Querying a Specified SAML Provider

Function

This API is used to query details about SAML 2.0 IdPs.

Authorization Information

Each account root user has all the permissions required to call all APIs, but IAM users must be assigned the following required identity policy-based permissions. For details about the required permissions, see Permissions Policies and Supported Actions.

Action	Access Level	Resource Type (*: required)	Condition Key	Alias	Dependencies
iam:samlProviders:getV5	Read	samlProvider *	g:ResourceTag/<tag-key>	-	-

URI

GET /v5/saml-providers/{provider_id}

**Table 1** Path Parameters
Parameter	Mandatory	Type	Description
provider_id	Yes	String	Definition Provider ID. To obtain the value, call the ListSAMLProvidersV5 or ListOIDCProvidersV5 API. Constraints N/A Range The value must contain 1 to 64 characters, including only letters, digits, and hyphens (-). Default Value N/A

Request Parameters

None

Response Parameters

Status code: 200

**Table 2** Response body parameters
Parameter	Type	Description
saml_provider	saml_provider object	Definition SAML provider. Range N/A

**Table 3** saml_provider
Parameter	Type	Description
provider_id	String	Definition ID of the SAML identity provider. Range The value must contain 1 to 64 characters, including only letters, digits, and hyphens (-).
name	String	Definition Name of the SAML identity provider. Range The value must contain 1 to 64 characters, including only letters, digits, underscores (_), and hyphens (-).
description	String	Definition Description of an identity provider. Range The value can contain 0 to 255 characters and cannot contain the following special characters: @#%&<>$^*.
urn	String	Definition Uniform resource name. Range The value must contain 16 to 1,500 characters, including letters, digits, slashes (/), equal signs (=), underscores (_), colons (:), and hyphens (-).
saml_metadata_document	String	Definition XML document of an IdP that supports SAML 2.0. Range The value is a UTF-8-encoded XML file whose length ranges from 1,000 to 512,000 characters.
assertion_encryption_mode	String	Definition Encryption settings of the SAML identity provider. Range The value can be "Required" or "Allowed". Required: Only encrypted SAML assertions are supported. Allowed: Both encrypted and unencrypted SAML assertions are supported.
private_keys	Array of private_keys objects	Definition List of private keys used to decrypt SAML assertions. Each private key contains the key_id (private key ID) and timestamp (upload time) fields. Range N/A
tags	Array of tags objects	Definition List of custom tags. Each tag contains the tag_key (tag key) and tag_value (tag value) fields. Range The array length is not involved.
created_at	String	Definition Time when the SAML identity provider was created. The UTC time format is used. The format is yyyy-MM-ddTHH:mm:ss.SSSZ, for example, 2023-09-13T06:51:20.550Z. Range N/A
expires_at	String	Definition Time when the SAML identity provider expires. The UTC time format is used. The format is yyyy-MM-ddTHH:mm:ss.SSSZ, for example, 2023-09-13T06:51:20.550Z. Range N/A

**Table 4** private_keys
Parameter	Type	Description
key_id	String	Definition ID of the private key for decrypting SAML assertions. Range N/A
timestamp	String	Definition Time when the private key for decrypting SAML assertions was uploaded. The value must comply with the ISO 8601 format, for example, 2024-01-01T12:00:00Z. Range N/A

**Table 5** tags
Parameter	Type	Description
tag_key	String	Definition Tag key. Range The value can contain 1 to 64 characters, including letters, digits, spaces, and the following special characters: _.:=+-@. The value cannot start or end with a space or start with *sys*.
tag_value	String	Definition Tag value. Range The value can contain 0 to 128 characters, including letters, digits, spaces, and the following special characters: _.:/=+-@. It can also be an empty string.

Status code: 403

**Table 6** Response body parameters
Parameter	Type	Description
error_code	String	Definition: Error code. For details, see Error Code. Range: The format is PAP5.XXXX, for example, PAP5.0012.
error_msg	String	Definition: Error message. For details, see Error Message. Range: N/A.
request_id	String	Definition: Unique identifier of an API request, which is used to locate API calling exceptions. Range: N/A
encoded_authorization_message	String	Definition: Encrypted details returned when the authentication fails, which are used to locate authentication problems. The STS5 decryption API can be used for decryption. For details, see API link. Range: N/A.

Status code: 404

**Table 7** Response body parameters
Parameter	Type	Description
error_code	String	Definition: Error code. For details, see Error Code. Range: The format is PAP5.XXXX, for example, PAP5.0012.
error_msg	String	Definition: Error message. For details, see Error Message. Range: N/A.
request_id	String	Definition: Unique identifier of an API request, which is used to locate API calling exceptions. Range: N/A

Example Requests

None

Example Responses

Status code: 200

{
  "saml_provider" : {
    "provider_id" : "example-saml-provider-id",
    "name" : "example_saml_provider",
    "urn" : "iam::123456789012:user:example-saml-user",
    "saml_metadata_document" : "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<md:EntityDescriptor entityID=\"http://***.***.com/****************************\"\n                     xmlns:md=\"urn:oasis:names:tc:SAML:2.0:metadata\">\n\t<md:IDPSSODescriptor WantAuthnRequestsSigned=\"false\"\n\t                     protocolSupportEnumeration=\"urn:oasis:names:tc:SAML:2.0:protocol\">\n\t\t<md:KeyDescriptor use=\"signing\">\n\t\t\t<ds:KeyInfo xmlns:ds=\"http://www.w3.org/2000/09/xmldsig#\">\n\t\t\t\t<ds:X509Data>\n\t\t\t\t\t<ds:X509Certificate>example************************************************************************************************************************************************************************************************************************************************************************************************************************************************example</ds:X509Certificate>\n\t\t\t\t</ds:X509Data>\n\t\t\t</ds:KeyInfo>\n\t\t</md:KeyDescriptor>\n\t\t<md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</md:NameIDFormat>\n\t\t<md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</md:NameIDFormat>\n\t\t<md:SingleSignOnService Binding=\"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST\"\n\t\t                        Location=\"https://***************.okta.com/app/***************_oktaaws_1/****************************/sso/saml\"/>\n\t\t<md:SingleSignOnService Binding=\"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect\"\n\t\t                        Location=\"https://***************.okta.com/app/***************_oktaaws_1/****************************/sso/saml\"/>\n\t</md:IDPSSODescriptor>\n</md:EntityDescriptor>",
    "description" : "",
    "assertion_encryption_mode" : "Allowed",
    "private_keys" : [ ],
    "tags" : [ ],
    "created_at" : "2023-09-13T06:51:20.550Z",
    "expires_at" : "2023-09-13T06:51:20.550Z"
  }
}