@@ -890,38 +890,61 @@ You can manage SSO settings and map SSO group roles and user attributes.
890890SsoService ss = descopeClient. getManagementServices(). getSsoService();
891891// You can get SSO settings for a specific tenant ID
892892try {
893- SSOSettingsResponse resp = ss. getSettings (" tenant-id" );
893+ SSOSettingsResponse resp = ss. loadSettings (" tenant-id" );
894894} catch (DescopeException de) {
895895 // Handle the error
896896}
897897
898- // You can configure SSO settings manually by setting the required fields directly
898+ // Configure SSO - SAML
899899String tenantId = " tenant-id" ; // Which tenant this configuration is for
900900String idpUrl = " https://idp.com" ;
901901String entityId = " my-idp-entity-id" ;
902902String idpCert = " <your-cert-here>" ;
903+ String idpMetadataUrl = " https://idp.com/metadata" ;
903904String redirectUrl = " https://my-app.com/handle-saml" ; // Global redirect URL for SSO/SAML
904905List<String > domains = Arrays . asList(" domain.com" ); // Users logging in from this domain will be logged in to this tenant
905906
907+ // Map IDP groups to Descope roles, or map user attributes.
908+ // This function overrides any previous mapping (even when empty). Use carefully.
909+ List<RoleMapping > rm = Arrays . asList(new RoleMapping (Arrays . asList(" Groups" ), " Tenant Role" ));
910+ AttributeMapping am = new AttributeMapping (" Tenant Name" , " Tenant Email" , " Tenant Phone Num" , " Tenant Group" );
911+
912+
913+ // Using Manual Configuration
914+ SSOSAMLSettings manualSettings = new SSOSAMLSettings (idpUrl, entityId, idpCert, am, rm);
915+
906916try {
907- ss. configureSettings (tenantId, idpUrl, idpCert, entityId, redirectUrl , domains);
917+ ss. configureSAMLSettings (tenantId, manualSettings , domains);
908918} catch (DescopeException de) {
909919 // Handle the error
910920}
911921
912- // Alternatively, configure using an SSO metadata URL
922+ // Using metadata URL
923+ SSOSAMLSettingsByMetadata metadataSettings = new SSOSAMLSettingsByMetadata (idpMetadataUrl ,am, rm);
924+
913925try {
914- ss. configureMetadata (tenantId, " https://idp.com/my-idp-metadata " );
926+ ss. configureSAMLSettingsByMetadata (tenantId, metadataSettings, domains );
915927} catch (DescopeException de) {
916928 // Handle the error
917929}
918930
919- // Map IDP groups to Descope roles, or map user attributes.
920- // This function overrides any previous mapping (even when empty). Use carefully.
921- List<RoleMapping > rm = Arrays . asList(new RoleMapping (Arrays . asList(" Groups" ), " Tenant Role" ));
922- AttributeMapping am = new AttributeMapping (" Tenant Name" , " Tenant Email" , " Tenant Phone Num" , " Tenant Group" );
931+ // Configure SSO - OIDC
932+ String name = " Provider" ; // Name of the provider
933+ String clientId = " <oidc-client-id>" ; // The client id set on the IdP
934+ String clientSecret = " <oidc-client-secret>" ; // The client secret on the IdP
935+ String redirectUrl = " https://my-app.com/redirect" ; // Optional - a custom redirect url
936+ String authUrl = " https://idp.com/auth" ; // The IdP's authentication endpoint
937+ String tokenUrl = " https://idp.com/token" ; // The IdP's token endpoint
938+ String userDataUrl = " https://idp.com/user" ; // The IdP's user endpoint
939+ List<String > scope = Arrays . asList(" openid" , " profile" ); // The scopes
940+ String grantType = " implicit" ; // The grant type
941+ List<String > domains = Arrays . asList(" domain.com" ); // Users logging in from this domain will be logged in to this tenant
942+
943+
944+ SSOOIDCSettings oidcSettings = new SSOOIDCSettings (name, clientId, clientSecret, redirectUrl, authUrl, tokenUrl, userDataUrl, scope, grantType);
945+
923946try {
924- ss. configureMapping (tenantId, rm, am );
947+ ss. configureOIDCSettings (tenantId, oidcSettings, domains );
925948} catch (DescopeException de) {
926949 // Handle the error
927950}
0 commit comments