SSO AuthenticationSAML 2.0
Authentik
Configure Authentik as a SAML 2.0 identity provider for Safeguard.
Authentik
Example values
The tenant-specific values (the sg_ab12cde parts) show the shape only — Safeguard displays your real ACS URL and SP Entity ID in the Add Provider dialog after you click Save. This table makes it unambiguous which value goes on which side.
In Authentik — the SAML app / SP details (you enter these at the IdP):
| Field | Example value |
|---|---|
| ACS URL | https://api.safeguard.sh/auth/idp/realms/sg_ab12cde/broker/authentik/endpoint |
| SP Entity ID / Audience | https://api.safeguard.sh/auth/idp/realms/sg_ab12cde |
| Name ID format | EmailAddress |
email attribute | the signed-in user's email (via a Property mapping that sends email as an assertion attribute) |
In Safeguard — Add Provider → SAML 2.0 (you copy these from the IdP):
| Field | Example value |
|---|---|
| Alias | authentik |
| Display Name | Sign in with Authentik |
| SSO Service URL | https://<authentik-host>/application/saml/<app-slug>/sso/binding/redirect/ |
| Entity ID | https://<authentik-host>/application/saml/<app-slug>/sso/binding/redirect/ (or your configured issuer) |
| X.509 Certificate | the PEM block below |
-----BEGIN CERTIFICATE-----
MIIDdDCCAlygAwIBAgIGAX...(full cert from your IdP)...P3B/k0SolrFYPo
-----END CERTIFICATE------ In Authentik, go to Applications → Providers → Create → SAML Provider.
- Set ACS URL to the ACS URL Safeguard shows after Save, Issuer to the SP Entity ID Safeguard shows after Save, and Service Provider Binding to Post.
- Under Advanced protocol settings, set NameID Property Mapping to
email. - Under Property mappings, ensure a mapping sending
emailas an assertion attribute is selected — separate from the NameID Property Mapping above. - Save, then copy the SSO URL (Post) and download the Signing Certificate from the provider detail page.
- In Safeguard, click Add Provider → SAML 2.0 → Authentik, and enter the SSO URL, Issuer (Entity ID), and Certificate.
- Create an Application that uses this provider, and assign it to the group(s) allowed to sign in.
- Click Test in Safeguard to confirm.
Common errors: an assertion that's signed but rejected by Safeguard usually means Service Provider Binding is set to "Redirect" instead of "Post" — Safeguard's ACS only accepts HTTP-POST bindings.