SAML via Gateway

Authentication via Gateway

By default, SAML authentication is handled by the Akeyless SaaS authentication service: the
browser and the Identity Provider (IdP) exchange the SAML assertion with
https://auth.akeyless.io, and the Akeyless Gateway is not part of the login flow.

Authentication via Gateway moves that flow to your own
Akeyless Gateway. When it is enabled on a SAML
Authentication Method, the IdP and the client communicate with the Gateway instead of the SaaS
authentication service, and the Gateway validates the assertion and issues the Akeyless token.

Use this option when the login flow must stay inside your network — for example when the IdP is
not reachable from the internet, when corporate policy forbids the IdP from posting assertions to
a SaaS endpoint, or in air-gapped and offline-oriented deployments where the SaaS authentication
service is not reachable from the client.

Prerequisites

• An Akeyless Gateway reachable from the client over HTTPS at its
  Configuration Manager address (default port 8000)
  See TLS Settings for enabling HTTPS on the
  Gateway.
• Admin permission on the target Gateway. Enabling or changing the Gateway binding on an
  Authentication Method modifies the Gateway configuration, so it requires the Admin capability in
  the Gateway's access permissions. See
  Gateway Access Permissions Reference
  and Authentication and Access.
• Administrative access to the IdP application, so its SAML endpoints can be repointed to the
  Gateway.

Enable Authentication via Gateway

1. Open the Gateway Configuration Manager UI.
2. Navigate to the SAML Authentication Method (or create a new one).
3. Enable the Enable Gateway Authentication option.
4. Select the Gateway cluster that should own the authentication flow.
5. Save.

To block this capability for an entire Gateway — so that no Authentication Method can be bound to
it — deploy the Gateway with AKEYLESS_ENABLE_SAML_SP_IDENTITY=false.

Configure the IdP

Point the IdP application at the Gateway instead of the Akeyless SaaS endpoints. Replace
https://<Your-Akeyless-GW-URL>:8000 with your Gateway Configuration Manager URL.

Configure Allowed Redirect URIs

Allowed Redirect URIs controls where the client is sent
after a successful IdP login. This is separate from the IdP ACS URL configured above, and the
Gateway addresses used by your clients must appear in this list.

Sign in with the CLI

The CLI must be told explicitly to authenticate through the Gateway. Pass --gateway-url with the
Gateway Configuration Manager URL:

akeyless auth \
  --access-type saml \
  --access-id <SAML Access ID> \
  --gateway-url https://<Your-Akeyless-GW-URL>:8000

Troubleshooting