Manage SSO connections

On the Admin Portal Enterprise SSO menu, you can see the SSO Connections details.

Add SAML connections

Once you've set up the SAML app on your Identity Provider, the Identity Provider will generate a SAML Metadata file.

The SAML metadata file contains information about the various SAML Authorities that can be used in SAML 2.0 protocol message exchanges.

Download the SAML Metadata file from your IdP and follow the below steps for adding the SAML connection.

• Click the button New Connection.
• Choose SAML as the type.
• Give your new connection a name.
• Add your Tenant (Eg: ory.com) and Product (Eg: flex).
• Add Allowed redirect URLs.
• Add Default redirect URL.
• Paste the Raw IdP XML.
• If ForceAuthn is checked, it means that the user will be forced to re-authenticate at SAML IdP, even if they have an active session.
• Click the button Save Changes.

Now you've successfully added your first SAML connection.

Add OIDC connections

Once you've registered the OIDC app on your Identity Provider, the Identity Provider will generate a clientId and clientSecret.

The clientSecret will be used to authenticate the OIDC client (in this case Ory Polis) and obtain the access_token.

Also get the OpenID provider discovery endpoint (usually ending in /.well-known/openid-configuration) and follow the below steps for adding the OIDC connection.

• Click the button New Connection.
• Choose OIDC as the type.
• Give your new connection a name.
• Add your Tenant (Eg: ory.com) and Product (Eg: flex).
• Add Allowed redirect URLs.
• Add Default redirect URL.
• Enter the URL for OpenID Provider discovery which exposes the Provider Metadata.
• Paste the clientId and clientSecret values into Client ID [OIDC Provider]/Client Secret [OIDC Provider] fields in the UI.
• Click the button Save Changes.

Now you've successfully added your first OIDC connection.

Identity federation

Identity Federation is an enterprise feature and you need to have an enterprise license to use this feature. See Identity Federation for how it works.

From the Admin Portal go to Identity Federation > Apps.

Create an Identity Federation App

• Click New App.
• Under Select App Type, choose SAML or OIDC.
• Enter the following information:
  • Name
  • Tenant
  • Product
  • For a SAML app, the ACS URL (ACS URL of the SP; a SAML assertion is delivered over HTTP, so this must be an HTTP or HTTPS URL) and the Entity ID (Entity ID of the SP)
  • For an OIDC app, the Allowed redirect URLs
  • Optionally, Tenants, to associate more tenants with the app
  • For a SAML app, optionally, Attribute Mappings
• Click Create App.

Update an Identity Federation App

• From the list of Identity Federation Apps, click on the Edit icon of the app you want to update.
• You can update the following information:
  • Name
  • For a SAML app, the ACS URL and the Entity ID
  • For an OIDC app, the Allowed redirect URLs
  • Tenants

View IdP configuration

The apps list has two buttons that show what to give the service provider:

• SAML Configuration, for SAML apps: the SSO URL, the Entity ID / Audience URI / Audience Restriction, the X.509 Certificate and the IdP metadata.
• OIDC Configuration, for OIDC apps: the OpenID Connect discovery document of Ory Polis.