MKE 4 Documentation
Operations
Authentication
SAML

SAML

You can configure SAML (Security Assertion Markup Language) for MKE 4 through the authentication section of the MKE configuration file. To enable the service, set enabled to true. The remaining fields in the authentication.saml section are used to configure the SAML provider. For information on how to obtain the field values, refer to your chosen provider:

For more information, refer to the official DEX documentation Authentication through SAML 2.0.

Configure MKE

The MKE configuration file authentication.smal fields are detailed below:

FieldDescription
enabledEnable authentication through dex.
ssoMetadataURLMetadata URL provided by some IdPs, with which MKE can retrieve information for all other SAML configurations.
caCertificate Authority (CA) alternative to caData to use when validating the signature of the SAML response. Must be manually mounted in a local accessible by dex.
caDataCA alternative to ca, which you can use to place the certificate data directly into the config file.
ssoURLURL to provide to users to sign into MKE 4 with SAML. Provided by the IdP.
redirectURICallback URL for dex to which users are returned to following successful IdP authentication.
insecureSkipSignatureValidationOptional. Use to skip the signature validation. For testing purposes only.
usernameAttrUsername attribute in the returned assertions, to map to ID token claims.
emailAttrEmail attribute in the returned assertions, to map to ID token claims.
groupsAttrOptional. Groups attribute in the returned assertions, to map to ID token claims.
entityIssuerOptional. Include as the Issuer value during authentication requests.
ssoIssuerOptional. Issuer value that is expected in the SAML response.
groupsDelimOptional. If groups are assumed to be represented as a single attribute, this delimiter splits the attribute value into multiple groups.
nameIDPolicyFormatRequested name ID format.

An example configuration for SAML:

authentication:
  enabled: true
  saml:
    enabled: true
    ssoURL: https://dev64105006.okta.com/app/dev64105006_mke4saml_1/epkdtszgindywD6mF5s7/sso/saml
    redirectURI: http://{MKE host}:5556/callback
    usernameAttr: name
    emailAttr: email

Test authentication flow

ℹ️
To test authentication flow, ports 5556 (dex) and 5555 (example-app) must be externally available.
  1. Navigate to http://{MKE hostname}:5555/login.
  2. Click Login to display the login page.
  3. Select Log in with SAML.
  4. Enter your credentials and click Sign In. If authentication is successful, you will be redirected to the client applications home page.
Create OIDC application in OktaCreate SAML application in Okta