SAML Authentication Properties

The following properties are available for SAML Authentication objects, grouped by the categories shown in the authentication service editors.

Behavior

Property Type Default Description

Debug

bool

false

Whether to turn on additional debug logging on the server’s Java SAML library.

SignAuthenticationRequests

bool

false

Whether the service provider should sign authentication requests to the identity provider.

Strict

bool

false

Whether the server should reject unsigned or unencrypted messages.

WantAssertionsSigned

bool

false

Whether the service provider wants assertions from the identity provider signed.

Configuration

Property Type Default Description

IdpEntityID

string

A unique value shared between the Service Provider (Dodeca) and Identity Provider (JumpCloud, Okta) which is used to establish two-way trust.

IdpSingleSignOnServiceUrl

string

The Identity Provider (JumpCloud, Okta) endpoint that receives single sign-on authentication requests for launch via the Service Provider (Dodeca).

IdpX509Certificate

string

The public key of Identity Provider (JumpCloud, Okta) that is used by the Service Provider (Dodeca) to verify assertions and responses.

SpAssertionConsumerServiceUrl

string

The service provider endpoint which is redirected to after the Identity Provider authenticates the user.

SpEntityID

string

The unique service provider entity identifier that must be shared between the Service Provider (Dodeca) and Identity Provider (JumpCloud, Okta).

SpSingleLogoutServiceUrl

string

The service provider endpoint which is accessed when the Identity Provider logs out the user.

UsernameAttribute

string

The assertion attribute whose value becomes the authenticated username. A blank value uses the SAML NameID; a login fails when the configured attribute is not present in the assertion. This is resolved on every login under every PrincipalResolutionPolicy, including Principal, so a missing attribute fails login even for an already fully-provisioned user.

Misc

Property Type Default Description

AllowSingleSignOnWithPrimaryAccount

bool

true

Whether the hosted browser should attempt to allow single sign on using the operating system’s logged in account.

AuthenticatedUsernameAttribute

string

The identity provider attribute that should be mapped to an authenticated username. If omitted, the authenticated username matches the Dodeca username for the client session.

AuthenticatedUsernameProvider

bool

false

Whether the authentication provider should set the authenticated username for the client session.

AuthenticationFormSize
displayed as AuthenticationFormSizeDefaults

Size

400, 600

Sets the default width and height of the authentication form. When Authentication Form Size Policy is AutoSize, only the width is used; the height is determined automatically from the page content.