Skip to content
Products
Platform
Developer Tools
Portal

SAML 2.0 federation guide

Last updated on

Set up SAML federation with STACKIT IdP by following these steps. The STACKIT IdP acts as the Service Provider (SP), and your organization’s system acts as the Identity Provider (IdP).

SAML flow types and support scope

Section titled “SAML flow types and support scope”

SAML federations can be started in two ways.

Service provider-initiated flow (supported)

Section titled “Service provider-initiated flow (supported)”

Users start the login flow in STACKIT (the Service Provider), which sends an authentication request to your IdP.

Diagram

IdP-initiated flow (not supported)

Section titled “IdP-initiated flow (not supported)”

Users start the login flow in your IdP Portal, which sends a SAML response directly to STACKIT.

Diagram

STACKIT support

Section titled “STACKIT support”

STACKIT supports service provider-initiated SAML flows only. IdP-initiated SAML is not supported.

User account creation behavior

Section titled “User account creation behavior”

SAML federations in STACKIT can be configured to create users automatically at first successful login (also known as JIT user creation), depending on your onboarding requirements.

  • Auto creation enabled: Users are created on first successful SAML login if they don’t already exist.
  • Auto creation disabled: Users must already exist (for example, through SCIM provisioning or manual setup) before they can log in.

Define your preferred mode during onboarding so the federation can be configured accordingly.

Step 1: Open a support ticket

Section titled “Step 1: Open a support ticket”

Open a support ticket with the following information:

General information

  • Federation type: SAML 2.0
  • Reason for integration: Brief explanation (for example, “Enable SSO for enterprise users”)
  • Email domains: All email domains your employees use for login (for example, @example.org and @foobar.com)
  • User account creation mode: Auto creation enabled or Auto creation disabled

SAML-specific information

  • IdP metadata URL: Publicly accessible URL to your IdP’s metadata file. Our system uses this URL to automatically retrieve configuration details (endpoints, certificates, etc.)

Step 2: Configure attribute mappings

Section titled “Step 2: Configure attribute mappings”

Ensure the following user attributes are present in your IdP metadata:

  • id: Unique identifier for the user
  • preferredName: User’s preferred display name
  • email: User’s email address

If your metadata doesn’t contain these attributes, specify how they’re named in your system. For example: “The id attribute in your system corresponds to our uid attribute.”

Step 3: Configure your IdP

Section titled “Step 3: Configure your IdP”

After you provide the required information, our support team configures the federation. We then provide you with a unique SAML metadata URL for the STACKIT IdP:

https://accounts.stackit.cloud/idps/FEDERATION_ID_HERE/saml/metadata

Add this URL to your organization’s IdP to establish the trust relationship.

Step 4: Verification

Section titled “Step 4: Verification”

Confirm the federation works and report the results or any problems you face.

Changing from OIDC to SAML

Section titled “Changing from OIDC to SAML”

If you have an existing OIDC federation and switch to SAML, the transition is seamless. As long as email addresses remain the same, users won’t lose access or data. User accounts are tied to email addresses, not federation methods.