Skip to content

docs(auth): saml default redirect url #88

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
anukiransolur merged 1 commit into from
Apr 14, 2026
Merged

docs(auth): saml default redirect url #88

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
36 changes: 20 additions & 16 deletions docs/guides/auth/overview.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -223,21 +223,25 @@ When configuring SAML, Tailor Platform acts as the Service Provider (SP). Key SP

- **EntityID**: Uniquely identifies your Tailor Platform application (format: `https://api.tailor.tech/saml/{workspace_id}/{auth_namespace}/metadata.xml`)
- **ACS URL**: The callback endpoint where SAML assertions are received (format: `https://{application_url}/oauth2/callback`)
- **Certificate/Key Pair**: Used for signing and encryption of SAML messages
- **Request Signing**: The platform provides a built-in key for signing SAML authentication requests. Enable via `enableSignRequest`.

For detailed steps on setting up the IdP with SAML, refer to the [tutorial](/tutorials/setup-auth/setup-identity-provider#2settingupidpforsaml).

**IdP-initiated flow**

The Tailor Platform does not support the SAML IdP-initiated flow, because SP-initiated flows provide stronger security guarantees. For applications that still need to start a flow from the IdP side, the platform provides a redirect mechanism: when a SAML assertion arrives without a `RelayState`, the platform redirects the user to the `defaultRedirectURL` configured on the IdP. Applications typically point this URL at their own login entry point, which then starts a normal SP-initiated flow.

Here is an example of a SAML configuration with the SDK:

```typescript
import { defineAuth, idp, secrets } from "@tailor-platform/sdk";
import { defineAuth, idp } from "@tailor-platform/sdk";
import { user } from "./tailordb/user";

const auth = defineAuth("my-auth", {
idProvider: idp.saml("saml-local", {
metadataUrl: "{METADATA_URL}",
spCertBase64: secrets.value("default", "saml-cert"),
spKeyBase64: secrets.value("default", "saml-key"),
enableSignRequest: false,
defaultRedirectURL: "https://your-app.example.com/login",
}),
userProfile: {
type: user,
Expand All @@ -252,18 +256,18 @@ const auth = defineAuth("my-auth", {
});
```

| Property | Description |
| ---------------- | -------------------------------------------------------------------- |
| **idProvider** | An Identity Provider for SSO configured via `idp.saml()`. |
| - metadataUrl | Metadata URL of the identity provider. |
| - spCertBase64 | Service Provider Certificate. Managed via `secrets.value()`. |
| - spKeyBase64 | Service Provider Key. Managed via `secrets.value()`. |
| **userProfile** | Configuration for the user profile provider. |
| - type | Reference to the TailorDB type for user profiles **(required)**. |
| - usernameField | Field to map username (e.g., `email`) **(required)**. |
| - attributes | Object mapping attribute fields to `true` (e.g., `{ roles: true }`). |
| **machineUsers** | Object mapping machine user names to their configurations. |
| - attributes | Object mapping attribute fields to values. |
| Property | Description |
| -------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------ |
| **idProvider** | An Identity Provider for SSO configured via `idp.saml()`. |
| - metadataUrl | Metadata URL of the identity provider. |
| - enableSignRequest | Whether to enable signing of SAML authentication requests (optional, defaults to `false`). When enabled, the platform uses a built-in key for signing. |
| - defaultRedirectURL | URL the platform redirects to when a SAML assertion arrives without a `RelayState`. |
| **userProfile** | Configuration for the user profile provider. |
| - type | Reference to the TailorDB type for user profiles **(required)**. |
| - usernameField | Field to map username (e.g., `email`) **(required)**. |
| - attributes | Object mapping attribute fields to `true` (e.g., `{ roles: true }`). |
| **machineUsers** | Object mapping machine user names to their configurations. |
| - attributes | Object mapping attribute fields to values. |

### ID Token

Expand Down
12 changes: 7 additions & 5 deletions docs/tutorials/setup-auth/register-identity-provider.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -119,6 +119,7 @@ const auth = defineAuth("project-management-auth", {
// Alternative: use rawMetadata for inline XML
// rawMetadata: `<?xml version="1.0"?>...`,
enableSignRequest: false, // Set to true to enable request signing
defaultRedirectURL: "https://your-app.example.com/login",
},
},
});
Expand All @@ -136,11 +137,12 @@ export default defineConfig({

**Configuration Properties:**

| Property | Description |
| --------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------ |
| **metadataUrl** | Metadata URL of the identity provider **(required if rawMetadata is not provided)**. |
| **rawMetadata** | Raw SAML metadata XML string **(required if metadataUrl is not provided)**. |
| **enableSignRequest** | Whether to enable signing of SAML authentication requests (optional, defaults to `false`). When enabled, the platform uses a built-in key for signing. |
| Property | Description |
| ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------ |
| **metadataUrl** | Metadata URL of the identity provider **(required if rawMetadata is not provided)**. |
| **rawMetadata** | Raw SAML metadata XML string **(required if metadataUrl is not provided)**. |
| **enableSignRequest** | Whether to enable signing of SAML authentication requests (optional, defaults to `false`). When enabled, the platform uses a built-in key for signing. |
| **defaultRedirectURL** | URL the platform redirects to when a SAML assertion arrives without a `RelayState`. |

**Environment Variables:**

Expand Down
Loading