SAML 2.0 Setup

Simcha DB Studio is the SP; assertion signatures are verified against the IdP's X.509 signing cert and the account is reconciled on the NameID/email attribute. The SP does not sign or encrypt requests (no SP-side keypair to distribute) and does not publish a metadata endpoint, configure the IdP from the fixed values below. IdP-initiated and SP-initiated flows both land on the same ACS.

SP Coordinates (register these at the IdP)

Configuration Reference

Azure AD (Entra ID) via SAML

Register a non-gallery Enterprise Application and, under Single sign-on → SAML, set Identifier = SP entity ID, Reply URL = ACS, Sign-on URL = SP login (all three from the SP coordinates table). Emit user.mail and user.displayname as claims and add user.groups if you drive role mapping from Entra groups (note: Entra emits group object IDs by default, not names, either switch the group claim to sAMAccountName/display name or map on the GUIDs in roleMapping). The config cert is the Base64 SAML signing certificate with the PEM header/footer lines stripped; entryPoint is the Entra Login URL.

Azure AD SAML config

{
  "saml": {
    "enabled": true,
    "entryPoint": "https://login.microsoftonline.com/YOUR_TENANT_ID/saml2",
    "issuer": "https://your-app.example.com",
    "cert": "MIIC8DCCAdigAwIBAgIQd... (base64 certificate without headers)",
    "callbackUrl": "https://your-app.example.com/api/auth/idp/saml/callback",
    "signatureAlgorithm": "sha256",
    "identifierFormat": "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress",
    "wantAssertionsSigned": true,
    "attributeMapping": {
      "email": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress",
      "name": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name"
    }
  }
}

Okta via SAML

Create a SAML 2.0 app integration: Single sign-on URL = ACS, Audience URI = SP entity ID, Name ID format = EmailAddress, Application username = Email. Add attribute statements email → user.email and displayName → user.displayName, and a group attribute statement named groups with filter Matches regex .* (or a tighter filter scoped to the groups you map). From Sign On → View SAML setup instructions, take the IdP SSO URL as entryPoint and the X.509 cert as cert.

Okta SAML config

{
  "saml": {
    "enabled": true,
    "entryPoint": "https://your-org.okta.com/app/simchadbstudio/XXXX/sso/saml",
    "issuer": "https://your-app.example.com",
    "cert": "MIIDpDCCAoygAwIBAgIGAX... (base64 certificate without headers)",
    "callbackUrl": "https://your-app.example.com/api/auth/idp/saml/callback",
    "signatureAlgorithm": "sha256",
    "identifierFormat": "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress",
    "wantAssertionsSigned": true,
    "attributeMapping": {
      "email": "email",
      "name": "displayName"
    }
  }
}

SAML Troubleshooting