Skip to content
Axowl

SAML SSO

When an enterprise customer brings their own SAML IdP (ADFS, Okta, Entra), Axowl acts as the Service Provider so their users sign into an Axowl-backed app with their corporate identity.

Flow

Section titled “Flow”
  1. Configure the IdP connection — POST /api/org/{slug}/idp-connections with type: "custom-saml": the enterprise IdP’s EntityID, SSO URL, and signing certificate (via metadata URL, metadata XML, or manual entry), plus attribute mapping. Enterprise SSO requires the Pro plan or higher, and the number of active connections is capped per plan — see IdP connections.
  2. Initiate — GET /api/public/orgs/{slug}/auth/saml/login emits a SAML AuthnRequest and redirects (302) to the IdP (SamlAuthEndpoints.cs:57).
  3. ACS — the IdP POSTs a signed SAMLResponse to /api/public/orgs/{slug}/auth/saml/acs (:175). Axowl verifies the signature, conditions, and audience (Saml2Response.GetClaims, :286), maps attributes → NameID, and JIT-provisions a ConnectedId, then issues the session.

Endpoint detail and the IdP (outbound) direction: SAML reference.