Skip to main content
The Generic SAML connector provides a generic SAML 2.0 integration for any SAML-compliant identity provider — giving you flexibility to connect providers that use the SAML protocol for federation.
Console terminology: In the Maverics Console, this section is called Identity Fabric. The YAML configuration uses the connectors key to define identity provider integrations.

​
Overview

The Generic SAML connector supports SAML 2.0 SSO profiles including SP-initiated and IdP-initiated flows. It handles SAML assertion parsing, signature validation, and attribute extraction — making it suitable for government and education SAML federations, legacy SAML systems, and any provider that speaks SAML 2.0.

​
Use Cases

  • Unify SSO across non-standard IdPs — Connect SAML identity providers that aren’t covered by dedicated connectors, bringing them into a single orchestrated sign-on experience across your hybrid environment
  • Government and education federations — Integrate with InCommon, eduGAIN, and other SAML-based federation services that require generic SAML 2.0 support
  • Legacy SAML modernization — Extend SSO to older identity systems that only support SAML 2.0, without rewriting applications or migrating users
  • IdP resilience for SAML providers — Pair with the Continuity connector to enable failover between SAML identity providers, ensuring authentication availability if a primary IdP becomes unreachable

​
Setup

To create a Generic SAML connector in the Maverics Console:
  1. Navigate to Identity Fabric in the Console sidebar.
  2. Click Create and select Generic SAML.
  3. Enter a Name — the friendly name for your SAML provider.
  4. Enter the Metadata URL — the URL of the IdP’s SAML metadata document.
  5. Enter the Consumer Service (ACS) URL — the Assertion Consumer Service URL where the IdP sends SAML responses.
  6. Enter the Entity ID — the unique identifier for the Orchestrator as the SAML Service Provider.
  7. Optionally enter a Logout Callback URL for Single Logout (SLO) callback.
  8. Optionally enter the SP Certificate Path and SP Private Key Path for signing SAML requests.
  9. Optionally select a NameID Format to specify the NameID format used in SAML assertions.
  10. Optionally enable IdP Initiated Login to allow authentication flows started by the identity provider.
  11. Click Save.

​
Troubleshooting

  • Verify SAML metadata URL is accessible — The Orchestrator fetches the IdP’s metadata XML at startup. If the URL is unreachable or returns an error, the connector will fail to initialize. Test the URL with curl from the Orchestrator host.
  • Ensure entityID matches the IdP configuration — The samlEntityID value must match what is configured as the trusted Service Provider on the IdP side. Mismatched entity IDs cause the IdP to reject authentication requests.
  • Check the Assertion Consumer Service URL — The samlConsumerServiceURL must match the Orchestrator’s actual callback endpoint. If behind a load balancer or reverse proxy, use the external-facing URL that the IdP will redirect to.
  • SP signing certificate errors — If the IdP requires signed authentication requests, ensure samlSPCertPath and samlSPKeyPath point to valid PEM files and the key matches the certificate.

Identity Fabric

Overview of all identity providers

Identity Fabric

Complete field reference for all connector types

Generic OIDC

Generic OpenID Connect connector

Continuity

IdP failover connector