Single Sign-On
Related guide: Single Sign-On.
The identity provider calls the callbacks through the user’s browser, as part of an authentic transaction. Do not call them with manually built values.
GET /sso/login
Starts the federated login and redirects the browser to the provider.
Access: public.
| Parameter | In | Required | Description |
|---|---|---|---|
provider | query | Yes | Identifier of the configured provider. |
Responses: 302 — redirect to the identity provider.
GET /sso/logout
Starts the federated logout.
Access: SSO session.
| Parameter | In | Required | Description |
|---|---|---|---|
provider | query | Yes | Identifier of the configured provider. |
Responses: 302 — redirect to the provider or to the logout destination; 401 — session not accepted.
GET POST /sso/oauth2/cb
OAuth 2.0 and 2.1/OpenID Connect authorization callback.
Access: provider.
| Parameter | In | Required | Description |
|---|---|---|---|
state | query (GET) or form (POST) | Yes | State created at the start of the flow. |
code | query (GET) or form (POST) | Yes | Authorization code issued by the provider. |
Responses: 302 — session established and redirect.
GET POST /sso/oauth2/logout/cb
OAuth 2.0 logout callback.
Access: provider.
| Parameter | In | Required | Description |
|---|---|---|---|
state | query (GET) or form (POST) | Yes | State of the logout flow. |
provider | query (GET) or form (POST) | Yes | Provider identifier. |
Responses: 302 — redirect after logout.
POST /sso/saml2/acs
Assertion Consumer Service: receives the SAML 2.0 authentication response.
Access: provider.
| Field (form) | Required | Description |
|---|---|---|
SAMLResponse | Yes | SAML response in Base64. |
RelayState | No | State passed by the provider, when applicable. |
Responses: 302 — session established and redirect.
GET POST /sso/saml2/slo
Single Logout: receives the SAML 2.0 logout message.
Access: provider.
| Parameter | In | Required | Description |
|---|---|---|---|
SAMLResponse | query (GET) or form (POST) | No | SAML logout response in Base64. |
RelayState | query (GET) or form (POST) | No | State passed by the provider. |
Responses: 302 — redirect after logout.
GET /sso/saml2/metadata
Returns the XML metadata of the SAML 2.0 provider, used to register the API with the identity provider. You can specify the provider in the query string or in the path (/sso/saml2/metadata/{provider}).
Access: public.
| Parameter | In | Required | Description |
|---|---|---|---|
provider | query, or {provider} in the path | Yes | SAML provider identifier. |
Responses: 200 — XML metadata.