OAuth2.0 - SAML Bearer Flow

Overview

The SAML bearer grant type (RFC7522) allows a client application to exchange a SAML assertion for an access token. The SAML assertion contains information about the user's identity, such as their name, email address, and other attributes. The client application sends the JWT to the Safewhere Identify, which validates the assertion and returns an access token to the client application.

And Safewhere Identify supports both SAML 1.1 assertion and SAML 2.0 assertion bearer grant type.

OpenId Connect Discovery endpoint

The OpenID Connect Discovery endpoint now contains two new supported grant types: urn:ietf:params:oauth:grant-type:saml-bearer and urn:ietf:params:oauth:grant-type:saml2-bearer in the grant_types_supported property:

  "grant_types_supported": [
    ...
    "urn:ietf:params:oauth:grant-type:saml-bearer",
    "urn:ietf:params:oauth:grant-type:saml2-bearer"
  ],

Configuration

To use the SAML bearer grant type in Safewhere Identify, you need to configure the OAuth connection by following these steps:

  1. Open the existing OAuth/OIDC application.
  2. Go to its Security tab and enable the Allow SAML bearer flow.

allow-saml-bearer-flow

  1. Go to its Connection tab and add Bootstrap token trusted issuer.
  • Issuer: The iss (issuer) value of the applied SAML assertion.
  • Find Value: The certificate thumbprint to validate the signing of the applied SAML assertion.

bootstrap-token-trusted-issuer

Note that Bootstrap token trusted issuers do not allow duplicated certificate thumbprints.

You can also enable additional SAML assertion validation options:

  • Received Security Token Encryption certificate: Specify the certificate information so that the Safewhere Identify can decrypt the received SAML assertion when it is encrypted.

received-security-token-encryption-certificate

  • Validate target audience: When enabled, the audience information of the SAML assertion must be the Safewhere Identify Entity ID.
  • Detect replay attack when doing token exchange: When enabled, Safewhere Identify OAuth server performs replay attack detection for every token request.

other-settings

  • Signing certificate revocation check: When the selected value is not None, Safewhere Identify performs a revocation check for the signing certificate used to sign the SAML assertion.
  • Encryption certificate revocation check: When the selected value is not None, Safewhere Identify performs a revocation check for the encryption certificate used to encrypt the SAML assertion.

SAML 1.1 known issue

  • STS SAML1.1 assertion contain trust:BinarySecret that cause error about "trust' is an undeclared prefix. Line 1, position 711."

  • STS SAML1.1 assertion that is used for SAML Bearer must have saml:NameIdentifier section.

Ask for a token

Perform a POST operation to the token endpoint:

https://#identifydomain/runtime/oauth2/token.idp

With the following parameters:

Parameter Description
client_id Your application's client ID
client_secret Your application's client secret
grant_type This must be "urn:ietf:params:oauth:grant-type:saml-bearer" for SAML 1.1 flow or "urn:ietf:params:oauth:grant-type:saml2-bearer" for SAML 2.0 flow
assertion {SAML Assertion}

The {SAML Assertion} is the base64-encoded SAML assertion that you received from your SAML20 identity provider.

Request body example when grant_type is urn:ietf:params:oauth:grant-type:saml-bearer:

Key Value
client_id test_client_id
client_secret test_client_secret
grant_type urn:ietf:params:oauth:grant-type:saml-bearer
assertion PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTE2Ij8+PHNhbWw6QXNzZXJ0aW9uIE1ham9yVmVyc2lvbj0iMSIgTWlub3JWZXJzaW9uPSIxIiBBc3NlcnRpb25JRD0iX2ZjYmM4YzEwLWE4ZDgtNGE3NC05N2FhLWE2ZmI5OTFlYWYxNiIgSXNzdWVyPSJodHRwczovL2lkZW50aWZ5MDEuaWRlbnRpZnkuc2FmZXdoZXJlLmNvbS9ydW50aW1lLyIgSXNzdWVJbnN0YW50PSIyMDIzLTA0LTA3VDA5OjUwOjEzLjA0N1oiIHhtbG5zOnNhbWw9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjEuMDphc3NlcnRpb24iPjxzYW1sOkNvbmRpdGlvbnMgTm90QmVmb3JlPSIyMDIzLTA0LTA3VDA5OjUwOjEzLjAyMFoiIE5vdE9uT3JBZnRlcj0iMjAyMy0wNC0xMFQxMDo1MDoxMy4wMjBaIj48c2FtbDpBdWRpZW5jZVJlc3RyaWN0aW9uQ29uZGl0aW9uPjxzYW1sOkF1ZGllbmNlPmh0dHBzOi8vY2xhaW1hcHAwMS5zcC5zYWZld2hlcmUuY29tLzwvc2FtbDpBdWRpZW5jZT48c2FtbDpBdWRpZW5jZT5odHRwczovL3NhbWwub2F1dGg1MTUuc2FmZXdoZXJlLmxvY2FsL3J1bnRpbWUvPC9zYW1sOkF1ZGllbmNlPjwvc2FtbDpBdWRpZW5jZVJlc3RyaWN0aW9uQ29uZGl0aW9uPjwvc2FtbDpDb25kaXRpb25zPjxTaWduYXR1cmUgeG1sbnM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvMDkveG1sZHNpZyMiPjxTaWduZWRJbmZvPjxDYW5vbmljYWxpemF0aW9uTWV0aG9kIEFsZ29yaXRobT0iaHR0cDovL3d3dy53My5vcmcvMjAwMS8xMC94bWwtZXhjLWMxNG4jIiAvPjxTaWduYXR1cmVNZXRob2QgQWxnb3JpdGhtPSJodHRwOi8vd3d3LnczLm9yZy8yMDAxLzA0L3htbGRzaWctbW9yZSNyc2Etc2hhMjU2IiAvPjxSZWZlcmVuY2UgVVJJPSIjX2ZjYmM4YzEwLWE4ZDgtNGE3NC05N2FhLWE2ZmI5OTFlYWYxNiI+PFRyYW5zZm9ybXM+PFRyYW5zZm9ybSBBbGdvcml0aG09Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvMDkveG1sZHNpZyNlbnZlbG9wZWQtc2lnbmF0dXJlIiAvPjxUcmFuc2Zvcm0gQWxnb3JpdGhtPSJodHRwOi8vd3d3LnczLm9yZy8yMDAxLzEwL3htbC1leGMtYzE0biMiIC8+PC9UcmFuc2Zvcm1zPjxEaWdlc3RNZXRob2QgQWxnb3JpdGhtPSJodHRwOi8vd3d3LnczLm9yZy8yMDAxLzA0L3htbGVuYyNzaGEyNTYiIC8+PERpZ2VzdFZhbHVlPlZrTUNMQTFDVWkrK0xDakV0YnNBM1dudHRLYUVQZHgvcm5EUXVXaUc1TGs9PC9EaWdlc3RWYWx1ZT48L1JlZmVyZW5jZT48L1NpZ25lZEluZm8+PFNpZ25hdHVyZVZhbHVlPk94dG9zSGcvcVRzQysydENkUTd4eS85SWJQdlhvY2Z4NzVRdE8vcWFiSHBCMmE5TTRIakkvUkE3dUc5NWlvazBpU1haV0lpTmVXVXlJMEFmMkNPT001Y0xaSTBqcU5ZZzJXYTF4N2NJQklvY1p1aDUzOUYxMGw1Mkg4VzRqcTQwOGcwby9GdnZGdjBRV1NoaG0xK1Z6MWdObVBUdWVOVHkwVUZna29tTzduTFZzT2EreDR6bVQwQTNGd2tZZmM5cmxuRmJDYWNyME9UblhoZFp1QlRqNGNWVkRTcUFaS1hMYzN2TWVjcjdBdURHcTZORnNCd0lWZVRobXBNbUppNzBMekRDYlZkSmMxQTR4elRRMHZaM1JkMlVmYkdYUEI2cEk2YS9ReXQyeWRuOEF0ZGRRQnYvcWwwR2pKblJHUjg5ZEZqZ3NXeUpEZVZ5UDN5VGVXRXpkenRleE9mZWVLR2NWc3BhcWQwOHZPVTYwcHJhRjkvSlBoK2tvWWFka1VKM1NSSjBJNGpkV3E3alYvL0UwNDlYTm5aTnMzMmVlUi9HY21BNDRFL3lxRGpTZHgzSUNNNXNvZzVVVjZMSEJ5L2VrcVNFS3pJeStIY2hMQW1zVTY2aXBvZFRCSURiOFRYUE1KdmhtSkliTldwRm1vV212WWpiL3ZJYXI2bktIRnREPC9TaWduYXR1cmVWYWx1ZT48S2V5SW5mbz48WDUwOURhdGE+PFg1MDlDZXJ0aWZpY2F0ZT5NSUlHaHpDQ0JMdWdBd0lCQWdJVVF6NFYvYnlxOER4czI2cmVaVWFwRllYRW9HNHdRUVlKS29aSWh2Y05BUUVLTURTZ0R6QU5CZ2xnaGtnQlpRTUVBZ0VGQUtFY01Cb0dDU3FHU0liM0RRRUJDREFOQmdsZ2hrZ0JaUU1FQWdFRkFLSURBZ0VnTUdzeExUQXJCZ05WQkFNTUpFUmxiaUJFWVc1emEyVWdVM1JoZENCUFEwVlRJSFZrYzNSbFpHVnVaR1V0UTBFZ01URVRNQkVHQTFVRUN3d0tWR1Z6ZENBdElHTjBhVEVZTUJZR0ExVUVDZ3dQUkdWdUlFUmhibk5yWlNCVGRHRjBNUXN3Q1FZRFZRUUdFd0pFU3pBZUZ3MHlNakV5TVRjd09UUXhNamRhRncweU5URXlNVFl3T1RReE1qWmFNSUdkTVJ3d0dnWURWUVFEREJOcFpHVnVkR2xtZVMxdlkyVnpNeTEwWlhOME1UY3dOUVlEVlFRRkV5NVZTVHBFU3kxUE9rYzZaR015TW1FeU16TXRNVEV5WmkwMFlqUTJMV0V6TXpBdE1XSTVZV1JqT1Roa01HSTJNUjR3SEFZRFZRUUtEQlZUZFc1a2FHVmtjMlJoZEdGemRIbHlaV3h6Wlc0eEZ6QVZCZ05WQkdFTURrNVVVa1JMTFRNek1qVTNPRGN5TVFzd0NRWURWUVFHRXdKRVN6Q0NBYUl3RFFZSktvWklodmNOQVFFQkJRQURnZ0dQQURDQ0FZb0NnZ0dCQUpZYW9UbmpHNUhoUlpLV3lqaFNlL0ZqT3VJN3l2Q0RnTTkrMmF5eXRXNWhlekJpMTJWNUVTbDdGWnRRcGptd3NVam9YcnIwTlJORTVtS28wSWh6TXlOZnpQWHBPRVZVOXNpanAzWXE3VEtMak9rckdLZ2ZPZ2k5Qk5mYnovYWxzeUptWTVod2Y4Z01JbE9STE9EM3IycVF1ekc1enZxMHIyKy9mWHJ3SUFvbzJVL1N1d0JxK3RQTGdxc0dBN0l6WWhDbnZhODlOQklvZFBQMkVoY1pTeTMwZDJwWVp3RDh4WmNwNkM4dmhzcWk3M1F2ZjU5VFFDd0NSb2dueDJiSUFWZ0NvSFBXWTZ3RUJTNityMHFSY21QTm5QYUJMN0xPanNMbGdVVXVYWC9BUkR6ZWpQZlU5ZWtSU2VuMm5GZnlGV3ZhaTNKVDJWcjJVZURSbll4VmswbVF3K2ZWRGhieGs2Q2pkTHY2eDdsdFQ1NVVLWEFhZlgyaDA2TjV2WThiM0hmRjUwNVY1ZW5XNWlySFliQlNMQWpjTGVLUkN6T1cxKzIxOExqSXdKNERUY2VGQ2dmMEpuendVZTd1bkpEUkFibVJhTUYzdUFKVEFyR05wN3l4VWlINWZXZE5ESDIzV0dybzJYTGU2b2Y0UUxvVkhwaXMvK0k0YUp1cDREWVZYd0lEQVFBQm80SUJoakNDQVlJd0RBWURWUjBUQVFIL0JBSXdBREFmQmdOVkhTTUVHREFXZ0JSL0tKL1pjWmxDNG5YbjF6VjJMazBJSlcxMlhqQjdCZ2dyQmdFRkJRY0JBUVJ2TUcwd1F3WUlLd1lCQlFVSE1BS0dOMmgwZEhBNkx5OWpZVEV1WTNScExXZHZkaTVrYXk5dlkyVnpMMmx6YzNWcGJtY3ZNUzlqWVdObGNuUXZhWE56ZFdsdVp5NWpaWEl3SmdZSUt3WUJCUVVITUFHR0dtaDBkSEE2THk5allURXVZM1JwTFdkdmRpNWtheTl2WTNOd01DRUdBMVVkSUFRYU1CZ3dDQVlHQkFDUGVnRUJNQXdHQ2lxQlVJRXBBUUVCQXdjd093WUlLd1lCQlFVSEFRTUVMekF0TUNzR0NDc0dBUVVGQndzQ01COEdCd1FBaSt4SkFRSXdGSVlTYUhSMGNITTZMeTkxYVdRdVoyOTJMbVJyTUVVR0ExVWRId1ErTUR3d09xQTRvRGFHTkdoMGRIQTZMeTlqWVRFdVkzUnBMV2R2ZGk1a2F5OXZZMlZ6TDJsemMzVnBibWN2TVM5amNtd3ZhWE56ZFdsdVp5NWpjbXd3SFFZRFZSME9CQllFRkt3L2Uyc0VPVHlQN2JIUG50R05mYWpzQU1wbk1BNEdBMVVkRHdFQi93UUVBd0lGb0RCQkJna3Foa2lHOXcwQkFRb3dOS0FQTUEwR0NXQ0dTQUZsQXdRQ0FRVUFvUnd3R2dZSktvWklodmNOQVFFSU1BMEdDV0NHU0FGbEF3UUNBUVVBb2dNQ0FTQURnZ0dCQUR0R3IwSFhtTU1lQ05HS3grcGl1eTRYN1ZQMHRxUUxVamYxaEZ6aDNyRVRKazBGeWFEcnhBWGJJU3RoM2tmS3ZoY2JDWVFnSGJWYk1jUzkvSThYMkc2VnNjd0c4UWljUmI2MnRXcVhFV3lCRHdXOW5LQXUrM0daaitHZmZFeExkUy9WZXJNeTMxbjRXQmxwczhxMzdJc3hYa2hxYXFwNHdvakRzYXVCQXZCeEVKWk9kWTNGelJ6ZTBVSmgzQUxyTytuT0pMOUtoMjhDalMyUHMxN0tremVGejdQYmtvMDNwZkxFVVJTUE5vaUg4cGdWMms5M1BZVzZqNDZKelRtMVZjQUdUcTdDRHRCRGQ1eit5VU5OcGVkNTBOYzNqUjNVa3MvdjZGNml1T2pKSGF6YUsxYzFvRW0rQVF5NU9WQnZ5MFQ2ZE1sYWlxaEpkbFRpNG4zZ0dVWTBGdGtPdUsrcHp3NnRhWlBOWkVSTFdDK2E0d3BDbTJ6YzVKMWhKOVNJY0ozUlc1akVjdEpJK3h4enJYUjFYNXFod01qT3Y3UTFEYW1ra1h6K2t1S3NVenpBUnBkK1VsTEU4aGo5WFBEYlVXTjhZNXh0RThnU2lwY3VIZ2FKSWM4elI3VGpCSGRCMjM0RmR4andEYVdzK2JpWEVqRm14aE1RUGlKNFJsNjJhQT09PC9YNTA5Q2VydGlmaWNhdGU+PC9YNTA5RGF0YT48L0tleUluZm8+PC9TaWduYXR1cmU+PHNhbWw6QXR0cmlidXRlU3RhdGVtZW50PjxzYW1sOlN1YmplY3Q+PHNhbWw6TmFtZUlkZW50aWZpZXIgRm9ybWF0PSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoxLjE6bmFtZWlkLWZvcm1hdDplbWFpbEFkZHJlc3MiPm1pbmhiaXBoQGdtYWlsLmNvbTwvc2FtbDpOYW1lSWRlbnRpZmllcj48c2FtbDpTdWJqZWN0Q29uZmlybWF0aW9uPjxzYW1sOkNvbmZpcm1hdGlvbk1ldGhvZD51cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoxLjA6Y206YmVhcmVyPC9zYW1sOkNvbmZpcm1hdGlvbk1ldGhvZD48L3NhbWw6U3ViamVjdENvbmZpcm1hdGlvbj48L3NhbWw6U3ViamVjdD48c2FtbDpBdHRyaWJ1dGUgQXR0cmlidXRlTmFtZT0ibmFtZSIgQXR0cmlidXRlTmFtZXNwYWNlPSJodHRwOi8vc2NoZW1hcy54bWxzb2FwLm9yZy93cy8yMDA1LzA1L2lkZW50aXR5L2NsYWltcyI+PHNhbWw6QXR0cmlidXRlVmFsdWU+bWluaGJpcGg8L3NhbWw6QXR0cmlidXRlVmFsdWU+PC9zYW1sOkF0dHJpYnV0ZT48c2FtbDpBdHRyaWJ1dGUgQXR0cmlidXRlTmFtZT0idXJuOmlkZW50aWZ5OnJlc3QtYXBpOnJvbGUiIEF0dHJpYnV0ZU5hbWVzcGFjZT0iaWRlbnRpZnkiPjxzYW1sOkF0dHJpYnV0ZVZhbHVlPkFkbWluaXN0cmF0b3I8L3NhbWw6QXR0cmlidXRlVmFsdWU+PC9zYW1sOkF0dHJpYnV0ZT48c2FtbDpBdHRyaWJ1dGUgQXR0cmlidXRlTmFtZT0icm9sZSIgQXR0cmlidXRlTmFtZXNwYWNlPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dzLzIwMDgvMDYvaWRlbnRpdHkvY2xhaW1zIj48c2FtbDpBdHRyaWJ1dGVWYWx1ZT5DbGFpbUFkbWluPC9zYW1sOkF0dHJpYnV0ZVZhbHVlPjxzYW1sOkF0dHJpYnV0ZVZhbHVlPlVzZXJBZG1pbjwvc2FtbDpBdHRyaWJ1dGVWYWx1ZT48L3NhbWw6QXR0cmlidXRlPjxzYW1sOkF0dHJpYnV0ZSBBdHRyaWJ1dGVOYW1lPSJnaXZlbl9uYW1lIiBBdHRyaWJ1dGVOYW1lc3BhY2U9ImlkZW50aWZ5Ij48c2FtbDpBdHRyaWJ1dGVWYWx1ZT5NaW5oPC9zYW1sOkF0dHJpYnV0ZVZhbHVlPjwvc2FtbDpBdHRyaWJ1dGU+PHNhbWw6QXR0cmlidXRlIEF0dHJpYnV0ZU5hbWU9ImVtYWlsIiBBdHRyaWJ1dGVOYW1lc3BhY2U9ImlkZW50aWZ5Ij48c2FtbDpBdHRyaWJ1dGVWYWx1ZT5taW5oYmlwaEBnbWFpbC5jb208L3NhbWw6QXR0cmlidXRlVmFsdWU+PC9zYW1sOkF0dHJpYnV0ZT48c2FtbDpBdHRyaWJ1dGUgQXR0cmlidXRlTmFtZT0idXJuOmludGVybmFsOnVzZXJpZCIgQXR0cmlidXRlTmFtZXNwYWNlPSJpZGVudGlmeSI+PHNhbWw6QXR0cmlidXRlVmFsdWU+NzJmNmUyYjctZmQ5Yy00NGU4LThhYzItYTYxMzdiM2JkYjZmPC9zYW1sOkF0dHJpYnV0ZVZhbHVlPjwvc2FtbDpBdHRyaWJ1dGU+PC9zYW1sOkF0dHJpYnV0ZVN0YXRlbWVudD48L3NhbWw6QXNzZXJ0aW9uPg==

Request body example when grant_type is urn:ietf:params:oauth:grant-type:saml2-bearer:

Key Value
client_id test_client_id
client_secret test_client_secret
grant_type urn:ietf:params:oauth:grant-type:saml2-bearer
assertion PEFzc2VydGlvbiBJRD0iaWQxYmJjNGJlYzgyNjI0YjI0YTQ4ZGViNmE3ZGE1MGMwMSIgSXNzdWVJbnN0YW50PSIyMDIzLTA1LTIyVDAyOjEzOjE0LjIwMVoiIFZlcnNpb249IjIuMCIgeG1sbnM9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDphc3NlcnRpb24iPjxJc3N1ZXI+aHR0cHM6Ly9zYW1sLmlkZW50aWZ5MDF2NTE1ZnJlLmlkZW50aWZ5LnNhZmV3aGVyZS5jb20vcnVudGltZS88L0lzc3Vlcj48U2lnbmF0dXJlIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwLzA5L3htbGRzaWcjIj48U2lnbmVkSW5mbz48Q2Fub25pY2FsaXphdGlvbk1ldGhvZCBBbGdvcml0aG09Imh0dHA6Ly93d3cudzMub3JnLzIwMDEvMTAveG1sLWV4Yy1jMTRuIyIgLz48U2lnbmF0dXJlTWV0aG9kIEFsZ29yaXRobT0iaHR0cDovL3d3dy53My5vcmcvMjAwMS8wNC94bWxkc2lnLW1vcmUjcnNhLXNoYTI1NiIgLz48UmVmZXJlbmNlIFVSST0iI2lkMWJiYzRiZWM4MjYyNGIyNGE0OGRlYjZhN2RhNTBjMDEiPjxUcmFuc2Zvcm1zPjxUcmFuc2Zvcm0gQWxnb3JpdGhtPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwLzA5L3htbGRzaWcjZW52ZWxvcGVkLXNpZ25hdHVyZSIgLz48VHJhbnNmb3JtIEFsZ29yaXRobT0iaHR0cDovL3d3dy53My5vcmcvMjAwMS8xMC94bWwtZXhjLWMxNG4jIiAvPjwvVHJhbnNmb3Jtcz48RGlnZXN0TWV0aG9kIEFsZ29yaXRobT0iaHR0cDovL3d3dy53My5vcmcvMjAwMS8wNC94bWxlbmMjc2hhMjU2IiAvPjxEaWdlc3RWYWx1ZT5tbHRaRDhhRjJqeXpna0IwL1dzR2pwZ2E2QVgweHg5VGw0a2R6VitDbWtNPTwvRGlnZXN0VmFsdWU+PC9SZWZlcmVuY2U+PC9TaWduZWRJbmZvPjxTaWduYXR1cmVWYWx1ZT5RNDVJOTl3WWs5ZlBsdm13ZVVRQm5qYi81ME12UUl1eFpBRlVJZGJDZkEyUU5EbE1ZTGJCTk1nWFdrczZ2U2xtTkZDLzkyQ29VaWtjYU5vYWcrL0ExOTU3bzlNQW9VVUc3OW1EVTRvRjVGeUxzdHBDeXVTUC93ZFFGUC9UZUxWU21zZ0tsd0g2eVcwVUpxZUx4L25mczAySTA4Q2o2WGl3MnY4VjkzNzdIUCttZUFxbi9LZlBTVEN2d0FjV2tVeVR1YTBXWXBDTnhoYVQzSElqRDdGVTR1ckowRCtFZ01nUFJxZy9yZEs3dGhQbnc2Q3o5djJuVkQ0NTg2MFJtV2YvZVNteHQxZ05SYTJLZnppaU9TbHhEUkJOMEVrd3RrdTcvTWZDdXVOZEpZRkJyM1pMRjREUGM0dnBPMVFGemRiOFZmRkRBaVk1ckFCUW44TUNGSmJ0M00zei8xazJta0RLOGNOOEtGcmEyRTVTbHFRbWQrcFczNkNnK1lERW5CVEpTdVRYQ0pWaGVLdWlZcnNyZEtQWWZmQTFBVCtCUkROL2tLOVI3RDVXdktaNXlYellwRjc0blBua1hsbHdkZ3VLS0dxT0IrMlZMdTRUTGdDQytIQUtpa3VmVmttRlUrVmR1b0RMZDR5YmlSMEdPd3ZMT1QwRjFxajRKYURIbjBZQTwvU2lnbmF0dXJlVmFsdWU+PEtleUluZm8+PFg1MDlEYXRhPjxYNTA5Q2VydGlmaWNhdGU+TUlJR29EQ0NCTlNnQXdJQkFnSVVRcm1vS3hXb2RJQ1ptQ3ZWZWdJeUZUREJKZHN3UVFZSktvWklodmNOQVFFS01EU2dEekFOQmdsZ2hrZ0JaUU1FQWdFRkFLRWNNQm9HQ1NxR1NJYjNEUUVCQ0RBTkJnbGdoa2dCWlFNRUFnRUZBS0lEQWdFZ01Hc3hMVEFyQmdOVkJBTU1KRVJsYmlCRVlXNXphMlVnVTNSaGRDQlBRMFZUSUhWa2MzUmxaR1Z1WkdVdFEwRWdNVEVUTUJFR0ExVUVDd3dLVkdWemRDQXRJR04wYVRFWU1CWUdBMVVFQ2d3UFJHVnVJRVJoYm5OclpTQlRkR0YwTVFzd0NRWURWUVFHRXdKRVN6QWVGdzB5TXpBek16RXdPREEzTWpaYUZ3MHlOakF6TXpBd09EQTNNalZhTUlHMk1TMHdLd1lEVlFRRERDUkpaR1Z1ZEdsbWVTQkhiRzlpWlhSbFlXMGdUME5GVXpNZ1ZHVnpkRk5wWjI1cGJtY3hOekExQmdOVkJBVVRMbFZKT2tSTExVODZSem8yWmpVNU5tRmhNQzAyTXpnd0xUUmtNVEV0WWpsaFpTMDRPREUyWlRWak1XUmhNak14SmpBa0JnTlZCQW9NSFZSbGMzUnZjbWRoYm1sellYUnBiMjRnYm5JdUlEazJNVEV3TnpVMk1SY3dGUVlEVlFSaERBNU9WRkpFU3kwNU5qRXhNRGMxTmpFTE1Ba0dBMVVFQmhNQ1JFc3dnZ0dpTUEwR0NTcUdTSWIzRFFFQkFRVUFBNElCandBd2dnR0tBb0lCZ1FDTU04N2pUenRoSVNPUmJaY2hPRnpnOS9xaVFJcmVseks3SVdpQUVQK2c5Yk1YdytSc1M0Q2FIamNvRTJBaUR1KzIvaEJPbWoxOFNUcDJIRjQ3RFo2K2VDNjVWMGNVM1hOa1ROOU5qTnFrSGR0WVNkUm5ZOFIwRHZUMzFRb3RxTHNjakJteEhoSVdvSmYrUmE3UzM2aElzZTh4SEpzblFTdWtMQVlicEdXODdrdytEZENKVi9uZy9TM0dyOGlsR2pJbU1UanE1K2hobkp5NW9hTTVaWnE2L2lJZlJiekRZdjZCb1FNZzVZRElQN0VEYnNJZk1DSkVKeWRXNEFqZVBUb1lSM25ySEQzMUZUVUc3TERxemhYYkZzSUtrcGFOSGVlb2tiK1lVK3MrWS9WcnB5U2FCbkpSR05YblFkZktRQ3kzSmg1L0w5Y2VodUdCMUxsM2gycUlzcjNkcmpPTlh3ZDdYRFNtb0VXanRDbURoZmVmM05CcFNsdGxDdzY1bG1RTlFidDhTV29RV3RMUE1tOC96WTJ3MWxMNHd3VGUzNDJNMGcwZUYvMzF0K2lmRzJYZG5MdXkvRlo5ZXVtSFVQZzJ4SFFMSlY0M1QxOWp1WHo2SFB1Ykk0NFl0ZnNyVVMrUm54dzRoMkEwQlRWMUp6RXJweUErVG5RakU1NkZWSU1DQXdFQUFhT0NBWVl3Z2dHQ01Bd0dBMVVkRXdFQi93UUNNQUF3SHdZRFZSMGpCQmd3Rm9BVWZ5aWYyWEdaUXVKMTU5YzFkaTVOQ0NWdGRsNHdld1lJS3dZQkJRVUhBUUVFYnpCdE1FTUdDQ3NHQVFVRkJ6QUNoamRvZEhSd09pOHZZMkV4TG1OMGFTMW5iM1l1WkdzdmIyTmxjeTlwYzNOMWFXNW5MekV2WTJGalpYSjBMMmx6YzNWcGJtY3VZMlZ5TUNZR0NDc0dBUVVGQnpBQmhocG9kSFJ3T2k4dlkyRXhMbU4wYVMxbmIzWXVaR3N2YjJOemNEQWhCZ05WSFNBRUdqQVlNQWdHQmdRQWozb0JBVEFNQmdvcWdWQ0JLUUVCQVFNSE1Ec0dDQ3NHQVFVRkJ3RURCQzh3TFRBckJnZ3JCZ0VGQlFjTEFqQWZCZ2NFQUl2c1NRRUNNQlNHRW1oMGRIQnpPaTh2ZFdsa0xtZHZkaTVrYXpCRkJnTlZIUjhFUGpBOE1EcWdPS0EyaGpSb2RIUndPaTh2WTJFeExtTjBhUzFuYjNZdVpHc3ZiMk5sY3k5cGMzTjFhVzVuTHpFdlkzSnNMMmx6YzNWcGJtY3VZM0pzTUIwR0ExVWREZ1FXQkJTVHpwUUxlTjlOZE9yOWFiWnJzS0xhSUdmdVZEQU9CZ05WSFE4QkFmOEVCQU1DQmFBd1FRWUpLb1pJaHZjTkFRRUtNRFNnRHpBTkJnbGdoa2dCWlFNRUFnRUZBS0VjTUJvR0NTcUdTSWIzRFFFQkNEQU5CZ2xnaGtnQlpRTUVBZ0VGQUtJREFnRWdBNElCZ1FCWXdNRUhHSXh5YmZsZGpJV201RlgrZTNLSzZpaHpPcEdWbHFDSTAzSGM0bmhIbTRNR2dkU1Z4NjAxMU13UXdLUWltMVpCZFFoMThETm01WnYzSTgxdEI1RVBrRUZoVEFVSUNvRDZWSXVpSDJPbEsvbURMZENtdXg4QTRSSFpoU2lPTi8wTHNLNHdTM3Zqb3Vzcm5FYXN6a2FOUmE3MHJMUlhXYklIZ2dNcjdSelpaMHFBbXRzOTNYMjVrNlMxNWFKV0JDTUlaTW1uU09pb3RGVFpJN0VLN2pyRGV2dDZGRXFQcmZ1Qk9YeUsvcjZ4TDhzYmJzSkhlKzhPNTg0ZG1wSmEzSVNnWmorN1NWZW5TMlIyY3BaZkhSN1JtdnFuTk53NVA5VmFRcjVZS0JNUE8zckU3NGdzc3lPR0dwdW5TMWNSTVNKL1FheTJhdURqeUZXc3pqSXgraGovZUhzRTFMTWNlVjQvb3F4K041MlhHd1llZEhUbUZQdnRGeUlqQU02RWd0QmFzZGtXSDI3emF4MUVVbGJsWXZyYzhkMnVBSkNqd25tckc3QVdzS2hTOWs1T3c4Ti9JSjBManBzZ2hCd3lnWDV3eGtNY1dVc0U2NFNsakdBeEhKb0F2YlNqRmV5aFhtTC9yaEJyZnFYZnNma005bThicnVHMmhUUmd4S289PC9YNTA5Q2VydGlmaWNhdGU+PC9YNTA5RGF0YT48L0tleUluZm8+PC9TaWduYXR1cmU+PFN1YmplY3Q+PE5hbWVJRCBGb3JtYXQ9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjEuMTpuYW1laWQtZm9ybWF0OnVuc3BlY2lmaWVkIj51c2VyMDA8L05hbWVJRD48U3ViamVjdENvbmZpcm1hdGlvbiBNZXRob2Q9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDpjbTpiZWFyZXIiPjxTdWJqZWN0Q29uZmlybWF0aW9uRGF0YSBJblJlc3BvbnNlVG89ImlkN2E4ZTZmMDRhZjg0NDg4OTgzMGYxN2Q0MzEyZmYxOGQiIE5vdE9uT3JBZnRlcj0iMjAyMy0wNS0yMlQwMjoxODoxNC4yMDFaIiBSZWNpcGllbnQ9Imh0dHBzOi8vc2FtbHdpZjEuc2FmZXdoZXJlLmxvY2FsL2xvZ2luLmFzaHgiIC8+PC9TdWJqZWN0Q29uZmlybWF0aW9uPjwvU3ViamVjdD48Q29uZGl0aW9ucyBOb3RCZWZvcmU9IjIwMjMtMDUtMjJUMDI6MTM6MTQuMjAxWiIgTm90T25PckFmdGVyPSIyMDIzLTA1LTIyVDAzOjEzOjE0LjIwMVoiPjxBdWRpZW5jZVJlc3RyaWN0aW9uPjxBdWRpZW5jZT5odHRwczovL3NhbWx3aWYxLnNhZmV3aGVyZS5sb2NhbDwvQXVkaWVuY2U+PC9BdWRpZW5jZVJlc3RyaWN0aW9uPjwvQ29uZGl0aW9ucz48QXV0aG5TdGF0ZW1lbnQgQXV0aG5JbnN0YW50PSIyMDIzLTA1LTIyVDAyOjEzOjE0LjIwMVoiIFNlc3Npb25JbmRleD0iaTBla0ZXM3loSHh5bkdiWXhoUk92dz09Ij48QXV0aG5Db250ZXh0PjxBdXRobkNvbnRleHRDbGFzc1JlZj51cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6YWM6Y2xhc3NlczpVbnNwZWNpZmllZDwvQXV0aG5Db250ZXh0Q2xhc3NSZWY+PC9BdXRobkNvbnRleHQ+PC9BdXRoblN0YXRlbWVudD48QXR0cmlidXRlU3RhdGVtZW50PjxBdHRyaWJ1dGUgTmFtZT0iaHR0cDovL3NjaGVtYXMueG1sc29hcC5vcmcvd3MvMjAwNS8wNS9pZGVudGl0eS9jbGFpbXMvbmFtZSIgTmFtZUZvcm1hdD0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOmF0dHJuYW1lLWZvcm1hdDpiYXNpYyI+PEF0dHJpYnV0ZVZhbHVlPnVzZXIwMDwvQXR0cmlidXRlVmFsdWU+PC9BdHRyaWJ1dGU+PEF0dHJpYnV0ZSBOYW1lPSJ1cm46aW50ZXJuYWw6dXNlcmlkIiBOYW1lRm9ybWF0PSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6YXR0cm5hbWUtZm9ybWF0OmJhc2ljIj48QXR0cmlidXRlVmFsdWU+ZmM3YzIxZmYtZTc0MC00ZWEwLWIwMTctMDBkOGUwNjFiZWZiPC9BdHRyaWJ1dGVWYWx1ZT48L0F0dHJpYnV0ZT48L0F0dHJpYnV0ZVN0YXRlbWVudD48L0Fzc2VydGlvbj4=

If the request is valid, Safewhere Identify returns an access_token.

{
    "scope": "identify*empty",
    "token_type": "Bearer",
    "access_token": "eyJhbGciOiJSUzI1NiIsImtpZCI6ImtvQzdSbEFiZ09weWMzX1VrdHU0ZUI4cTV4QSIsInR5cCI6IkpXVCJ9.eyJ1bmlxdWVfbmFt...b2F1dGgyIn0.BJy1tm2LAcYfPP...XdhDEpdR76eO",
    "expires_in": 3600
}

If the request is invalid, you may encounter errors with the following event IDs:

  • Event ID 4934: This error occurs when the input SAML assertion fails to validate.

  • Event ID 4935: This error occurs when the Bootstrap Token Trusted Issuers on the Connection are not configured correctly, resulting in the inability to load the certificate.