> ## Documentation Index
> Fetch the complete documentation index at: https://docs.strata.io/llms.txt
> Use this file to discover all available pages before exploring further.

# 1Kosmos (SAML)

The 1Kosmos connector integrates the Maverics Orchestrator with the 1Kosmos BlockID platform -- enabling passwordless and identity-verified authentication for your applications.

<Note>
  **Console terminology:** In the Maverics Console, this section is called
  **Identity Fabric**. The YAML configuration uses the `connectors` key to define
  identity provider integrations.
</Note>

## Overview

The 1Kosmos connector uses SAML 2.0 to federate authentication with the 1Kosmos BlockID platform -- enabling identity-verified, passwordless authentication through the Maverics Orchestrator.

## Use Cases

* **Passwordless authentication** -- Replace passwords with 1Kosmos BlockID identity-verified authentication, modernizing the sign-on experience across legacy and cloud applications
* **Identity proofing for high-assurance access** -- Leverage 1Kosmos document verification and biometric capabilities for high-assurance authentication where compliance or security policies demand strong identity verification
* **Unify SSO with passwordless across hybrid environments** -- Route authentication to 1Kosmos alongside other IdPs, extending passwordless access to legacy apps that were never designed for it
* **Phased IdP rationalization** -- Gradually migrate users from legacy IdPs to 1Kosmos BlockID, reducing the number of identity platforms and the associated licensing and maintenance costs

## Setup

<Tabs>
  <Tab title="Console UI">
    To create a 1Kosmos connector in the Maverics Console:

    1. Navigate to **Identity Fabric** in the Console sidebar.
    2. Click **Create** and select **1Kosmos (SAML)**.
    3. Enter a **Name** -- the friendly name that identifies your provider.
    4. Enter the **Metadata URL** -- the URL of the 1Kosmos SAML metadata document.
    5. Enter the **Consumer Service (ACS) URL** -- the Assertion Consumer Service URL where 1Kosmos sends SAML responses.
    6. Enter the **Entity ID** -- the unique identifier for the Service Provider.
    7. Click **Save**.
  </Tab>

  <Tab title="Configuration">
    ```yaml maverics.yaml theme={null}
    connectors:
      - name: onekosmos
        type: onekosmos
        domain: "{{ env.ONEKOSMOS_DOMAIN }}"
        samlMetadataURL: "https://{{ env.ONEKOSMOS_DOMAIN }}/saml2/idp/metadata"
        samlConsumerServiceURL: "https://orch.example.com/saml/callback"
        samlEntityID: "https://orch.example.com"
        tls: onekosmos-tls
    ```

    ## Configuration Reference

    | Key                      | Type   | Required | Description                                                             |
    | ------------------------ | ------ | -------- | ----------------------------------------------------------------------- |
    | `name`                   | string | Yes      | Unique connector identifier referenced in app policies                  |
    | `type`                   | string | Yes      | Must be `onekosmos`                                                     |
    | `domain`                 | string | Yes      | The 1Kosmos BlockID domain for your organization                        |
    | `samlMetadataURL`        | string | Yes      | URL to the 1Kosmos SAML metadata XML                                    |
    | `samlConsumerServiceURL` | string | Yes      | Assertion Consumer Service (ACS) URL where 1Kosmos sends SAML responses |
    | `samlEntityID`           | string | No       | Service Provider entity ID that identifies the Orchestrator to 1Kosmos  |
    | `errorPage`              | string | No       | URL to redirect users to when an error occurs during authentication     |
    | `cache`                  | string | No       | Cache name reference for SAML request data storage                      |
    | `tls`                    | string | No       | Named TLS profile for metadata retrieval and IdP communication          |

    For the complete connector field reference, see [Identity Fabric Configuration Reference](/reference/orchestrator/identity-fabric#configuration-reference).
  </Tab>
</Tabs>

## Troubleshooting

* **Verify the SAML metadata URL is accessible** from the Orchestrator host -- confirm the 1Kosmos domain is correct and reachable
* **Ensure the entity ID matches the 1Kosmos configuration** -- The `samlEntityID` value must match the trusted Service Provider identifier configured in the 1Kosmos BlockID administration portal
* **Check the Assertion Consumer Service URL** -- The `samlConsumerServiceURL` must match the Orchestrator's actual callback endpoint. If behind a load balancer, use the external-facing URL.
* **Verify the domain value** -- The `domain` field must match the 1Kosmos BlockID domain assigned to your organization

## Related Pages

<CardGroup cols={2}>
  <Card title="Identity Fabric" icon="id-badge" href="/reference/orchestrator/identity-fabric">
    Overview of all identity providers
  </Card>

  <Card title="Generic OIDC" icon="key" href="/reference/orchestrator/identity-fabric/custom-oidc">
    Generic OpenID Connect connector
  </Card>

  <Card title="Generic SAML" icon="file-shield" href="/reference/orchestrator/identity-fabric/custom-saml">
    Generic SAML 2.0 connector
  </Card>

  <Card title="HYPR" icon="fingerprint" href="/reference/orchestrator/identity-fabric/hypr">
    HYPR passwordless authentication connector
  </Card>
</CardGroup>