## Documentation

- About
- Read First
  - What is IdentityServer
  - Installation Scenarios
- Migrations
- Bootstrapping
- Configuration & Integration
  - AdminUI Settings
  - Configuring AdminUI
  - Configuring AdminUI (NuGet)
  - Integrating with Identity Server
  - Integrating with Identity Server Custom Schema
  - Integrating with Quickstarts
  - Enabling Logging
- Installation
  - IIS
  - Azure
    - Install in Azure
    - Create Azure Web App
  - Docker
  - NuGet
- Custom Database Connections
- Custom Identity Store
  - Overview
  - Partial Implementation
  - Full Implementation
  - Tenancy With Entity Framework
  - NoSql Implementation (MongoDB)
- Custom CSP
- Users
  - Searching for Users
  - Adding Users
  - Editing Users
  - Deleting Users
  - Merge Users
  - Set User Password
  - Session Management
  - User Reports
  - Bulk User Import
- Roles
  - Creating Roles
  - Managing Roles
  - Managing Users in a Role
  - Managing Role Claims
- Claim Types
- Clients
  - Searching for Clients
  - Adding Clients
  - Adding a SAML Client
  - Adding a WS-Fed Client
  - Editing Clients
  - Deleting Clients
  - Clone Client
- Import and Export
  - Exporting Clients
  - Importing Clients
  - Importing Client Configuration with Secrets
  - Importing SAML Clients with Certificates
  - Import and Export Via the API
- Dynamic Authentication Providers
  - What is Dynamic Authentication
  - Enabling or disabling Dynamic Authentication
  - Add a Dynamic Provider
    - First Steps
    - Adding OIDC Provider
    - Adding SAML Provider
  - Edit a Dynamic Provider
    - Accessing edit view
    - Editing a OIDC Provider
    - Editing a SAML Provider
  - Deleting a Provider
  - Searching for Provider
- Resources
  - Searching for Resources
  - Creating Resources
  - Editing resources
- Webhooks
  - Webhooks
  - Endpoint Configuration
- MCP
  - Overview
  - Default Server Prompt Instructions
- User Settings Endpoints
- Access Policy
- Keys
- Auditing
- FAQs
- Troubleshooting
  - Unable to start AdminUI
  - Unable to contact IdentityServer
  - Unable to contact API
  - Unable to log in

### Adding SAML Provider

- -Setting up an SAML Dynamic Provider
- -Step 3: Define the Service Provider
- -Step 4: Certificate
- -Step 5: Define IdP Metadata Address
- -Step 6: Sign-In Scheme
- -Step 7: Summary

## Setting up an SAML Dynamic Provider

### Step 3: Define the Service Provider

Here is where you define the Service Provider. Be aware that your IDS acts as the Service Provider in the SAML connection:

Name | Required | Type | Description
--- | --- | --- | ---
`SP Entity Id` | Yes | Text | String that uniquely identifies this Service Provider
`Callback path (ACS endpoint)` | Yes | Text | Relative path to redirect an authenticated user after sign-in. If you use Duende Dynamic Authentication, it must start with the configured prefix, the default value is '/federation/'

### Step 4: Certificate

Here we can setup an optional certificate that can be used by your Service Provider to sign requests. This helps to ensure that requests are coming from a legitimate source.

- If you don't want to setup this certificate just click on 'Next'.

- If you want to add a certificate, enter a certificate file and password and then, click on the "Test" button to validate the certificate.

- If you change your mind, click Clear to remove the certificate.

Name | Required | Type | Description
--- | --- | --- | ---
`Certificate` | Yes | File | Certificate in PFX or P12 format
`Password` | Yes | Text | Password protecting the certificate selected

### Step 5: Define IdP Metadata Address

Here we setup the connection to the external Identity Provider:

Name | Required | Type | Description
--- | --- | --- | ---
`Idp Metadata Address` | Yes | Text | Metadata address of the Identity Provider. It has a button to verify the address is reachable and that contains a well-formated metadata.

### Step 6: Sign-In Scheme

Here we select the Sign in Scheme that will handle authentication:

Name | Required | Type | Description
--- | --- | --- | ---
`Sign in Scheme` | Yes | Text | Sign in Scheme representing an authentication handler on your IDS code

The interface offers default schemes for IdentityServer and Asp.Identity in the form of radio buttons. These options will automatically populate the Sign in Scheme field. However, you also have the flexibility to manually enter a different scheme if desired.

#### IdentityServer Overriding Sign In/Out Schemes

Depending on how Identity Server's SAML plug-in is configured this setting could be overridden. If 'SignInScheme' or 'SignOutScheme' are set in Saml2pAuthenticationOptions in Identity Server then these will override the settings configured in AdminUI.

The following is a code fragment that shows a way these setting could be configured:

    services.AddIdentityServer(...)
        .AddSamlDynamicProvider(options =>
        {
            options.SignInScheme = "MySignInScheme";
            options.SignOutScheme = "MySignOutScheme";
        });

### Step 7: Summary

The final step in the creation process is a summary that will allow you to review the settings for the dynamic provider as a whole and then also go back and make changes. There is also the option to disable the provider if you do not wish it to be active immediately.

Previous Next