SSO: SAML & OIDC¶
Drovio Server supports single sign-on through SAML and OpenID Connect (OIDC). Only one of them can be enabled at a time. The field-by-field settings live in the Configuration reference.
SAML keystore¶
When the configuration points to a non-existing keystore, it is automatically created for you. However, you may want to manually create your own keystore:
keytool -genkeypair -alias myalias -keypass changeit -keystore samlKeystore.jks \
-storepass changeit -keyalg RSA -keysize 2048 -validity 3650
This generates a keystore with store password changeit and private key password
changeit, valid for 10 years.
SAML service provider metadata¶
Your identity provider needs Drovio Server's own metadata: its entity ID, its assertion consumer service URL and its signing certificate. Drovio Server builds them from the current configuration and serves them at:
The response is application/samlmetadata+xml and is generated on each request.
It always reflects the running configuration. The endpoint requires no
authentication, as identity providers fetch it anonymously: it only exposes public
information. Point your identity provider at this URL whenever it can consume
metadata over HTTP, and it will follow your changes on its own.
If your identity provider only accepts an uploaded file, use
sp_metadata_path: Drovio Server
exports the metadata there at every start, and the log line SAML SP metadata
written to … confirms it. That file is an export for you and your identity
provider. The server never reads it back. Leave the setting empty to skip the export
entirely.
SAML and OIDC callback URLs¶
Also referred to as the redirect URI, this is where the user is redirected after a successful authentication.
| Protocol | Callback URL |
|---|---|
| SAML | https://example.com/sso/auth/callback/saml |
| OIDC | https://example.com/sso/auth/callback/oidc |
Where example.com is the domain name for your Drovio Server.