Configuration
This plugin is compatible with DB-less mode.
Compatible protocols
The SAML plugin is compatible with the following protocols:
grpc
, grpcs
, http
, https
Parameters
Here's a list of all the parameters which can be used in this plugin's configuration:
-
string required
The name of the plugin, in this case
saml
.- If using the Kong Admin API, Konnect API, declarative configuration, or decK files, the field is
name
. - If using the KongPlugin object in Kubernetes, the field is
plugin
.
- If using the Kong Admin API, Konnect API, declarative configuration, or decK files, the field is
-
string
An optional custom name to identify an instance of the plugin, for example
saml_my-service
.The instance name shows up in Kong Manager and in Konnect, so it's useful when running the same plugin in multiple contexts, for example, on multiple services. You can also use it to access a specific plugin instance via the Kong Admin API.
An instance name must be unique within the following context:
- Within a workspace for Kong Gateway Enterprise
- Within a control plane or control plane group for Konnect
- Globally for Kong Gateway (OSS)
-
string
The name or ID of the service the plugin targets. Set one of these parameters if adding the plugin to a service through the top-level
/plugins
endpoint. Not required if using/services/{serviceName|Id}/plugins
. -
string
The name or ID of the route the plugin targets. Set one of these parameters if adding the plugin to a route through the top-level
/plugins
endpoint. Not required if using/routes/{routeName|Id}/plugins
. -
boolean default:
true
Whether this plugin will be applied.
-
record required
-
string required starts_with:
/
A string representing a URL path, such as /path/to/resource. Must start with a forward slash (/) and must not contain empty segments (i.e., two consecutive forward slashes).
-
string required
A string representing a URL, such as https://example.com/path/to/resource?q=search.
-
string referenceable encrypted
The public certificate provided by the IdP. This is used to validate responses from the IdP. Only include the contents of the certificate. Do not include the header (
BEGIN CERTIFICATE
) and footer (END CERTIFICATE
) lines.
-
string referenceable encrypted
The private encryption key required to decrypt encrypted assertions.
-
string referenceable encrypted
The private key for signing requests. If this parameter is set, requests sent to the IdP are signed. The
request_signing_certificate
parameter must be set as well.
-
string referenceable encrypted
The certificate for signing requests.
-
string default:
SHA256
Must be one of:SHA256
,SHA384
,SHA512
The signature algorithm for signing Authn requests. Options available are: -
SHA256
-SHA384
-SHA512
-
string default:
SHA256
Must be one of:SHA256
,SHA1
The digest algorithm for Authn requests: -
SHA256
-SHA1
-
string default:
SHA256
Must be one of:SHA256
,SHA384
,SHA512
The algorithm for validating signatures in SAML responses. Options available are: -
SHA256
-SHA384
-SHA512
-
string default:
SHA256
Must be one of:SHA256
,SHA1
The algorithm for verifying digest in SAML responses: -
SHA256
-SHA1
-
string required
The unique identifier of the IdP application. Formatted as a URL containing information about the IdP so the SP can validate that the SAML assertions it receives are issued from the correct IdP.
-
string default:
EmailAddress
Must be one of:Unspecified
,EmailAddress
,Persistent
,Transient
The requested
NameId
format. Options available are: -Unspecified
-EmailAddress
-Persistent
-Transient
-
boolean default:
true
Enable signature validation for SAML responses.
-
string
An optional string (consumer UUID or username) value to use as an “anonymous” consumer. If not set, a Kong Consumer must exist for the SAML IdP user credentials, mapping the username format to the Kong Consumer username.
-
string required referenceable encrypted matches:
^[0-9a-zA-Z/_+]+$
len_min:32
len_max:32
The session secret. This must be a random string of 32 characters from the base64 alphabet (letters, numbers,
/
,_
and+
). It is used as the secret key for encrypting session data as well as state information that is sent to the IdP in the authentication exchange.
-
string default:
default
The session audience, for example “my-application”
-
string default:
session
The session cookie name.
-
boolean default:
false
Enables or disables persistent sessions
-
string default:
remember
Persistent session cookie name
-
number default:
604800
Persistent session rolling timeout in seconds.
-
number default:
2592000
Persistent session absolute timeout in seconds.
-
number default:
900
The session cookie idle time in seconds.
-
number default:
3600
The session cookie absolute timeout in seconds. Specifies how long the session can be used until it is no longer valid.
-
number default:
86400
The session cookie absolute timeout in seconds. Specifies how long the session can be used until it is no longer valid.
-
string default:
/
starts_with:/
A string representing a URL path, such as /path/to/resource. Must start with a forward slash (/) and must not contain empty segments (i.e., two consecutive forward slashes).
-
string
The session cookie domain flag.
-
string default:
Lax
Must be one of:Strict
,Lax
,None
,Default
Controls whether a cookie is sent with cross-origin requests, providing some protection against cross-site request forgery attacks.
-
boolean default:
true
Forbids JavaScript from accessing the cookie, for example, through the
Document.cookie
property.
-
boolean
The cookie is only sent to the server when a request is made with the https:scheme (except on localhost), and therefore is more resistant to man-in-the-middle attacks.
-
set of type
string
Must be one of:id
,audience
,subject
,timeout
,idling-timeout
,rolling-timeout
,absolute-timeout
-
set of type
string
Must be one of:id
,audience
,subject
,timeout
,idling-timeout
,rolling-timeout
,absolute-timeout
-
string default:
cookie
Must be one of:cookie
,memcache
,memcached
,redis
The session storage for session data: -
cookie
: stores session data with the session cookie. The session cannot be invalidated or revoked without changing the session secret, but is stateless, and doesn’t require a database. -memcached
: stores session data in memcached -redis
: stores session data in Redis
-
boolean default:
false
Configures whether or not session metadata should be stored. This includes information about the active sessions for the
specific_audience
belonging to a specific subject.
-
boolean default:
false
When set to
true
, audiences are forced to share the same subject.
-
boolean default:
false
When set to
true
, the value of subject is hashed before being stored. Only applies whensession_store_metadata
is enabled.
-
boolean default:
false
When set to
true
, the storage key (session ID) is hashed for extra security. Hashing the storage key means it is impossible to decrypt data from the storage without a cookie.
-
string
The memcached session key prefix.
-
string
The memcached unix socket path.
-
string default:
127.0.0.1
The memcached host.
-
integer default:
11211
between:0
65535
An integer representing a port number between 0 and 65535, inclusive.
-
record required
-
string default:
127.0.0.1
A string representing a host name, such as example.com.
-
integer default:
6379
between:0
65535
An integer representing a port number between 0 and 65535, inclusive.
-
integer default:
2000
between:0
2147483646
An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.
-
integer default:
2000
between:0
2147483646
An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.
-
integer default:
2000
between:0
2147483646
An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.
-
string referenceable
Username to use for Redis connections. If undefined, ACL authentication won’t be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to
default
.
-
string referenceable encrypted
Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis.
-
string referenceable
Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won’t be performed. This requires Redis v6.2.0+.
-
string referenceable encrypted
Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels.
-
integer default:
0
Database to use for the Redis connection when using the
redis
strategy
-
integer default:
256
between:1
2147483646
The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither
keepalive_pool_size
norkeepalive_backlog
is specified, no pool is created. Ifkeepalive_pool_size
isn’t specified butkeepalive_backlog
is specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low.
-
integer between:
0
2147483646
Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return
nil
. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less thankeepalive_pool_size
. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger thankeepalive_pool_size
.
-
string
Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel.
-
string Must be one of:
master
,slave
,any
Sentinel role to use for Redis connections when the
redis
strategy is defined. Defining this value implies using Redis Sentinel.
-
array of type
record
len_min:1
Sentinel node addresses to use for Redis connections when the
redis
strategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element.
-
array of type
record
len_min:1
Cluster addresses to use for Redis connections when the
redis
strategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element.
-
boolean default:
false
If set to true, uses SSL to connect to Redis.
-
boolean default:
false
If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure
lua_ssl_trusted_certificate
inkong.conf
to specify the CA (or server) certificate used by your Redis server. You may also need to configurelua_ssl_verify_depth
accordingly.
-
string
A string representing an SNI (server name indication) value for TLS.
-
integer default:
5
Maximum retry attempts for redirection.
-
boolean default:
false
If the connection to Redis is proxied (e.g. Envoy), set it
true
. Set thehost
andport
to point to the proxy address.
-
string
The Redis session key prefix.
-
string
The Redis unix socket path.
-
-
-
number
Deprecation notice: This field is planned to be removed in version 4.0.
-
number
Deprecation notice: This field is planned to be removed in version 4.0.
-
string
Deprecation notice: This field is planned to be removed in version 4.0.
-
boolean
Deprecation notice: This field is planned to be removed in version 4.0.
-
string
Deprecation notice: This field is planned to be removed in version 4.0.
-
string
Deprecation notice: This field is planned to be removed in version 4.0.
-
string
Deprecation notice: This field is planned to be removed in version 4.0.
-
integer
Deprecation notice: This field is planned to be removed in version 4.0.
-
number
Deprecation notice: This field is planned to be removed in version 4.0.
-
integer
Deprecation notice: This field is planned to be removed in version 4.0.
-
string
Deprecation notice: This field is planned to be removed in version 4.0.
-
string
Deprecation notice: This field is planned to be removed in version 4.0.
-
number
Deprecation notice: This field is planned to be removed in version 4.0.
-
string
Deprecation notice: This field is planned to be removed in version 4.0.
-
string
Deprecation notice: This field is planned to be removed in version 4.0.
-
string
Deprecation notice: This field is planned to be removed in version 4.0.
-
integer
Deprecation notice: This field is planned to be removed in version 4.0.
-
string
Deprecation notice: This field is planned to be removed in version 4.0.
-
string
Deprecation notice: This field is planned to be removed in version 4.0.
-
integer
Deprecation notice: This field is planned to be removed in version 4.0.
-
integer
Deprecation notice: This field is planned to be removed in version 4.0.
-
integer
Deprecation notice: This field is planned to be removed in version 4.0.
-
boolean
Deprecation notice: This field is planned to be removed in version 4.0.
-
boolean
Deprecation notice: This field is planned to be removed in version 4.0.
-
string
Deprecation notice: This field is planned to be removed in version 4.0.
-
array of type
record
-
integer
Deprecation notice: This field is planned to be removed in version 4.0.
-
integer
Deprecation notice: This field is planned to be removed in version 4.0.