Skip to main content
The Custom SAML connector provides a generic SAML 2.0 integration for any SAML-compliant identity provider — giving you flexibility to connect providers that use the SAML protocol for federation.
Console terminology: In the Maverics Console, this section is called Identity Fabric. The YAML configuration uses the connectors key to define identity provider integrations.

​
Overview

The Custom SAML connector (type: saml) supports SAML 2.0 SSO profiles including SP-initiated and IdP-initiated flows. It handles SAML assertion parsing, signature validation, and attribute extraction — making it suitable for government and education SAML federations, legacy SAML systems, and any provider that speaks SAML 2.0.

​
Use Cases

  • Non-standard SAML IdPs — Connect SAML identity providers that aren’t covered by the dedicated connectors (ADFS, etc.)
  • Government and education federations — Integrate with InCommon, eduGAIN, and other SAML-based federation services
  • Legacy SAML systems — Connect to older identity systems that only support SAML 2.0 for federation

​
Configuration

Console UI documentation is coming soon. This section will walk you through configuring this component using the Maverics Console’s visual interface, including step-by-step screenshots and field descriptions.
Custom SAML configuration screen in Maverics Console

​
Configuration Reference

KeyTypeRequiredDescription
namestringYesUnique connector identifier referenced by app policies and attribute providers
typestringYesMust be saml
samlMetadataURLstringYesURL to the IdP’s SAML metadata XML — the Orchestrator fetches this to discover SSO endpoints and signing certificates
samlConsumerServiceURLstringYesAssertion Consumer Service (ACS) URL where the IdP sends SAML responses
samlEntityIDstringNoService Provider entity ID that identifies the Orchestrator to the IdP
samlLogoutCallbackURLstringNoLogout callback URL for SAML single logout
samlSPCertPathstringNoPath to the SP certificate file for signing SAML requests
samlSPKeyPathstringNoPath to the SP private key file for signing SAML requests
samlNameIDFormatstringNoRequested NameID format (e.g., urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress)
samlIDPInitiatedLoginobjectNoIdP-initiated login configuration
cachestringNoCache name reference for SAML request data storage
tlsstringNoNamed TLS profile for metadata retrieval and IdP communication
healthCheckobjectNoHealth check monitoring configuration (see Identity Fabric Configuration Reference)
For the complete connector field reference including health check details, see Identity Fabric Configuration Reference.

​
Troubleshooting

  • Verify SAML metadata URL is accessible — The Orchestrator fetches the IdP’s metadata XML at startup. If the URL is unreachable or returns an error, the connector will fail to initialize. Test the URL with curl from the Orchestrator host.
  • Ensure entityID matches the IdP configuration — The samlEntityID value must match what is configured as the trusted Service Provider on the IdP side. Mismatched entity IDs cause the IdP to reject authentication requests.
  • Check the Assertion Consumer Service URL — The samlConsumerServiceURL must match the Orchestrator’s actual callback endpoint. If behind a load balancer or reverse proxy, use the external-facing URL that the IdP will redirect to.
  • SP signing certificate errors — If the IdP requires signed authentication requests, ensure samlSPCertPath and samlSPKeyPath point to valid PEM files and the key matches the certificate.

Identity Fabric

Overview of all identity providers

Identity Fabric

Complete field reference for all connector types

Custom OIDC

Generic OpenID Connect connector

Continuity

IdP failover connector