---
title: SAML2Authentication
description: Resource path:
component: pingam
version: 8.1
page_id: pingam:entity-reference:sec-amster-entity-saml2authentication
canonical_url: https://docs.pingidentity.com/pingam/8.1/entity-reference/sec-amster-entity-saml2authentication.html
section_ids:
  sec-amster-entity-saml2authentication-realm-ops: Realm Operations
  sec-amster-entity-saml2authentication-realm-ops-create: create
  sec-amster-entity-saml2authentication-realm-ops-delete: delete
  sec-amster-entity-saml2authentication-realm-ops-gettype: getType
  sec-amster-entity-saml2authentication-realm-ops-getupgradedconfig: getUpgradedConfig
  sec-amster-entity-saml2authentication-realm-ops-query: query
  sec-amster-entity-saml2authentication-realm-ops-read: read
  sec-amster-entity-saml2authentication-realm-ops-update: update
  sec-amster-entity-saml2authentication-realm-ops-versioninfo: versionInfo
---

# SAML2Authentication

## Realm Operations

Resource path:

```
/realm-config/authentication/authenticationtrees/nodes/product-Saml2Node/1.0
```

Resource version: `3.0`

### create

**Usage**

```
am> create SAML2Authentication --realm Realm --id id --body body
```

**Parameters**

* *\--id*

  The unique identifier for the resource.

* *\--body*

  The resource in JSON format, described by the following JSON schema:

  ```json
  {
    "type" : "object",
    "properties" : {
      "requestBinding" : {
        "title" : "Request Binding",
        "description" : "Use this parameter to indicate what binding the SP should use when communicating with the IdP.",
        "propertyOrder" : 700,
        "type" : "string",
        "exampleValue" : ""
      },
      "isPassive" : {
        "title" : "Passive Authentication",
        "description" : "Use this parameter to indicate whether the identity provider should authenticate passively (true) or not (false).",
        "propertyOrder" : 1000,
        "type" : "boolean",
        "exampleValue" : ""
      },
      "authnContextDeclRef" : {
        "title" : "Authentication Context Declaration Reference",
        "description" : "(Optional) Use this parameter to specify authentication context declaration references.",
        "propertyOrder" : 600,
        "items" : {
          "type" : "string"
        },
        "type" : "array",
        "exampleValue" : ""
      },
      "metaAlias" : {
        "title" : "SP MetaAlias",
        "description" : "MetaAlias for Service Provider. The format of this parameter is <pre>/realm_name/SP</pre>",
        "propertyOrder" : 200,
        "type" : "string",
        "exampleValue" : ""
      },
      "binding" : {
        "title" : "Response Binding",
        "description" : "Use this parameter to indicate what binding the IdP should use when communicating with this SP.",
        "propertyOrder" : 800,
        "type" : "string",
        "exampleValue" : ""
      },
      "authComparison" : {
        "title" : "Comparison Type",
        "description" : "(Optional) Use this parameter to specify a comparison method to evaluate the requested context classes or statements. OpenAM accepts the following values: <pre>better</pre>, <pre>exact</pre>, <pre>maximum</pre>, and <pre>minimum</pre>.",
        "propertyOrder" : 400,
        "type" : "string",
        "exampleValue" : ""
      },
      "authnContextClassRef" : {
        "title" : "Authentication Context Class Reference",
        "description" : "(Optional) Use this parameter to specify authentication context class references.",
        "propertyOrder" : 500,
        "items" : {
          "type" : "string"
        },
        "type" : "array",
        "exampleValue" : ""
      },
      "nameIdFormat" : {
        "title" : "NameID Format",
        "description" : "(Optional) Use this parameter to specify a SAML Name Identifier format identifier such as <pre>urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</pre> <pre>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</pre> <pre>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</pre>",
        "propertyOrder" : 1100,
        "type" : "string",
        "exampleValue" : ""
      },
      "forceAuthn" : {
        "title" : "Force IdP Authentication",
        "description" : "Use this parameter to indicate whether the identity provider should force authentication (true) or can reuse existing security contexts (false).",
        "propertyOrder" : 900,
        "type" : "boolean",
        "exampleValue" : ""
      },
      "idpEntityId" : {
        "title" : "IdP Entity ID",
        "description" : "The entity name of the SAML2 IdP Service to use for this module (must be configured).",
        "propertyOrder" : 100,
        "type" : "string",
        "exampleValue" : ""
      },
      "validateIdpEntityId" : {
        "title" : "Validate IdP Entity ID",
        "description" : "Enable to validate the assertion issuer against the configured IdP Entity ID.",
        "propertyOrder" : 150,
        "type" : "boolean",
        "exampleValue" : ""
      },
      "allowCreate" : {
        "title" : "Allow IdP to Create NameID",
        "description" : "Use this parameter to indicate whether the identity provider can create a new identifier for the principal if none exists (true) or not (false).",
        "propertyOrder" : 300,
        "type" : "boolean",
        "exampleValue" : ""
      }
    },
    "required" : [ "requestBinding", "isPassive", "authnContextDeclRef", "metaAlias", "binding", "authComparison", "authnContextClassRef", "nameIdFormat", "forceAuthn", "idpEntityId", "validateIdpEntityId", "allowCreate" ]
  }
  ```

### delete

**Usage**

```
am> delete SAML2Authentication --realm Realm --id id
```

**Parameters**

* *\--id*

  The unique identifier for the resource.

### getType

List information related to the node such as a name, description, tags and metadata.

**Usage**

```
am> action SAML2Authentication --realm Realm --actionName getType
```

### getUpgradedConfig

Get the upgraded configuration for the node type.

**Usage**

```
am> action SAML2Authentication --realm Realm --body body --actionName getUpgradedConfig --targetVersion targetVersion
```

**Parameters**

* *\--body*

  The resource in JSON format, described by the following JSON schema:

  ```json
  {
    "type" : "object",
    "title" : "The current configuration of the node type."
  }
  ```

* *\--targetVersion*

  \=== listOutcomes

List the available outcomes for the node type.

**Usage**

```
am> action SAML2Authentication --realm Realm --body body --actionName listOutcomes
```

**Parameters**

* *\--body*

  The resource in JSON format, described by the following JSON schema:

  ```json
  {
    "description" : "Some configuration of the node. This does not need to be complete against the configuration schema.",
    "type" : "object",
    "title" : "Node configuration"
  }
  ```

### query

Get the full list of instances of this collection. This query only supports `_queryFilter=true` filter.

**Usage**

```
am> query SAML2Authentication --realm Realm --filter filter
```

**Parameters**

* *\--filter*

  A CREST formatted query filter, where "true" will query all.

### read

**Usage**

```
am> read SAML2Authentication --realm Realm --id id
```

**Parameters**

* *\--id*

  The unique identifier for the resource.

### update

**Usage**

```
am> update SAML2Authentication --realm Realm --id id --body body
```

**Parameters**

* *\--id*

  The unique identifier for the resource.

* *\--body*

  The resource in JSON format, described by the following JSON schema:

  ```json
  {
    "type" : "object",
    "properties" : {
      "requestBinding" : {
        "title" : "Request Binding",
        "description" : "Use this parameter to indicate what binding the SP should use when communicating with the IdP.",
        "propertyOrder" : 700,
        "type" : "string",
        "exampleValue" : ""
      },
      "isPassive" : {
        "title" : "Passive Authentication",
        "description" : "Use this parameter to indicate whether the identity provider should authenticate passively (true) or not (false).",
        "propertyOrder" : 1000,
        "type" : "boolean",
        "exampleValue" : ""
      },
      "authnContextDeclRef" : {
        "title" : "Authentication Context Declaration Reference",
        "description" : "(Optional) Use this parameter to specify authentication context declaration references.",
        "propertyOrder" : 600,
        "items" : {
          "type" : "string"
        },
        "type" : "array",
        "exampleValue" : ""
      },
      "metaAlias" : {
        "title" : "SP MetaAlias",
        "description" : "MetaAlias for Service Provider. The format of this parameter is <pre>/realm_name/SP</pre>",
        "propertyOrder" : 200,
        "type" : "string",
        "exampleValue" : ""
      },
      "binding" : {
        "title" : "Response Binding",
        "description" : "Use this parameter to indicate what binding the IdP should use when communicating with this SP.",
        "propertyOrder" : 800,
        "type" : "string",
        "exampleValue" : ""
      },
      "authComparison" : {
        "title" : "Comparison Type",
        "description" : "(Optional) Use this parameter to specify a comparison method to evaluate the requested context classes or statements. OpenAM accepts the following values: <pre>better</pre>, <pre>exact</pre>, <pre>maximum</pre>, and <pre>minimum</pre>.",
        "propertyOrder" : 400,
        "type" : "string",
        "exampleValue" : ""
      },
      "authnContextClassRef" : {
        "title" : "Authentication Context Class Reference",
        "description" : "(Optional) Use this parameter to specify authentication context class references.",
        "propertyOrder" : 500,
        "items" : {
          "type" : "string"
        },
        "type" : "array",
        "exampleValue" : ""
      },
      "nameIdFormat" : {
        "title" : "NameID Format",
        "description" : "(Optional) Use this parameter to specify a SAML Name Identifier format identifier such as <pre>urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</pre> <pre>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</pre> <pre>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</pre>",
        "propertyOrder" : 1100,
        "type" : "string",
        "exampleValue" : ""
      },
      "forceAuthn" : {
        "title" : "Force IdP Authentication",
        "description" : "Use this parameter to indicate whether the identity provider should force authentication (true) or can reuse existing security contexts (false).",
        "propertyOrder" : 900,
        "type" : "boolean",
        "exampleValue" : ""
      },
      "idpEntityId" : {
        "title" : "IdP Entity ID",
        "description" : "The entity name of the SAML2 IdP Service to use for this module (must be configured).",
        "propertyOrder" : 100,
        "type" : "string",
        "exampleValue" : ""
      },
      "validateIdpEntityId" : {
        "title" : "Validate IdP Entity ID",
        "description" : "Enable to validate the assertion issuer against the configured IdP Entity ID.",
        "propertyOrder" : 150,
        "type" : "boolean",
        "exampleValue" : ""
      },
      "allowCreate" : {
        "title" : "Allow IdP to Create NameID",
        "description" : "Use this parameter to indicate whether the identity provider can create a new identifier for the principal if none exists (true) or not (false).",
        "propertyOrder" : 300,
        "type" : "boolean",
        "exampleValue" : ""
      }
    },
    "required" : [ "requestBinding", "isPassive", "authnContextDeclRef", "metaAlias", "binding", "authComparison", "authnContextClassRef", "nameIdFormat", "forceAuthn", "idpEntityId", "validateIdpEntityId", "allowCreate" ]
  }
  ```

### versionInfo

List the versions available for the node type.

**Usage**

```
am> action SAML2Authentication --realm Realm --actionName versionInfo
```