Previous Next JavaScript must be enabled to correctly display this content

## 3.4.7.4.7 Editing SAML Sign In

Delegates authentication to the Security Assertion Markup Language (SAML) Sign In authentication scheme.

- About SAML Sign In
  Learn about SAML Sign In authentication.
- About Response Signing when Using SAML
  Learn about the authentication response signing requirements when using SAML.
- About Cross-Origin Resource Sharing when Using SAML
  Learn about cross-origin resource sharing when using SAML.
- Configuring SAML Sign-In
  Edit the SAML Sign-In authentication scheme for an instance.

Parent topic: Configuring Authentication Schemes for an Instance

### 3.4.7.4.7.1 About SAML Sign In

Learn about SAML Sign In authentication.

Oracle APEX supports the use of Security Assertion Markup Language (SAML). SAML is an XML-based protocol for exchanging security information between software entities on the Web. SAML security is based on the interaction of asserting and relying parties. SAML provides single sign-on capabilities; users can authenticate at one location and then access service providers at other locations without having to log in multiple times.

Note:

SAML support requires Oracle Database 19c (Database Release Update 19.9.0.0.0 or newer) or Oracle AI Database 26ai. If your database does not meet these requirements, SAML Sign-In authentication scheme will not display.

Parent topic: Editing SAML Sign In

### 3.4.7.4.7.2 About Response Signing when Using SAML

Learn about the authentication response signing requirements when using SAML.

Oracle APEX requires the Identity Provider to digitally sign both the SAML Assertion and SAML Response. It is common for Identity Providers to only sign the SAML Assertion by default. When only the SAML Assertion is signed, APEX will reject the SAML payload with the `Invalid value for parameter` error. You must ensure your Identity Provider is signing both the SAML Assertion and SAML Response.

Parent topic: Editing SAML Sign In

### 3.4.7.4.7.3 About Cross-Origin Resource Sharing when Using SAML

Learn about cross-origin resource sharing when using SAML.

The SAML authentication end user flow requires Oracle REST Data Services (ORDS) to permit cross-origin requests from your Identity Provider to Oracle APEX. By default, ORDS does not allow cross-origin requests to its PL/SQL gateway including to Oracle APEX. You must configure ORDS to designate your Identity Provider as a trusted origin by setting `security.externalSessionTrustedOrigins` configuration parameter.

See Also:

Cross-Origin Resource Sharing Feature in Oracle REST Data Services Developer's Guide

Parent topic: Editing SAML Sign In

### 3.4.7.4.7.4 Configuring SAML Sign-In

Edit the SAML Sign-In authentication scheme for an instance.

To edit SAML Sign-In:

1. Sign in to Oracle APEX Administration Services.
2. Click Manage Instance.
3. Under Instance Settings, click Security.
4. Under Authentication Control, scroll down to Development Environment Authentication Schemes.
   The Status column indicates if the authentication scheme designated as Current.
5. Find SAML and click Edit.
   The Edit Scheme page appears.
6. Click Make Current Scheme to have applications identify and verify the user using this authentication scheme.
7. Under Edit Authentication Scheme:
   - PL/SQL Code - Enter a PL/SQL anonymous block of code that contains procedures for pre- and post-authentication entry points. To improve performance, you can also store this code in a PL/SQL package in the database.
   - Pre-Authentication Procedure Name - Specify the name of a procedure to be executed after the login page is submitted and just before credentials verification is performed. The procedure can be defined in the PL/SQL Code attribute or within the database.

     Authentication schemes where user credentials checking is done outside of Oracle APEX typically do not execute the Pre-Authentication procedure. Examples include HTTP Header Variable, Oracle Application Server Single Sign-On and custom authentication schemes that use `APEX_AUTHENTICATION.POST_LOGIN` instead of `APEX_AUTHENTICATION.LOGIN`.

   - Post-Authentication Procedure Name - Specify the name of a procedure to be executed by the Oracle APEX LOGIN procedure after the authentication step (login credentials verification). The LOGIN procedure will execute this code after it performs its normal duties, which include setting a cookie and registering the session, but before it redirects to the desired application page. The procedure can be defined in the PL/SQL Code attribute or within the database.
8. Under SAML for Internal and Workspace Applications: APEX Attributes:
   - Enable SAML for Applications - Enable if workspace applications should be able to use SAML authentication. Note that you can enable any other authentication scheme for internal applications, but still use SAML in applications if this attribute is enabled.
   - Username Attribute - SAML responses can contain additional attributes about the user. If set, APEX uses that attribute's value as the username. By default, APEX uses the assertion subject's NameID attribute.
   - NameID Format - Enter the expected format of the NameID attribute. If empty, APEX assumes `urn:oasis:names:tc:SAML:2.0:nameid-format:persistent`.
   - Issuer - Enter the `Issuer` attribute that Oracle APEX sends. This attribute defaults to the callback URL (`https://apex.example.com/ords/apex_authentication.saml_callback`), which is normally sufficient.
   - Certificate - Enter the primary certificate of the APEX side.
   - Private Key - Enter the private key of the APEX side. Note that APEX does not display an existing private key, but you can enter a new one.
   - Alternative Certificate - Enter the alternative certificate of the APEX side.
   - Alternative Private Key - Enter the alternative private key of the APEX side. Note that APEX does not display an existing private key, but you can enter a new one.
   - Supported Callback URLs - Enter APEX callback URLs (separated by new lines) if this APEX instance should support integration using multiple domains. When redirecting to the identify provider for login APEX sends `AssertionConsumerServiceIndex="nnn"` in the authentication request, where `nnn` is the index of the current callback URL in this list, starting with 0. This attribute is optional if the APEX instance only needs to support integration with a single domain.
9. Under SAML for Internal and Workspace Applications: Identity Provider Attributes:
   - Issuer - Enter the Issuer attribute from the identity provider's metadata, for example:

     `https://login.example.com/oam/fed`

   - Signing Certificate - Enter the certificate from the identity provider's metadata.
   - Alternative Signing Certificate - Enter an alternative certificate from the identity provider's metadata.
   - Sign-In URL - Enter the identity provider's sign in URL.
   - Sign-Out URL - Enter the identity provider's sign out URL. If empty, it defaults to the sign in URL, which is normally sufficient.
10. To save your changes, click Apply Changes.

Tip:

If your APEX instance is using the prerequisite database release and Database Release Update and the SAML Sign-In authentication scheme does not appear, execute the following while connected to the database (or pluggable database) as SYSDBA:

    set serveroutput on
    exec sys.validate_apex

Parent topic: Editing SAML Sign In