SAML Field Reference

This reference describes each SAML configuration field available when creating a Custom SAML Application in Fixiam.

Use this guide to understand what each field is used for, where to obtain its value, whether it is required, and the impact of an incorrect configuration.

Field	Description	Who Provides the Value?	Required	Example	If Configured Incorrectly
IdP Entity ID	A unique identifier for Fixiam as the Identity Provider (IdP). This value is automatically generated by Fixiam and is used by the Service Provider to establish trust with Fixiam.	Fixiam	Yes	`https://fixiam.example.com/realms/fixiam`	The Service Provider cannot identify or trust Fixiam, causing authentication to fail.
SP Entity ID	A unique identifier for the Service Provider (application). This value must exactly match the Entity ID configured in the Service Provider.	Service Provider	Yes	`https://app.company.com`	Users may receive an Invalid Audience or Entity ID Mismatch error during login.
SP Initiated ACS URL	The Assertion Consumer Service (ACS) URL where the Service Provider receives SAML responses after users authenticate through Fixiam. This URL is used for Service Provider initiated logins.	Service Provider	Yes	`https://app.company.com/saml/acs`	Users may authenticate successfully but will not be redirected back to the application.
IdP Initiated ACS URL	The ACS URL used when users launch the application directly from the Fixiam dashboard instead of starting from the application. This field is only required if the application supports IdP initiated SSO.	Service Provider	Optional	`https://app.company.com/saml/acs`	IdP initiated login will fail or redirect users to an incorrect location.
Single Logout (SLO) URL	The endpoint that receives logout requests from Fixiam. When configured, users can sign out from both Fixiam and the Service Provider using a single logout action.	Service Provider	Optional	`https://app.company.com/logout`	Logging out of Fixiam may not terminate the user's session in the application.
NameID Format	Defines the format of the user identifier sent in the SAML assertion. The selected format must match what the Service Provider expects.	Service Provider Documentation	Yes	Email Address, Persistent, Transient, Unspecified	Users may authenticate successfully but fail to sign in because the application cannot identify them.
NameID Value	Specifies which Fixiam user attribute is sent as the NameID. This is commonly the user's email address, username, or employee ID.	Administrator	Yes	Email, Username, Employee ID	The application may be unable to match the authenticated user to an existing account.
Attribute Mapping	Defines which user attributes are included in the SAML assertion and how they map to the attributes expected by the Service Provider.	Administrator	Yes	Email → mail, First Name → givenName	Users may authenticate successfully but profile information such as email, name, or group membership may be missing or incorrect.
Metadata XML	An XML file containing the complete Fixiam Identity Provider configuration, including the IdP Entity ID, Single Sign On URL, supported bindings, and signing certificate. Most Service Providers support importing this file directly.	Fixiam	Yes	Export Metadata	The Service Provider cannot automatically configure its SAML settings. Manual configuration will be required.
Metadata URL	A URL that exposes the latest Fixiam Identity Provider metadata. Applications that support metadata URL import can retrieve configuration directly from this endpoint.	Fixiam	Optional	Copy Metadata URL	The Service Provider will not be able to automatically retrieve future metadata updates.
Signing Certificate (X.509 Certificate)	The certificate used by Fixiam to digitally sign SAML assertions. The Service Provider uses this certificate to verify that authentication responses originate from Fixiam and have not been altered.	Fixiam	Yes	Automatically generated	The Service Provider will reject authentication requests because the signature cannot be validated.
Signature Algorithm	The cryptographic algorithm used by Fixiam to sign SAML assertions. The selected algorithm must be supported by the Service Provider.	Fixiam	Yes	RSA SHA256	The Service Provider may reject the SAML response if it does not support the selected algorithm.
Relay State	An optional value that allows users to be redirected to a specific page or resource within the application after successful authentication.	Service Provider	Optional	`/dashboard`	Users may be redirected to the application's default landing page instead of the intended destination.

Where can I find these values?

Most Service Provider values can be obtained from one of the following sources:

The application's SAML configuration page.
The application's SAML metadata XML file.
The application's SAML documentation.
Your application's administrator.

Fixiam automatically provides the following values after the SAML application has been configured:

IdP Entity ID
Metadata XML
Metadata URL
Signing Certificate
Single Sign On (SSO) URL

Best Practices

Copy and paste URLs exactly as provided. SAML values are case sensitive.
Ensure the SP Entity ID configured in Fixiam exactly matches the value configured in the Service Provider.
Always verify that the ACS URL is correct before testing authentication.
Use the application's metadata XML whenever possible instead of manually entering values.
Verify that the NameID Format and NameID Value match the Service Provider's requirements.
After completing the configuration, assign the application to a group and add a test user before testing Single Sign On.