SAML SSO configuration

After installing and configuring the Apigee SSO, you can configure SAML IDP settings as described in this section.

SAML configuration properties

Append the following block to the file shown here on the server where apigee-openldap is installed, modifying the variables to match the details provided by your SAML IDP (for example, Okta or ADFS):

sudo vi /opt/apigee/customer/application/openldap.properties

 # SAML Settings
 lib_settings_enable_sso_saml=true
 lib_settings_saml_name=Okta
 lib_settings_saml_sso_url=https://idp.example.com/sso
 lib_settings_saml_entity_issuer=apigee-saml-login-opdk
 lib_settings_saml_redirect_uri=http://PUBLIC_IP:9099/callback
 lib_settings_saml_username_attr=name
 lib_settings_saml_email_attr=email
 lib_settings_saml_groups_attr=groups
 lib_settings_saml_ca_file=/opt/apigee/customer/certificates/okta.crt

Note: The lib_settings_saml_entity_issuer property sets the Service Provider (SP) Entity ID. The default value is apigee-saml-login-opdk for backward compatibility, but you can override it with your own custom Entity ID if required by your IDP.

Run the following command to configure the apigee-openldap component with the SAML settings shown earlier:

 /opt/apigee/apigee-service/bin/apigee-service apigee-openldap setup-sso -f /opt/silent.conf

Note: The setup-sso script automatically parses the variables from both /opt/silent.conf and /opt/apigee/customer/application/openldap.properties, applies the configuration, and starts the embedded Apigee SSO. Refer to Install and configure Apigee SSO for tokens that the configuration file needs to have for successful SSO configuration.