Docs / User Management

SAML SSO

Available

Overview

Workspace users can sign in through an enterprise SAML 2.0 identity provider when the operator sets ISOWARD_SAML_IDP_METADATA_URL to the IdP metadata document URL.

Endpoints

• GET /v1/auth/saml/metadata — service provider metadata for the IdP
• GET /v1/auth/saml/login — start SSO (redirect to IdP)
• POST /v1/auth/saml/acs — assertion consumer service
• GET /v1/auth/saml/status — whether SAML is configured

Local test IdP (Keycloak)

docker compose --profile saml-test up -d
# Admin UI: http://127.0.0.1:8089  (admin / admin)
# Create a realm + SAML client pointing ACS at
#   {ISOWARD_PUBLIC_URL}/v1/auth/saml/acs
# Then set ISOWARD_SAML_IDP_METADATA_URL to the realm SAML descriptor URL.

See Accounts & sign-in for password and OAuth options.