SAML

Axowl supports SAML in both directions, scoped per organization.

SP — Axowl as Service Provider (inbound enterprise SSO)

An enterprise’s own IdP (ADFS/Okta/Entra) logs the user into an Axowl-backed app. Base path: /api/public/orgs/{slug}/auth/saml. These routes are public; the SAML exchange itself is the credential.

Method · Route	Purpose
GET login	Emit a SAML AuthnRequest (302 to the IdP)
GET metadata	SP metadata. EntityID is …/api/public/orgs/{slug}/auth/saml; the ACS URL is that plus /acs
POST acs	Assertion Consumer Service — validates the SAMLResponse (form post) and signs the user in

The ACS verifies the response’s signature against the connection’s IdP certificate, and checks its conditions and audience. It accepts a response only once and only in answer to a request it issued. It then creates or finds the member from the mapped attributes (an email is required) and issues the session cookies.

Errors are 400 with an error code (404 org_not_found for an unknown slug):

error	When
no_active_saml_connection	The org has no active SAML connection
saml_ambiguous	More than one active SAML connection matches
saml_sso_url_missing · saml_idp_incomplete · saml_idp_cert_invalid	The connection is missing its sign-in URL, EntityID or signing certificate, or the certificate cannot be read
missing_saml_response · invalid_saml_response_encoding · invalid_saml_response_xml	The posted SAMLResponse is absent or malformed
saml_unsolicited_or_replayed · saml_replay	The response does not answer a pending request, or was already used
saml_validation_failed · saml_no_assertion	Signature, conditions or audience check failed, or there is no assertion
saml_no_email	No email in the assertion — set the attribute mapping on the connection
saml_jit_failed · saml_login_unsuccessful	The member could not be created or signed in

The inbound connection itself (custom-saml) is configured through IdP connections.

IdP — Axowl as Identity Provider (“Sign in with Axowl”)

A registered SP receives a signed SAML assertion from Axowl. Base path: /api/public/orgs/{slug}/saml/idp.

Method · Route	Purpose
GET metadata	IdP metadata + signing certificate (the org’s RSA key). 404 org_or_signing_key_not_found
GET/POST sso	Parse the AuthnRequest (HTTP-Redirect or HTTP-POST binding, with RelayState) and check that the SP is registered
GET sso/continue	Resume after login; POST the signed Response to the SP’s ACS

SP registration (EntityID, ACS URL) lives on the Application — see Applications. The IdP signs the Response with the org’s RSA key (RSA-SHA256).

sso answers 400 with: missing_saml_request, invalid_saml_request_encoding, invalid_saml_request_xml, not_an_authn_request, missing_sp_issuer, unregistered_saml_sp (no Application has that EntityID), saml_sp_not_in_app_group, or acs_url_mismatch (the request’s ACS URL is not the registered one).