Create SAML Test Configuration

can

lock

object

Operations the current user is able to perform on this object

enabled

boolean

Enable/Disable Saml authentication for the server

idp_cert

string

Identity Provider Certificate (provided by IdP)

idp_url

string

Identity Provider Url (provided by IdP)

idp_issuer

string

Identity Provider Issuer (provided by IdP)

idp_audience

string

Identity Provider Audience (set in IdP config). Optional in Looker. Set this only if you want Looker to validate the audience value returned by the IdP.

allowed_clock_drift

integer

Count of seconds of clock drift to allow when validating timestamps of assertions.

user_attribute_map_email

string

Name of user record attributes used to indicate email address field

user_attribute_map_first_name

string

Name of user record attributes used to indicate first name

user_attribute_map_last_name

string

Name of user record attributes used to indicate last name

new_user_migration_types

string

Merge first-time saml login to existing user account by email addresses. When a user logs in for the first time via saml this option will connect this user into their existing account by finding the account with a matching email address by testing the given types of credentials for existing users. Otherwise a new user account will be created for the user. This list (if provided) must be a comma separated list of string like 'email,ldap,google'

alternate_email_login_allowed

boolean

Allow alternate email-based login via '/login/email' for admins and for specified users with the 'login_special_email' permission. This option is useful as a fallback during ldap setup, if ldap config problems occur later, or if you need to support some users who are not in your ldap directory. Looker email/password logins are always disabled for regular users when ldap is enabled.

test_slug

lock

string

Slug to identify configurations that are created in order to run a Saml config test

modified_at

lock

string

When this config was last modified

modified_by

lock

string

User id of user who last modified this config

default_new_user_roles

Role[]

default_new_user_groups

Group[]

default_new_user_role_ids

string[]

default_new_user_group_ids

string[]

set_roles_from_groups

boolean

Set user roles in Looker based on groups from Saml

groups_attribute

string

Name of user record attributes used to indicate groups. Used when 'groups_finder_type' is set to 'grouped_attribute_values'

groups

SamlGroupRead[]

groups_with_role_ids

SamlGroupWrite[]

auth_requires_role

boolean

Users will not be allowed to login at all unless a role for them is found in Saml if set to true

user_attributes

SamlUserAttributeRead[]

user_attributes_with_ids

SamlUserAttributeWrite[]

groups_finder_type

string

Identifier for a strategy for how Looker will find groups in the SAML response. One of ['grouped_attribute_values', 'individual_attributes']

groups_member_value

string

Value for group attribute used to indicate membership. Used when 'groups_finder_type' is set to 'individual_attributes'

bypass_login_page

boolean

Bypass the login page when user authentication is required. Redirect to IdP immediately instead.

allow_normal_group_membership

boolean

Allow SAML auth'd users to be members of non-reflected Looker groups. If 'false', user will be removed from non-reflected groups on login.

allow_roles_from_normal_groups

boolean

SAML auth'd users will inherit roles from non-reflected Looker groups.

allow_direct_roles

boolean

Allows roles to be directly assigned to SAML auth'd users.

url

lock

string

Link to get this item