base64-encoded certificate (sp.crt).
To genrate private key you can run the below command:
> openssl req -new -x509 -key sp_private_key.key -out sp_cert.crt -days 365
Copy the "sp_cert.crt" file content and pass it to the below property.
-->
<entry key="onelogin.saml2.sp.x509cert"></entry>
</properties>
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
OneLogin
<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<!DOCTYPE properties SYSTEM "http://java.sun.com/dtd/properties.dtd">
<properties>
<comment>SAML Configurations</comment>
<entry key="auth.saml">true</entry>
<!--
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Identity Provider (IdP) Configuration
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
These values are provided by the Identity Provider (IdP)
(e.g. Ping Identity, Okta, ADFS, Azure AD, etc.).
They tell the Service Provider (your app) where to send
SAML AuthnRequests and how to validate responses.
-->
<!--
Unique identifier (Entity ID) of the IdP.
Must be exactly as configured in the IdP metadata.
Example: https://idp.example.com/metadata
-->
<entry key="onelogin.saml2.idp.entityid">https://app.onelogin.com/saml/metadata/${APP_ID}</entry>
<!--
Single Sign-On (SSO) endpoint of the IdP.
SP will redirect authentication requests here.
Example: https://idp.example.com/sso
-->
<entry key="onelogin.saml2.idp.single_sign_on_service.url">https://app.onelogin.com/trust/saml2/http-post/sso/${APP_ID}</entry>
<!--
Logout endpoint of the IdP.
The SP will send logout requests here.
Example: https://idp.example.com/slo
-->
<entry key="onelogin.saml2.idp.single_logout_service.url">https://app.onelogin.com/trust/saml2/http-redirect/slo/${APP_ID}</entry>
<!--
Public x509 certificate of the IdP.
Used to verify SAML responses from the IdP.
Copy the Base64 content of the certificate here.
-->
<entry key="onelogin.saml2.idp.x509cert">${IDP_X509_CERT}</entry>
<!--
Alternative to x509cert: Fingerprint of the IdP cert.
Example: onelogin.saml2.idp.certfingerprint=11:22:33:...
If used, specify the fingerprint algorithm as well (sha1, sha256, etc.).
-->
<!--<entry key="onelogin.saml2.idp.certfingerprint"></entry>-->
<!-- <entry key="onelogin.saml2.idp.certfingerprint_algorithm">sha256</entry> -->
<!--
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Service Provider (SP) Configuration
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
These values configure how your application (the SP)
identifies itself to the IdP and where it expects responses.
-->
<!--
Unique identifier (Entity ID) of your Service Provider.
This must match what you register in the IdP.
Example: https://<YCRASH_HOST>/saml-metadata.jsp
-->
<entry key="onelogin.saml2.sp.entityid"></entry>
<!--
Assertion Consumer Service (ACS) endpoint.
The IdP will send authentication responses here.
Example: https://<YCRASH_HOST>/saml-acs.jsp
-->
<entry key="onelogin.saml2.sp.assertion_consumer_service.url"></entry>
<!--
Logout endpoint of Service Provider.
The IdP will send logout responses here.
Example: https://<YCRASH_HOST>/saml-slo
-->
<entry key="onelogin.saml2.sp.single_logout_service.url"></entry>
<!--
Optional:
This property controls whether the Service Provider (SP) will cryptographically sign
the <samlp:LogoutRequest> messages it sends to the Identity Provider (IdP).
- true → The SP will sign all LogoutRequest messages using its private key.
- false → The SP will send LogoutRequest messages without a signature.
Note: Some IdPs require signed LogoutRequest, so check with your IdP setup.
-->
<entry key="onelogin.saml2.security.logoutrequest_signed">false</entry>
<!--
Optional:
This property controls whether the Service Provider (SP) will cryptographically sign
the <samlp:LogoutResonse> messages it sends to the Identity Provider (IdP).
- true → The SP will sign all LogoutResonse messages using its private key.
- false → The SP will send LogoutResonse messages without a signature.
Note: Some IdPs require signed LogoutResonse, so check with your IdP setup.
-->
<entry key="onelogin.saml2.security.logoutresponse_signed">false</entry>
<!--
Optional:
Service Provider (SP) private key in PKCS#8 format.
Required if signing of AuthnRequests or LogoutRequests is enabled.
Value is the Base64-encoded private key (sp.key).
To genrate private key you can run the below command:
> openssl genrsa -out sp_private_key.key 2048
Copy the "sp.key" file content and pass it to the below property.
-->
<entry key="onelogin.saml2.sp.privatekey"></entry>
<!--
Optional:
Service Provider (SP) public x509 certificate.
Used to sign requests (e.g. LogoutRequest) and encrypt assertions if required.
Value is the Base64-encoded certificate (sp.crt).
To genrate private key you can run the below command:
> openssl req -new -x509 -key sp_private_key.key -out sp_cert.crt -days 365
Copy the "sp_cert.crt" file content and pass it to the below property.
-->
<entry key="onelogin.saml2.sp.x509cert"></entry>
</properties>
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
Azure AD (Microsoft Entra ID)
<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<!DOCTYPE properties SYSTEM "http://java.sun.com/dtd/properties.dtd">
<properties>
<comment>SAML Configurations</comment>
<entry key="auth.saml">true</entry>
<!--
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Identity Provider (IdP) Configuration
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
These values are provided by the Identity Provider (IdP)
(e.g. Ping Identity, Okta, ADFS, Azure AD, etc.).
They tell the Service Provider (your app) where to send
SAML AuthnRequests and how to validate responses.
-->
<!--
Unique identifier (Entity ID) of the IdP.
Must be exactly as configured in the IdP metadata.
Example: https://idp.example.com/metadata
-->
<entry key="onelogin.saml2.idp.entityid">https://login.microsoftonline.com/${TENANT_ID}/v2.0</entry>
<!--
Single Sign-On (SSO) endpoint of the IdP.
SP will redirect authentication requests here.
Example: https://idp.example.com/sso
-->
<entry key="onelogin.saml2.idp.single_sign_on_service.url">https://login.microsoftonline.com/${TENANT_ID}/saml2</entry>
<!--
Logout endpoint of the IdP.
The SP will send logout requests here.
Example: https://idp.example.com/slo
-->
<entry key="onelogin.saml2.idp.single_logout_service.url">https://login.microsoftonline.com/${TENANT_ID}/saml2</entry>
<!--
Public x509 certificate of the IdP.
Used to verify SAML responses from the IdP.
Copy the Base64 content of the certificate here.
-->
<entry key="onelogin.saml2.idp.x509cert">${IDP_X509_CERT}</entry>
<!--
Alternative to x509cert: Fingerprint of the IdP cert.
Example: onelogin.saml2.idp.certfingerprint=11:22:33:...
If used, specify the fingerprint algorithm as well (sha1, sha256, etc.).
-->
<!--<entry key="onelogin.saml2.idp.certfingerprint"></entry>-->
<!-- <entry key="onelogin.saml2.idp.certfingerprint_algorithm">sha256</entry> -->
<!--
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Service Provider (SP) Configuration
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
These values configure how your application (the SP)
identifies itself to the IdP and where it expects responses.
-->
<!--
Unique identifier (Entity ID) of your Service Provider.
This must match what you register in the IdP.
Example: https://<YCRASH_HOST>/saml-metadata.jsp
-->
<entry key="onelogin.saml2.sp.entityid"></entry>
<!--
Assertion Consumer Service (ACS) endpoint.
The IdP will send authentication responses here.
Example: https://<YCRASH_HOST>/saml-acs.jsp
-->
<entry key="onelogin.saml2.sp.assertion_consumer_service.url"></entry>
<!--
Logout endpoint of Service Provider.
The IdP will send logout responses here.
Example: https://<YCRASH_HOST>/saml-slo
-->
<entry key="onelogin.saml2.sp.single_logout_service.url"></entry>
<!--
Optional:
This property controls whether the Service Provider (SP) will cryptographically sign
the <samlp:LogoutRequest> messages it sends to the Identity Provider (IdP).
- true → The SP will sign all LogoutRequest messages using its private key.
- false → The SP will send LogoutRequest messages without a signature.
Note: Some IdPs require signed LogoutRequest, so check with your IdP setup.
-->
<entry key="onelogin.saml2.security.logoutrequest_signed">false</entry>
<!--
Optional:
This property controls whether the Service Provider (SP) will cryptographically sign
the <samlp:LogoutResonse> messages it sends to the Identity Provider (IdP).
- true → The SP will sign all LogoutResonse messages using its private key.
- false → The SP will send LogoutResonse messages without a signature.
Note: Some IdPs require signed LogoutResonse, so check with your IdP setup.
-->
<entry key="onelogin.saml2.security.logoutresponse_signed">false</entry>
<!--
Optional:
Service Provider (SP) private key in PKCS#8 format.
Required if signing of AuthnRequests or LogoutRequests is enabled.
Value is the Base64-encoded private key (sp.key).
To genrate private key you can run the below command:
> openssl genrsa -out sp_private_key.key 2048
Copy the "sp.key" file content and pass it to the below property.
-->
<entry key="onelogin.saml2.sp.privatekey"></entry>
<!--
Optional:
Service Provider (SP) public x509 certificate.
Used to sign requests (e.g. LogoutRequest) and encrypt assertions if required.
Value is the Base64-encoded certificate (sp.crt).
To genrate private key you can run the below command:
> openssl req -new -x509 -key sp_private_key.key -out sp_cert.crt -days 365
Copy the "sp_cert.crt" file content and pass it to the below property.
-->
<entry key="onelogin.saml2.sp.x509cert"></entry>
</properties>
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
Auth0
<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<!DOCTYPE properties SYSTEM "http://java.sun.com/dtd/properties.dtd">
<properties>
<comment>SAML Configurations</comment>
<entry key="auth.saml">true</entry>
<!--
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Identity Provider (IdP) Configuration
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
These values are provided by the Identity Provider (IdP)
(e.g. Ping Identity, Okta, ADFS, Azure AD, etc.).
They tell the Service Provider (your app) where to send
SAML AuthnRequests and how to validate responses.
-->
<!--
Unique identifier (Entity ID) of the IdP.
Must be exactly as configured in the IdP metadata.
Example: https://idp.example.com/metadata
-->
<entry key="onelogin.saml2.idp.entityid">https://${AUTH0_TENANT}.auth0.com/</entry>
<!--
Single Sign-On (SSO) endpoint of the IdP.
SP will redirect authentication requests here.
Example: https://idp.example.com/sso
-->
<entry key="onelogin.saml2.idp.single_sign_on_service.url">https://${AUTH0_TENANT}.auth0.com/samlp/${CLIENT_ID}</entry>
<!--
Logout endpoint of the IdP.
The SP will send logout requests here.
Example: https://idp.example.com/slo
-->
<entry key="onelogin.saml2.idp.single_logout_service.url">https://${AUTH0_TENANT}.auth0.com/v2/logout</entry>
<!--
Public x509 certificate of the IdP.
Used to verify SAML responses from the IdP.
Copy the Base64 content of the certificate here.
-->
<entry key="onelogin.saml2.idp.x509cert">${IDP_X509_CERT}</entry>
<!--
Alternative to x509cert: Fingerprint of the IdP cert.
Example: onelogin.saml2.idp.certfingerprint=11:22:33:...
If used, specify the fingerprint algorithm as well (sha1, sha256, etc.).
-->
<!--<entry key="onelogin.saml2.idp.certfingerprint"></entry>-->
<!-- <entry key="onelogin.saml2.idp.certfingerprint_algorithm">sha256</entry> -->
<!--
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Service Provider (SP) Configuration
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
These values configure how your application (the SP)
identifies itself to the IdP and where it expects responses.
-->
<!--
Unique identifier (Entity ID) of your Service Provider.
This must match what you register in the IdP.
Example: https://<YCRASH_HOST>/saml-metadata.jsp
-->
<entry key="onelogin.saml2.sp.entityid"></entry>
<!--
Assertion Consumer Service (ACS) endpoint.
The IdP will send authentication responses here.
Example: https://<YCRASH_HOST>/saml-acs.jsp
-->
<entry key="onelogin.saml2.sp.assertion_consumer_service.url"></entry>
<!--
Logout endpoint of Service Provider.
The IdP will send logout responses here.
Example: https://<YCRASH_HOST>/saml-slo
-->
<entry key="onelogin.saml2.sp.single_logout_service.url"></entry>
<!--
Optional:
This property controls whether the Service Provider (SP) will cryptographically sign
the <samlp:LogoutRequest> messages it sends to the Identity Provider (IdP).
- true → The SP will sign all LogoutRequest messages using its private key.
- false → The SP will send LogoutRequest messages without a signature.
Note: Some IdPs require signed LogoutRequest, so check with your IdP setup.
-->
<entry key="onelogin.saml2.security.logoutrequest_signed">false</entry>
<!--
Optional:
This property controls whether the Service Provider (SP) will cryptographically sign
the <samlp:LogoutResonse> messages it sends to the Identity Provider (IdP).
- true → The SP will sign all LogoutResonse messages using its private key.
- false → The SP will send LogoutResonse messages without a signature.
Note: Some IdPs require signed LogoutResonse, so check with your IdP setup.
-->
<entry key="onelogin.saml2.security.logoutresponse_signed">false</entry>
<!--
Optional:
Service Provider (SP) private key in PKCS#8 format.
Required if signing of AuthnRequests or LogoutRequests is enabled.
Value is the Base64-encoded private key (sp.key).
To genrate private key you can run the below command:
> openssl genrsa -out sp_private_key.key 2048
Copy the "sp.key" file content and pass it to the below property.
-->
<entry key="onelogin.saml2.sp.privatekey"></entry>
<!--
Optional:
Service Provider (SP) public x509 certificate.
Used to sign requests (e.g. LogoutRequest) and encrypt assertions if required.
Value is the Base64-encoded certificate (sp.crt).
To genrate private key you can run the below command:
> openssl req -new -x509 -key sp_private_key.key -out sp_cert.crt -days 365
Copy the "sp_cert.crt" file content and pass it to the below property.
-->
<entry key="onelogin.saml2.sp.x509cert"></entry>
</properties>
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
Ping Identity
<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<!DOCTYPE properties SYSTEM "http://java.sun.com/dtd/properties.dtd">
<properties>
<comment>SAML Configurations</comment>
<entry key="auth.saml">true</entry>
<!--
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Identity Provider (IdP) Configuration
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
These values are provided by the Identity Provider (IdP)
(e.g. Ping Identity, Okta, ADFS, Azure AD, etc.).
They tell the Service Provider (your app) where to send
SAML AuthnRequests and how to validate responses.
-->
<!--
Unique identifier (Entity ID) of the IdP.
Must be exactly as configured in the IdP metadata.
Example: https://idp.example.com/metadata
-->
<entry key="onelogin.saml2.idp.entityid">https://idp.pingidentity.com/${ORG_ID}/sso/saml2</entry>
<!--
Single Sign-On (SSO) endpoint of the IdP.
SP will redirect authentication requests here.
Example: https://idp.example.com/sso
-->
<entry key="onelogin.saml2.idp.single_sign_on_service.url">https://idp.pingidentity.com/${ORG_ID}/sso/saml2</entry>
<!--
Logout endpoint of the IdP.
The SP will send logout requests here.
Example: https://idp.example.com/slo
-->
<entry key="onelogin.saml2.idp.single_logout_service.url">https://idp.pingidentity.com/${ORG_ID}/slo/saml2</entry>
<!--
Public x509 certificate of the IdP.
Used to verify SAML responses from the IdP.
Copy the Base64 content of the certificate here.
-->
<entry key="onelogin.saml2.idp.x509cert">${IDP_X509_CERT}</entry>
<!--
Alternative to x509cert: Fingerprint of the IdP cert.
Example: onelogin.saml2.idp.certfingerprint=11:22:33:...
If used, specify the fingerprint algorithm as well (sha1, sha256, etc.).
-->
<!--<entry key="onelogin.saml2.idp.certfingerprint"></entry>-->
<!-- <entry key="onelogin.saml2.idp.certfingerprint_algorithm">sha256</entry> -->
<!--
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Service Provider (SP) Configuration
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
These values configure how your application (the SP)
identifies itself to the IdP and where it expects responses.
-->
<!--
Unique identifier (Entity ID) of your Service Provider.
This must match what you register in the IdP.
Example: https://<YCRASH_HOST>/saml-metadata.jsp
-->
<entry key="onelogin.saml2.sp.entityid"></entry>
<!--
Assertion Consumer Service (ACS) endpoint.
The IdP will send authentication responses here.
Example: https://<YCRASH_HOST>/saml-acs.jsp
-->
<entry key="onelogin.saml2.sp.assertion_consumer_service.url"></entry>
<!--
Logout endpoint of Service Provider.
The IdP will send logout responses here.
Example: https://<YCRASH_HOST>/saml-slo
-->
<entry key="onelogin.saml2.sp.single_logout_service.url"></entry>
<!--
Optional:
This property controls whether the Service Provider (SP) will cryptographically sign
the <samlp:LogoutRequest> messages it sends to the Identity Provider (IdP).
- true → The SP will sign all LogoutRequest messages using its private key.
- false → The SP will send LogoutRequest messages without a signature.
Note: Some IdPs require signed LogoutRequest, so check with your IdP setup.
-->
<entry key="onelogin.saml2.security.logoutrequest_signed">false</entry>
<!--
Optional:
This property controls whether the Service Provider (SP) will cryptographically sign
the <samlp:LogoutResonse> messages it sends to the Identity Provider (IdP).
- true → The SP will sign all LogoutResonse messages using its private key.
- false → The SP will send LogoutResonse messages without a signature.
Note: Some IdPs require signed LogoutResonse, so check with your IdP setup.
-->
<entry key="onelogin.saml2.security.logoutresponse_signed">false</entry>
<!--
Optional:
Service Provider (SP) private key in PKCS#8 format.
Required if signing of AuthnRequests or LogoutRequests is enabled.
Value is the Base64-encoded private key (sp.key).
To genrate private key you can run the below command:
> openssl genrsa -out sp_private_key.key 2048
Copy the "sp.key" file content and pass it to the below property.
-->
<entry key="onelogin.saml2.sp.privatekey"></entry>
<!--
Optional:
Service Provider (SP) public x509 certificate.
Used to sign requests (e.g. LogoutRequest) and encrypt assertions if required.
Value is the Base64-encoded certificate (sp.crt).
To genrate private key you can run the below command:
> openssl req -new -x509 -key sp_private_key.key -out sp_cert.crt -days 365
Copy the "sp_cert.crt" file content and pass it to the below property.
-->
<entry key="onelogin.saml2.sp.x509cert"></entry>
</properties>
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
AWS SSO
<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<!DOCTYPE properties SYSTEM "http://java.sun.com/dtd/properties.dtd">
<properties>
<comment>SAML Configurations</comment>
<entry key="auth.saml">true</entry>
<!--
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Identity Provider (IdP) Configuration
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
These values are provided by the Identity Provider (IdP)
(e.g. Ping Identity, Okta, ADFS, Azure AD, etc.).
They tell the Service Provider (your app) where to send
SAML AuthnRequests and how to validate responses.
-->
<!--
Unique identifier (Entity ID) of the IdP.
Must be exactly as configured in the IdP metadata.
Example: https://idp.example.com/metadata
-->
<entry key="onelogin.saml2.idp.entityid">https://${AWS_SSO_DOMAIN}.awsapps.com/start</entry>
<!--
Single Sign-On (SSO) endpoint of the IdP.
SP will redirect authentication requests here.
Example: https://idp.example.com/sso
-->
<entry key="onelogin.saml2.idp.single_sign_on_service.url">https://${AWS_SSO_DOMAIN}.awsapps.com/start</entry>
<!--
Logout endpoint of the IdP.
The SP will send logout requests here.
Example: https://idp.example.com/slo
-->
<entry key="onelogin.saml2.idp.single_logout_service.url">https://${AWS_SSO_DOMAIN}.awsapps.com/logout</entry>
<!--
Public x509 certificate of the IdP.
Used to verify SAML responses from the IdP.
Copy the Base64 content of the certificate here.
-->
<entry key="onelogin.saml2.idp.x509cert">${IDP_X509_CERT}</entry>
<!--
Alternative to x509cert: Fingerprint of the IdP cert.
Example: onelogin.saml2.idp.certfingerprint=11:22:33:...
If used, specify the fingerprint algorithm as well (sha1, sha256, etc.).
-->
<!--<entry key="onelogin.saml2.idp.certfingerprint"></entry>-->
<!-- <entry key="onelogin.saml2.idp.certfingerprint_algorithm">sha256</entry> -->
<!--
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Service Provider (SP) Configuration
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
These values configure how your application (the SP)
identifies itself to the IdP and where it expects responses.
-->
<!--
Unique identifier (Entity ID) of your Service Provider.
This must match what you register in the IdP.
Example: https://<YCRASH_HOST>/saml-metadata.jsp
-->
<entry key="onelogin.saml2.sp.entityid"></entry>
<!--
Assertion Consumer Service (ACS) endpoint.
The IdP will send authentication responses here.
Example: https://<YCRASH_HOST>/saml-acs.jsp
-->
<entry key="onelogin.saml2.sp.assertion_consumer_service.url"></entry>
<!--
Logout endpoint of Service Provider.
The IdP will send logout responses here.
Example: https://<YCRASH_HOST>/saml-slo
-->
<entry key="onelogin.saml2.sp.single_logout_service.url"></entry>
<!--
Optional:
This property controls whether the Service Provider (SP) will cryptographically sign
the <samlp:LogoutRequest> messages it sends to the Identity Provider (IdP).
- true → The SP will sign all LogoutRequest messages using its private key.
- false → The SP will send LogoutRequest messages without a signature.
Note: Some IdPs require signed LogoutRequest, so check with your IdP setup.
-->
<entry key="onelogin.saml2.security.logoutrequest_signed">false</entry>
<!--
Optional:
This property controls whether the Service Provider (SP) will cryptographically sign
the <samlp:LogoutResonse> messages it sends to the Identity Provider (IdP).
- true → The SP will sign all LogoutResonse messages using its private key.
- false → The SP will send LogoutResonse messages without a signature.
Note: Some IdPs require signed LogoutResonse, so check with your IdP setup.
-->
<entry key="onelogin.saml2.security.logoutresponse_signed">false</entry>
<!--
Optional:
Service Provider (SP) private key in PKCS#8 format.
Required if signing of AuthnRequests or LogoutRequests is enabled.
Value is the Base64-encoded private key (sp.key).
To genrate private key you can run the below command:
> openssl genrsa -out sp_private_key.key 2048
Copy the "sp.key" file content and pass it to the below property.
-->
<entry key="onelogin.saml2.sp.privatekey"></entry>
<!--
Optional:
Service Provider (SP) public x509 certificate.
Used to sign requests (e.g. LogoutRequest) and encrypt assertions if required.
Value is the Base64-encoded certificate (sp.crt).
To genrate private key you can run the below command:
> openssl req -new -x509 -key sp_private_key.key -out sp_cert.crt -days 365
Copy the "sp_cert.crt" file content and pass it to the below property.
-->
<entry key="onelogin.saml2.sp.x509cert"></entry>
</properties>
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
IBM ISAM
<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<!DOCTYPE properties SYSTEM "http://java.sun.com/dtd/properties.dtd">
<properties>
<comment>SAML Configurations</comment>
<entry key="auth.saml">true</entry>
<!--
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Identity Provider (IdP) Configuration
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
These values are provided by the Identity Provider (IdP)
(e.g. Ping Identity, Okta, ADFS, Azure AD, etc.).
They tell the Service Provider (your app) where to send
SAML AuthnRequests and how to validate responses.
-->
<!--
Unique identifier (Entity ID) of the IdP.
Must be exactly as configured in the IdP metadata.
Example: https://idp.example.com/metadata
-->
<entry key="onelogin.saml2.idp.entityid">https://${IBM_ISAM_DOMAIN}/mga/sps/saml2idp/saml20</entry>
<!--
Single Sign-On (SSO) endpoint of the IdP.
SP will redirect authentication requests here.
Example: https://idp.example.com/sso
-->
<entry key="onelogin.saml2.idp.single_sign_on_service.url">https://${IBM_ISAM_DOMAIN}/mga/sps/saml2idp/saml20/login</entry>
<!--
Logout endpoint of the IdP.
The SP will send logout requests here.
Example: https://idp.example.com/slo
-->
<entry key="onelogin.saml2.idp.single_logout_service.url">https://${IBM_ISAM_DOMAIN}/mga/sps/saml2idp/saml20/logout</entry>
<!--
Public x509 certificate of the IdP.
Used to verify SAML responses from the IdP.
Copy the Base64 content of the certificate here.
-->
<entry key="onelogin.saml2.idp.x509cert">${IDP_X509_CERT}</entry>
<!--
Alternative to x509cert: Fingerprint of the IdP cert.
Example: onelogin.saml2.idp.certfingerprint=11:22:33:...
If used, specify the fingerprint algorithm as well (sha1, sha256, etc.).
-->
<!--<entry key="onelogin.saml2.idp.certfingerprint"></entry>-->
<!-- <entry key="onelogin.saml2.idp.certfingerprint_algorithm">sha256</entry> -->
<!--
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Service Provider (SP) Configuration
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
These values configure how your application (the SP)
identifies itself to the IdP and where it expects responses.
-->
<!--
Unique identifier (Entity ID) of your Service Provider.
This must match what you register in the IdP.
Example: https://<YCRASH_HOST>/saml-metadata.jsp
-->
<entry key="onelogin.saml2.sp.entityid"></entry>
<!--
Assertion Consumer Service (ACS) endpoint.
The IdP will send authentication responses here.
Example: https://<YCRASH_HOST>/saml-acs.jsp
-->
<entry key="onelogin.saml2.sp.assertion_consumer_service.url"></entry>
<!--
Logout endpoint of Service Provider.
The IdP will send logout responses here.
Example: https://<YCRASH_HOST>/saml-slo
-->
<entry key="onelogin.saml2.sp.single_logout_service.url"></entry>
<!--
Optional:
This property controls whether the Service Provider (SP) will cryptographically sign
the <samlp:LogoutRequest> messages it sends to the Identity Provider (IdP).
- true → The SP will sign all LogoutRequest messages using its private key.
- false → The SP will send LogoutRequest messages without a signature.
Note: Some IdPs require signed LogoutRequest, so check with your IdP setup.
-->
<entry key="onelogin.saml2.security.logoutrequest_signed">false</entry>
<!--
Optional:
This property controls whether the Service Provider (SP) will cryptographically sign
the <samlp:LogoutResonse> messages it sends to the Identity Provider (IdP).
- true → The SP will sign all LogoutResonse messages using its private key.
- false → The SP will send LogoutResonse messages without a signature.
Note: Some IdPs require signed LogoutResonse, so check with your IdP setup.
-->
<entry key="onelogin.saml2.security.logoutresponse_signed">false</entry>
<!--
Optional:
Service Provider (SP) private key in PKCS#8 format.
Required if signing of AuthnRequests or LogoutRequests is enabled.
Value is the Base64-encoded private key (sp.key).
To genrate private key you can run the below command:
> openssl genrsa -out sp_private_key.key 2048
Copy the "sp.key" file content and pass it to the below property.
-->
<entry key="onelogin.saml2.sp.privatekey"></entry>
<!--
Optional:
Service Provider (SP) public x509 certificate.
Used to sign requests (e.g. LogoutRequest) and encrypt assertions if required.
Value is the Base64-encoded certificate (sp.crt).
To genrate private key you can run the below command:
> openssl req -new -x509 -key sp_private_key.key -out sp_cert.crt -days 365
Copy the "sp_cert.crt" file content and pass it to the below property.
-->
<entry key="onelogin.saml2.sp.x509cert"></entry>
</properties>
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
Oracle IDCS
<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<!DOCTYPE properties SYSTEM "http://java.sun.com/dtd/properties.dtd">
<properties>
<comment>SAML Configurations</comment>
<entry key="auth.saml">true</entry>
<!--
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Identity Provider (IdP) Configuration
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
These values are provided by the Identity Provider (IdP)
(e.g. Ping Identity, Okta, ADFS, Azure AD, etc.).
They tell the Service Provider (your app) where to send
SAML AuthnRequests and how to validate responses.
-->
<!--
Unique identifier (Entity ID) of the IdP.
Must be exactly as configured in the IdP metadata.
Example: https://idp.example.com/metadata
-->
<entry key="onelogin.saml2.idp.entityid">https://${ORACLE_IDCS_DOMAIN}/fed</entry>
<!--
Single Sign-On (SSO) endpoint of the IdP.
SP will redirect authentication requests here.
Example: https://idp.example.com/sso
-->
<entry key="onelogin.saml2.idp.single_sign_on_service.url">https://${ORACLE_IDCS_DOMAIN}/fed/v1/idp/sso</entry>
<!--
Logout endpoint of the IdP.
The SP will send logout requests here.
Example: https://idp.example.com/slo
-->
<entry key="onelogin.saml2.idp.single_logout_service.url">https://${ORACLE_IDCS_DOMAIN}/fed/v1/idp/slo</entry>
<!--
Public x509 certificate of the IdP.
Used to verify SAML responses from the IdP.
Copy the Base64 content of the certificate here.
-->
<entry key="onelogin.saml2.idp.x509cert">${IDP_X509_CERT}</entry>
<!--
Alternative to x509cert: Fingerprint of the IdP cert.
Example: onelogin.saml2.idp.certfingerprint=11:22:33:...
If used, specify the fingerprint algorithm as well (sha1, sha256, etc.).
-->
<!--<entry key="onelogin.saml2.idp.certfingerprint"></entry>-->
<!-- <entry key="onelogin.saml2.idp.certfingerprint_algorithm">sha256</entry> -->
<!--
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Service Provider (SP) Configuration
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
These values configure how your application (the SP)
identifies itself to the IdP and where it expects responses.
-->
<!--
Unique identifier (Entity ID) of your Service Provider.
This must match what you register in the IdP.
Example: https://<YCRASH_HOST>/saml-metadata.jsp
-->
<entry key="onelogin.saml2.sp.entityid"></entry>
<!--
Assertion Consumer Service (ACS) endpoint.
The IdP will send authentication responses here.
Example: https://<YCRASH_HOST>/saml-acs.jsp
-->
<entry key="onelogin.saml2.sp.assertion_consumer_service.url"></entry>
<!--
Logout endpoint of Service Provider.
The IdP will send logout responses here.
Example: https://<YCRASH_HOST>/saml-slo
-->
<entry key="onelogin.saml2.sp.single_logout_service.url"></entry>
<!--
Optional:
This property controls whether the Service Provider (SP) will cryptographically sign
the <samlp:LogoutRequest> messages it sends to the Identity Provider (IdP).
- true → The SP will sign all LogoutRequest messages using its private key.
- false → The SP will send LogoutRequest messages without a signature.
Note: Some IdPs require signed LogoutRequest, so check with your IdP setup.
-->
<entry key="onelogin.saml2.security.logoutrequest_signed">false</entry>
<!--
Optional:
This property controls whether the Service Provider (SP) will cryptographically sign
the <samlp:LogoutResonse> messages it sends to the Identity Provider (IdP).
- true → The SP will sign all LogoutResonse messages using its private key.
- false → The SP will send LogoutResonse messages without a signature.
Note: Some IdPs require signed LogoutResonse, so check with your IdP setup.
-->
<entry key="onelogin.saml2.security.logoutresponse_signed">false</entry>
<!--
Optional:
Service Provider (SP) private key in PKCS#8 format.
Required if signing of AuthnRequests or LogoutRequests is enabled.
Value is the Base64-encoded private key (sp.key).
To genrate private key you can run the below command:
> openssl genrsa -out sp_private_key.key 2048
Copy the "sp.key" file content and pass it to the below property.
-->
<entry key="onelogin.saml2.sp.privatekey"></entry>
<!--
Optional:
Service Provider (SP) public x509 certificate.
Used to sign requests (e.g. LogoutRequest) and encrypt assertions if required.
Value is the Base64-encoded certificate (sp.crt).
To genrate private key you can run the below command:
> openssl req -new -x509 -key sp_private_key.key -out sp_cert.crt -days 365
Copy the "sp_cert.crt" file content and pass it to the below property.
-->
<entry key="onelogin.saml2.sp.x509cert"></entry>
</properties>
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
ForgeRock
<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<!DOCTYPE properties SYSTEM "http://java.sun.com/dtd/properties.dtd">
<properties>
<comment>SAML Configurations</comment>
<entry key="auth.saml">true</entry>
<!--
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Identity Provider (IdP) Configuration
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
These values are provided by the Identity Provider (IdP)
(e.g. Ping Identity, Okta, ADFS, Azure AD, etc.).
They tell the Service Provider (your app) where to send
SAML AuthnRequests and how to validate responses.
-->
<!--
Unique identifier (Entity ID) of the IdP.
Must be exactly as configured in the IdP metadata.
Example: https://idp.example.com/metadata
-->
<entry key="onelogin.saml2.idp.entityid">https://${FORGEROCK_DOMAIN}/openam</entry>
<!--
Single Sign-On (SSO) endpoint of the IdP.
SP will redirect authentication requests here.
Example: https://idp.example.com/sso
-->
<entry key="onelogin.saml2.idp.single_sign_on_service.url">https://${FORGEROCK_DOMAIN}/openam/SSORedirect/metaAlias/idp</entry>
<!--
Logout endpoint of the IdP.
The SP will send logout requests here.
Example: https://idp.example.com/slo
-->
<entry key="onelogin.saml2.idp.single_logout_service.url">https://${FORGEROCK_DOMAIN}/openam/IDPSloRedirect/metaAlias/idp</entry>
<!--
Public x509 certificate of the IdP.
Used to verify SAML responses from the IdP.
Copy the Base64 content of the certificate here.
-->
<entry key="onelogin.saml2.idp.x509cert">${IDP_X509_CERT}</entry>
<!--
Alternative to x509cert: Fingerprint of the IdP cert.
Example: onelogin.saml2.idp.certfingerprint=11:22:33:...
If used, specify the fingerprint algorithm as well (sha1, sha256, etc.).
-->
<!--<entry key="onelogin.saml2.idp.certfingerprint"></entry>-->
<!-- <entry key="onelogin.saml2.idp.certfingerprint_algorithm">sha256</entry> -->
<!--
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Service Provider (SP) Configuration
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
These values configure how your application (the SP)
identifies itself to the IdP and where it expects responses.
-->
<!--
Unique identifier (Entity ID) of your Service Provider.
This must match what you register in the IdP.
Example: https://<YCRASH_HOST>/saml-metadata.jsp
-->
<entry key="onelogin.saml2.sp.entityid"></entry>
<!--
Assertion Consumer Service (ACS) endpoint.
The IdP will send authentication responses here.
Example: https://<YCRASH_HOST>/saml-acs.jsp
-->
<entry key="onelogin.saml2.sp.assertion_consumer_service.url"></entry>
<!--
Logout endpoint of Service Provider.
The IdP will send logout responses here.
Example: https://<YCRASH_HOST>/saml-slo
-->
<entry key="onelogin.saml2.sp.single_logout_service.url"></entry>
<!--
Optional:
Service Provider (SP) private key in PKCS#8 format.
Required if signing of AuthnRequests or LogoutRequests is enabled.
Value is the Base64-encoded private key (sp.key).
To genrate private key you can run the below command:
> openssl genrsa -out sp_private_key.key 2048
Copy the "sp.key" file content and pass it to the below property.
-->
<entry key="onelogin.saml2.sp.privatekey"></entry>
<!--
Optional:
This property controls whether the Service Provider (SP) will cryptographically sign
the <samlp:LogoutRequest> messages it sends to the Identity Provider (IdP).
- true → The SP will sign all LogoutRequest messages using its private key.
- false → The SP will send LogoutRequest messages without a signature.
Note: Some IdPs require signed LogoutRequest, so check with your IdP setup.
-->
<entry key="onelogin.saml2.security.logoutrequest_signed">false</entry>
<!--
Optional:
This property controls whether the Service Provider (SP) will cryptographically sign
the <samlp:LogoutResonse> messages it sends to the Identity Provider (IdP).
- true → The SP will sign all LogoutResonse messages using its private key.
- false → The SP will send LogoutResonse messages without a signature.
Note: Some IdPs require signed LogoutResonse, so check with your IdP setup.
-->
<entry key="onelogin.saml2.security.logoutresponse_signed">false</entry>
<!--
Optional:
Service Provider (SP) public x509 certificate.
Used to sign requests (e.g. LogoutRequest) and encrypt assertions if required.
Value is the Base64-encoded certificate (sp.crt).
To genrate private key you can run the below command:
> openssl req -new -x509 -key sp_private_key.key -out sp_cert.crt -days 365
Copy the "sp_cert.crt" file content and pass it to the below property.
-->
<entry key="onelogin.saml2.sp.x509cert"></entry>
</properties>
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
Copy the relevant template into a new saml.xml file, update the required values, and follow the setup steps outlined above.
Need Help?
If you face issues or need help with the SAML setup, please reach out to us at support@tier1app.com or refer to your IdP’s documentation for SAML settings.