Integration with applications over SAML

Identity Provider Login URL — http(s)://<full_DNS_name_of_the_Identity_Provider_server>/am/idp/Account/SsoService.
Identity Provider Logout URL — http(s)://<full_DNS_name_of_the_Identity_Provider_server>/am/idp/Account/Logout.
Identity Provider Name — urn:axidianid:saml_idp.

To integrate Identity Provider with applications over the SAML protocol, use the following parameters of the am/idp/app-settings.json configuration file.

Parameter	Description
`SingleSignOnServiceUrl`	Contains the URL of the Single Sign-On Service that receives SAML messages about logging in to the client application.
`LocalCertificates`	The Identity Provider certificate. The certificate is loaded into the store of the computer where Identity Provider is deployed. The certificate is specified in the `Thumbprint` parameter.
`SingleLogoutServiceUrl`	Contains the URL of the Single Logout Service that receives SAML messages about logging out of the client application.
`PartnerCertificates`	The client application certificate. The certificate is specified in the `Thumbprint` parameter.
`Name`	The name of the client application.
`Description`	The description of the client application.
`WantAuthnRequestSigned`	Defines whether the SAML authentication request must be signed. Recommended value: true.
`SignSAMLResponse`	Defines whether the SAML responses sent to the client application must be signed. Recommended value: true.
`WantSamlResponseSigned`	Defines whether the SAML assertions must be encrypted. Recommended value: true.
`SignLogoutRequest`	Defines whether the SAML logout requests sent to the client application must be signed. Recommended value: true.
`SignLogoutResponse`	Defines whether the SAML logout responses sent to the client application must be signed. Recommended value: true.
`SignAssertion`	Defines whether the SAML assertions must be signed. Recommended value: true.
`WantLogoutRequestSigned`	Defines whether the SAML logout requests received from the client application must be signed. Recommended value: true.
`WantLogoutResponseSigned`	Defines whether the SAML logout responses received from the client application must be signed. Recommended value: true.
`AssertionConsumerServiceUrl`	Contains the URL of the Assertion Consumer Service of the client application that receives SAML requests.

For an example of integration over the SAML protocol between IDP and Nextcloud, see the knowledge base.