Get SAML Values
What to enter in your identity provider (IdP) for SAML single sign-on on this endpoint: ngris's entity ID, its answer address (ACS URL), the NameID format and the attributes, and ngris's metadata, for an IdP that takes a metadata file instead. Read it before you add the IdP. In the dashboard: step 1 of the SAML dialog, with Copy.
Reading needs no plan: only endpoints:read.
Path parameters
uuid string (uuid) Req
The endpoint's
uuid from /endpoints.An integer id in the path is refused with 400 integer_id_unsupported (see public IDs). Use the uuid.
Response (200 OK)
entity_id string
https://<address>/_tunnel_auth/saml: the Audience (SP entity ID) in your IdP.acs_url string
https://<address>/_tunnel_auth/saml/acs: where your IdP posts its answer (HTTP-POST). Also its Recipient and Destination.metadata_url string
ngris's metadata address. It answers with
?idp=<idp uuid> added, once the IdP is saved: each IdP's sp.metadata_url has it.name_id_format string
urn:oasis:names:tc:SAML:2.0:nameid-format:persistent, the only format ngris takes.attributes object
The attribute names ngris reads unless an IdP names others:
{"email": "email", "name": "name", "groups": "groups"}.assertion_signed, encryption, single_logout string
required (the assertion itself is signed, with SHA-256), none (encrypted assertions are refused) and none.metadata_xml string
ngris's metadata, to upload to an IdP that takes a file.
start_url_template string
The start link for an IdP's portal tile, with
{idp_uuid} to fill in: https://<address>/_tunnel_auth/saml/start?idp={idp_uuid}.Errors
401 Unauthorized
Missing auth.
403 Forbidden
Caller lacks the
endpoints:read permission in the active account.404 Not Found
Endpoint doesn't exist or doesn't belong to the calling account.
409 Conflict
This endpoint has no address yet.Request
curl "https://api.ngris.com/v1/endpoints/019bb1e4-e785-77d2-9966-c3cff31d0a0e/saml/sp" \
-H "X-API-KEY: <your_api_key>"
CLI
ngris api saml-idps sp 019bb1e4-e785-77d2-9966-c3cff31d0a0e
Response
{
"entity_id": "https://app.example.com/_tunnel_auth/saml",
"acs_url": "https://app.example.com/_tunnel_auth/saml/acs",
"metadata_url": "https://app.example.com/_tunnel_auth/saml/metadata",
"name_id_format": "urn:oasis:names:tc:SAML:2.0:nameid-format:persistent",
"attributes": {"email": "email", "groups": "groups", "name": "name"},
"assertion_signed": "required",
"encryption": "none",
"single_logout": "none",
"metadata_xml": "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<md:EntityDescriptor …",
"start_url_template": "https://app.example.com/_tunnel_auth/saml/start?idp={idp_uuid}"
}
Was this helpful?