## Documentation

- About
- Read First
  - What is IdentityServer
  - Installation Scenarios
- Migrations
- Bootstrapping
- Configuration & Integration
  - AdminUI Settings
  - Configuring AdminUI
  - Configuring AdminUI (NuGet)
  - Integrating with Identity Server
  - Integrating with Identity Server Custom Schema
  - Integrating with Quickstarts
  - Enabling Logging
- Installation
  - IIS
  - Azure
    - Install in Azure
    - Create Azure Web App
  - Docker
  - NuGet
- Custom Database Connections
- Custom Identity Store
  - Overview
  - Partial Implementation
  - Full Implementation
  - Tenancy With Entity Framework
  - NoSql Implementation (MongoDB)
- Custom CSP
- Users
  - Searching for Users
  - Adding Users
  - Editing Users
  - Deleting Users
  - Merge Users
  - Set User Password
  - Session Management
  - User Reports
  - Bulk User Import
- Roles
  - Creating Roles
  - Managing Roles
  - Managing Users in a Role
  - Managing Role Claims
- Claim Types
- Clients
  - Searching for Clients
  - Adding Clients
  - Adding a SAML Client
  - Adding a WS-Fed Client
  - Editing Clients
  - Deleting Clients
  - Clone Client
- Import and Export
  - Exporting Clients
  - Importing Clients
  - Importing Client Configuration with Secrets
  - Importing SAML Clients with Certificates
  - Import and Export Via the API
- Dynamic Authentication Providers
  - What is Dynamic Authentication
  - Enabling or disabling Dynamic Authentication
  - Add a Dynamic Provider
    - First Steps
    - Adding OIDC Provider
    - Adding SAML Provider
  - Edit a Dynamic Provider
    - Accessing edit view
    - Editing a OIDC Provider
    - Editing a SAML Provider
  - Deleting a Provider
  - Searching for Provider
- Resources
  - Searching for Resources
  - Creating Resources
  - Editing resources
- Webhooks
  - Webhooks
  - Endpoint Configuration
- MCP
  - Overview
  - Default Server Prompt Instructions
- User Settings Endpoints
- Access Policy
- Keys
- Auditing
- FAQs
- Troubleshooting
  - Unable to start AdminUI
  - Unable to contact IdentityServer
  - Unable to contact API
  - Unable to log in

### Editing a SAML Provider

- -Editing a SAML Dynamic Auth Provider with AdminUI
- -Details Tab
- -SP Tab
- -IdP Tab
- -Actions Available

## Editing a SAML Dynamic Auth Provider with AdminUI

Once loaded you will be directed to the details tab by default. The SAML tabs to view and edit are:

- `Details Tab` page for managing general information about the SAML provider
- `SP` page for managing the Service Provider
- `IdP` page for managing the Identity Provider

### Details Tab

The `Details` tab is where you will be able to view the "Scheme" of the dynamic provider along with modify the following elements:

- `Enabled` a switch to enable and disable the provider (Only in Duende mode)
- `Display Name` a name used to identify the provider in the login screen
- `Sign In Scheme` an identifier for the authentication scheme that will be used on signing in
- `Different Sign Out` a switch to enable and disable the use of a different Scheme on signing out
- `Sign Out Scheme` (optional) an identifier for the authentication scheme that will be used on signing out
- `Time Comparison Tolerance` a number of seconds used during SAML protocol validation. Allows time comparison checks to be inaccurate by this number of seconds.

### SP Tab

In these subtabs, you can configure the Service Provider:

#### SP Details

The `SP Details` tab is where you configure the paths and the Entity ID of the Service Provider:

- `SP Entity ID` a name that uniquely identifies this SAML authentication
- `SP Metadata Path` a path to access the Service Provider metadata. If you use Duende Dynamic Authentication, it must start with the configured prefix, the default value is '/federation/'.
- `Callback Path (ACS endpoint)` a path to redirect an authenticated user after sign-in. If you use Duende Dynamic Authentication, it must start with the configured prefix, the default value is '/federation/'.
- `Signed out Callback Path` a path to redirect a user when signed out. If you use Duende Dynamic Authentication, it must start with the configured prefix, the default value is '/federation/'.

#### SP Request

The `SP Request` tab is where you configure the signing certificate.

- `Sign authentication requests` a switch to enable and disable the signing of generated requests
- `Add Certificate` a button that opens a modal to store the certificate for signing in requests

#### SP Response

The `SP Response` tab is where you configure the encryption certificate.

- `Require signed assertions` a switch to enable and disable validation for signed assertions
- `Require encrypted assertions` a switch to enable and disable the validation for encrypted assertions
- `Add Certificate` a button that opens a modal to store the certificate for encrypted assertions on incoming responses

### IdP Tab

In these subtabs, you can configure the Identity Provider:

#### IdP Details

The `IdP Details` tab is where you point to the external Identity Provider metadata.

- `Require valid metadata signature` a switch to enable and disable validation for metadata signatures
- `IdP metadata address` the address to the Identity Provider metadata document. It has a button to verify whether the address is reachable and that contains a well-formated metadata.

#### IdP Advanced

The `IdP Advanced` tab is where you can turn on and off the "Allow Idp Initiated Sso" option.

- `Allow Idp Initiated Sso` a switch to enable and disable permission to initiate single sign-on by the Identity Provider (It's not recommended).

### Actions Available

In the edit screen there are two options available, these are described below:

- `Save All` Once valid changes have been made this button should be clickable and it will save the changes made in all 3 of the tabs.
- `Delete` Will completely remove the provider from IdentityServer

Previous Next