Skip to content
AXOWLDevelopers
Quickstart

SAML SSO

When an enterprise customer brings their own SAML IdP (ADFS, Okta, Entra), Axowl acts as the Service Provider so their users sign into an Axowl-backed app with their corporate identity.

Flow

Section titled “Flow”
  1. Configure the IdP connection — POST /api/org/{slug}/idp-connections with type: "custom-saml": the enterprise IdP’s EntityID, SSO URL, and signing certificate (via metadata URL, metadata XML, or manual entry), plus attribute mapping. Enterprise SSO requires the Pro plan or higher, and the number of active connections is capped per plan — see IdP connections.
  2. Initiate — GET /api/public/orgs/{slug}/auth/saml/login emits a SAML AuthnRequest and redirects (302) to the IdP. The Service Provider metadata to register at the IdP is served at GET /api/public/orgs/{slug}/auth/saml/metadata.
  3. ACS — the IdP POSTs a signed SAMLResponse to /api/public/orgs/{slug}/auth/saml/acs. Axowl verifies the signature, conditions, audience and InResponseTo (each response is accepted once — a replayed one answers 400 saml_replay or 400 saml_unsolicited_or_replayed; a signature, condition or audience failure answers 400 saml_validation_failed), reads the email from the mapped attributes or the NameID, provisions the membership on first sign-in, then issues the session.

Endpoint detail and the IdP (outbound) direction: SAML reference.