Configure SAML SSO using the API

Use this request to retrieve the DigiCert Private CA service provider metadata.

curl -sk 'https://<your-ca-host>/certificate-authority/api/v1/auth/saml/metadata' \
  -H 'accept: application/xml, text/xml' \
  -H 'x-api-key: <superadmin-api-key>'

The response returns SAML service provider metadata XML.

<?xml version="1.0" encoding="UTF-8"?>
<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata"
  entityID="https://<your-ca-host>/certificate-authority/api/v1/auth/saml/metadata">
  <SPSSODescriptor
    protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol"
    AuthnRequestsSigned="false"
    WantAssertionsSigned="true">
    <AssertionConsumerService
      Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
      Location="https://<your-ca-host>/certificate-authority/api/v1/auth/saml/acs"
      index="0"/>
  </SPSSODescriptor>
</EntityDescriptor>

Use this request to save the SAML SSO configuration.

curl -sk -X POST 'https://<your-ca-host>/certificate-authority/api/v1/api/saml/config' \
  -H 'Content-Type: application/json' \
  -H 'x-api-key: <superadmin-api-key>' \
  -d '{
    "enabled": true,
    "idpEntityId": "https://your-idp.example.com/app/entity-id",
    "idpSsoUrl": "https://your-idp.example.com/sso",
    "idpMetadataXml": "<full IdP metadata XML string>",
    "idpCertificate": "-----BEGIN CERTIFICATE-----\n...\n-----END CERTIFICATE-----"
  }'

Expected response:

{
  "message": "SAML configuration saved successfully"
}

Use this request to confirm that SAML SSO is enabled.

curl -sk 'https://<your-ca-host>/certificate-authority/api/v1/auth/saml/enabled' \
  -H 'x-api-key: <api-key>'

Expected response:

{
  "enabled": true
}