SAML integration
Last updated
Last updated
SAML integration allows you to enable Single Sign-On (SSO) for your application using OXU IDP.
This method is typically used for enterprise environments where users authenticate through an identity provider (IdP) instead of directly logging into the application.
In a SAML integration:
Oten acts as the Identity Provider (IdP)
Your application acts as the Service Provider (SP)
When a user tries to access your application:
The user is redirected to OXU IDP
The user authenticates with OXU
Oten sends a SAML response back to your application
The user is logged in
SAML supports:
SP-initiated login (user starts from your app)
IdP-initiated login (user starts from Oten)
To integrate SAML with OXU IDP:
👉 After completing these steps, users can log in via OXU SSO
After creating a SAML integration, OXU will provide:
These values must be configured in your application.
In your application (e.g. GitHub, internal system), configure:
You will need to input the IdP values from Oten:
👉 In GitHub SSO, these fields correspond to:
You can map user attributes from Oten to your application:
Common attributes:
Example (GitHub):
After configuration:
If successful:
Common issues:
Create a SAML integration in OXU Dev Portal
Copy the IdP configuration from OXU:
SSO URL
Entity ID (Issuer)
Signing Certificate
Configure these values in your Service Provider (application)
Configure your application settings in Oten:
ACS URL
Audience (Entity ID)
Test the SAML login flow
SSO URL (Single Sign-On URL)
Entity ID (Issuer)
Signing Certificate (PEM format)
ACS URL (Assertion Consumer Service URL)
Audience / Entity ID
NameID format (recommended: email)
SSO URL
Issuer
Certificate
Sign-on URL
Issuer
Public certificate
name
username
username → uid
email → emails
fullname → name
Open your application login page
Trigger SSO login (e.g. "Login with SSO")
You will be redirected to Oten
After login, you will be redirected back to your application
A valid SAML response is returned
The user session is created in your application
Check certificate format (PEM)
Ensure correct Issuer / Entity ID
Verify ACS URL is correct
Ensure it matches exactly (including trailing slash)
Check attribute mapping (email / username)
Ensure user exists or provisioning is enabled
SAML is primarily used for enterprise SSO scenarios
Configuration may vary depending on your Service Provider (GitHub, Okta, Google, etc.)
Some providers require additional settings such as:
Signed request/response
Specific NameID format