SAML settings for your identity provider

Use these when setting up SAML for a team.

Sternway shows or needs	Keycloak	Okta	Microsoft Entra ID	Google Workspace
Entity ID	Client ID	Audience URI (SP Entity ID)	Identifier (Entity ID)	Entity ID
Assertion consumer service URL	Valid redirect URIs and Master SAML processing URL	Single sign-on URL	Reply URL	ACS URL
IdP metadata URL	https://<host>/realms/<realm>/protocol/saml/descriptor	Sign On tab › Metadata URL	App Federation Metadata Url	none: download the metadata and paste it
Name ID	format email, Force name ID format on	EmailAddress, Application username Email	user.mail	EMAIL, Primary email
Signing	Sign documents or assertions; Client signature required off	default	default	default

Keycloak

Go to Clients › Create client › SAML. Turn Client signature required off, because Sternway doesn’t sign its requests.

Okta and Microsoft Entra ID

Starting the app from the Okta dashboard or My Apps is an IdP-initiated sign-in, which Sternway refuses. Hide the tile, and have members start from Sternway.

Google Workspace

Go to Admin console › Apps › Web and mobile apps › Add custom SAML app. In step 2 of the wizard, download the IdP metadata and paste it into Sternway.