Any SAML or OIDC provider
SAML 2.0
Values for your IdP
| Setting | Value |
|---|
| ACS URL / Reply URL (HTTP-POST) | https://<workspace>.waxell.dev/api/waxell/v1/auth/saml/acs/<slug>/ |
| SP Entity ID / Audience | https://<workspace>.waxell.dev/api/waxell/v1/auth/saml/metadata/<slug>/ |
| SP metadata | the same URL. Open it in a browser to download it, or give it to an IdP that imports metadata by URL. |
| Name ID format | urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress |
| Assertions | must be signed |
| AuthnRequests | unsigned (Waxell doesn't sign them) |
Attributes Waxell reads
| Waxell field | Attribute names accepted (first match) |
|---|
| Email | email, mail, emailaddress, urn:oid:0.9.2342.19200300.100.1.3, http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress, or the Name ID if it's an email |
| First name | first_name, givenname, givenName, fn |
| Last name | last_name, surname, sn |
| Groups | whatever you set as Group claim (default groups) |
Values from your IdP
IdP entity ID (issuer), IdP single sign-on URL (HTTP-Redirect binding), and the
IdP's signing certificate.
OpenID Connect
| Setting | Value |
|---|
| Redirect URI | https://<workspace>.waxell.dev/api/waxell/v1/auth/sso/callback/ |
| Grant type | Authorization code, with PKCE (S256) |
| Default scopes | openid email profile |
| Discovery | Waxell reads <issuer>/.well-known/openid-configuration |
Waxell verifies the ID token's signature, issuer, audience and nonce, then reads
the user from the user-info endpoint:
| Claim | Required |
|---|
sub | yes |
email | yes |
email_verified | must be true; unverified addresses are refused |
name, given_name, family_name | optional |
| groups | optional, via your Group claim (default groups) |
The Issuer URL you enter must match the iss the IdP puts in its tokens.