Every organization as a SAML identity provider on login.<host> - metadata, SP- and IdP-initiated sign-in relays, the auto-continue page, SAML consent copy (Identity ID5.5)

Shipped

November 15, 2026 at 12:39 PM UTC

Author

Kamo

Commit

86a1339

[/o/{orgId}]/saml/idp/metadata (XML pass-through), GET|POST [/o/{orgId}]/saml/idp/sso (Redirect keeps the raw query for the request signature; POST binding is a cross-site form post - nothing is planted), /saml/idp/launch/{clientId} (app launcher), both continue to the org-branded sign-in like /oauth/authorize; /saml/idp/post/{postId} renders the signed answer as an auto-submitting form to the app's ACS (button always there, single use); /saml/idp/error plain refusals.