SAML service extensions let you customize how the Orchestrator builds and delivers SAML assertions to your service providers. Use these hooks to control authentication, enforce authorization, load user attributes, customize assertion claims, and configure IdP-initiated single sign-on.
The SAML provider handles both service provider-initiated (SP-initiated) SSO and identity provider-initiated (IdP-initiated) SSO. Both flows use the same processing pipeline once the authentication request is established.For IdP-initiated login, the Orchestrator creates a synthetic AuthnRequest and processes it through the same pipeline as SP-initiated requests. The buildRelayStateSE hook is only called during IdP-initiated flows. The authorization step evaluates isAuthorizedSE if configured, along with any declarative authorization rules.
Determine whether the current user is already authenticated. Return true to skip the login flow, or false to send the user through authentication. Use this when you need custom logic to check authentication status — for example, validating an external session token or checking a cookie from another system.Signature:
Handle authentication when the user has not yet logged in. Use this to redirect to an external login page, validate credentials directly, or start a custom authentication flow.Signature:
Decide whether an authenticated user is allowed to proceed. Return true to allow the request or false to deny it. Use this to call an external policy engine, enforce attribute-based access control (ABAC), or apply custom business rules beyond what declarative authorization rules support.Signature:
Enrich the user’s session with additional attributes before the SAML assertion is built. Use this to pull in user details from external sources — such as an LDAP directory, a database, or a REST API — transform attribute values, or merge attributes from multiple identity providers.Signature:
Add custom attributes to SAML assertions sent to service providers. The attributes you return are included in the assertion’s attribute statement alongside any standard attributes. Use this to include additional user data, transform values, or vary the attributes based on which service provider is requesting them.Signature:
Set the RelayState value for IdP-initiated login flows. RelayState tells the service provider where to send the user after login — for example, a specific landing page or deep link. Use this to dynamically determine the destination based on user attributes or request context.Signature:
