Edge Route SAML Module

Replace HTTPS Edge Route SAML Module

Request

PUT /edges/https/{edge_id}/routes/{id}/saml

Example Request

curl \
-X PUT \
-H "Authorization: Bearer {API_KEY}" \
-H "Content-Type: application/json" \
-H "Ngrok-Version: 2" \
-d '{"enabled":true,"idp_metadata":"\n<EntityDescriptor xmlns=\"urn:oasis:names:tc:SAML:2.0:metadata\" validUntil=\"2020-09-14T12:53:23.691Z\" cacheDuration=\"PT1M\" entityID=\"http://127.0.0.1:12345/metadata\"><IDPSSODescriptor xmlns=\"urn:oasis:names:tc:SAML:2.0:metadata\" protocolSupportEnumeration=\"urn:oasis:names:tc:SAML:2.0:protocol\"><NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</NameIDFormat><SingleSignOnService Binding=\"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect\" Location=\"http://127.0.0.1:12345/sso\"></SingleSignOnService><SingleSignOnService Binding=\"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST\" Location=\"http://127.0.0.1:12345/sso\"></SingleSignOnService></IDPSSODescriptor></EntityDescriptor>\n"}' \
https://api.ngrok.com/edges/https/edghts_2gsqMavmAlWY3WXCUK9pHGA9pEX/routes/edghtsrt_2gsqMdzQXlfx0PtsKe4p6VQhf4L/saml

Parameters

Name	Type	Description
enabled	boolean	true if the module will be applied to traffic, false to disable. default true if unspecified
options_passthrough	boolean	Do not enforce authentication on HTTP OPTIONS requests. necessary if you are supporting CORS.
cookie_prefix	string	the prefix of the session cookie that ngrok sets on the http client to cache authentication. default is 'ngrok.'
inactivity_timeout	uint32	Integer number of seconds of inactivity after which if the user has not accessed the endpoint, their session will time out and they will be forced to reauthenticate.
maximum_duration	uint32	Integer number of seconds of the maximum duration of an authenticated session. After this period is exceeded, a user must reauthenticate.
idp_metadata	string	The full XML IdP EntityDescriptor. Your IdP may provide this to you as a a file to download or as a URL.
force_authn	boolean	If true, indicates that whenever we redirect a user to the IdP for authentication that the IdP must prompt the user for authentication credentials even if the user already has a valid session with the IdP.
allow_idp_initiated	boolean	If true, the IdP may initiate a login directly (e.g. the user does not need to visit the endpoint first and then be redirected). The IdP should set the RelayState parameter to the target URL of the resource they want the user to be redirected to after the SAML login assertion has been processed.
authorized_groups	List<string>	If present, only users who are a member of one of the listed groups may access the target endpoint.
nameid_format	string	Defines the name identifier format the SP expects the IdP to use in its assertions to identify subjects. If unspecified, a default value of urn:oasis:names:tc:SAML:2.0:nameid-format:persistent will be used. A subset of the allowed values enumerated by the SAML specification are supported.

Response

Returns a 200 response on success

Example Response

{
	"allow_idp_initiated": true,
	"assertion_consumer_service_url": "https://idp.local-ngrok.com/saml/edghtsrt_2gsqMdzQXlfx0PtsKe4p6VQhf4L/acs",
	"authorized_groups": [],
	"cookie_prefix": "",
	"enabled": true,
	"entity_id": "https://idp.local-ngrok.com/saml/edghtsrt_2gsqMdzQXlfx0PtsKe4p6VQhf4L",
	"force_authn": false,
	"idp_metadata": "\n<EntityDescriptor xmlns=\"urn:oasis:names:tc:SAML:2.0:metadata\" validUntil=\"2020-09-14T12:53:23.691Z\" cacheDuration=\"PT1M\" entityID=\"http://127.0.0.1:12345/metadata\"><IDPSSODescriptor xmlns=\"urn:oasis:names:tc:SAML:2.0:metadata\" protocolSupportEnumeration=\"urn:oasis:names:tc:SAML:2.0:protocol\"><NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</NameIDFormat><SingleSignOnService Binding=\"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect\" Location=\"http://127.0.0.1:12345/sso\"></SingleSignOnService><SingleSignOnService Binding=\"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST\" Location=\"http://127.0.0.1:12345/sso\"></SingleSignOnService></IDPSSODescriptor></EntityDescriptor>\n",
	"idp_metadata_url": "",
	"inactivity_timeout": 0,
	"maximum_duration": 0,
	"metadata_url": "https://idp.local-ngrok.com/saml/edghtsrt_2gsqMdzQXlfx0PtsKe4p6VQhf4L",
	"nameid_format": "urn:oasis:names:tc:SAML:2.0:nameid-format:persistent",
	"options_passthrough": false,
	"request_signing_certificate_pem": "-----BEGIN CERTIFICATE-----\nMIIEBDCCAuygAwIBAgIRAP5xfA+/650720vwWbPSa44wDQYJKoZIhvcNAQELBQAw\ngaAxTjBMBgNVBAoMRWh0dHBzOi8vaWRwLmxvY2FsLW5ncm9rLmNvbS9zYW1sL2Vk\nZ2h0c3J0XzJnc3FNZHpRWGxmeDBQdHNLZTRwNlZRaGY0TDFOMEwGA1UEAwxFaHR0\ncHM6Ly9pZHAubG9jYWwtbmdyb2suY29tL3NhbWwvZWRnaHRzcnRfMmdzcU1kelFY\nbGZ4MFB0c0tlNHA2VlFoZjRMMCAXDTI0MDUyMzIwMzYyNloYDzIwNTkwNTE1MjAz\nNjI2WjCBoDFOMEwGA1UECgxFaHR0cHM6Ly9pZHAubG9jYWwtbmdyb2suY29tL3Nh\nbWwvZWRnaHRzcnRfMmdzcU1kelFYbGZ4MFB0c0tlNHA2VlFoZjRMMU4wTAYDVQQD\nDEVodHRwczovL2lkcC5sb2NhbC1uZ3Jvay5jb20vc2FtbC9lZGdodHNydF8yZ3Nx\nTWR6UVhsZngwUHRzS2U0cDZWUWhmNEwwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAw\nggEKAoIBAQDVLWdhOM544l+MDBk2cKSmUSIAXF3Sqdh7diagwm7M76bQGK5Dj1uB\nVCDT3iFuJEBt5K9mXiZa9dUkqMr//dBVlubh6WkrxU8VsYeSXE7ItlTKpCwqG83y\nMhsLiRnYecrv/eK/6polSpFXsZLyyx8npu4/ORkJICZQF9pdVzChcE4Xwsdty2O4\nPlxmIBR6EobaQia3k20mSNOkAWgQiAgQBfY54RrA2YCBu6aB6BMOx2uf6HoOLQ/H\nsRzu0sm6mweb8BdXCIBJrEdJikI6MhTp2ni2sV6lzjEo9fdpU+nR5Z5wkl/Ds9/v\ntfq34OmO9i5Iimq7WLRgOfj8vlbGS2SJAgMBAAGjNTAzMA4GA1UdDwEB/wQEAwIH\ngDATBgNVHSUEDDAKBggrBgEFBQcDATAMBgNVHRMBAf8EAjAAMA0GCSqGSIb3DQEB\nCwUAA4IBAQACyKyRuJ122KttIdMlXIenuf2N9T9ElwLco1ov/k3xDnYenTN9Zria\nACwWuONX0mLXeB+PAnPdnUKvQYzenHlsGA7tv1SMhiSd6tRQsfTeu0he/olqErFf\nSmKiapvzbccQPuPypaYp8dKq8C28RJScVG6RFINegW++OiI7cNeeR8S4jmBVdSYG\ndpVZ1PlIdq/6pOQGMPTQ6FUyM0lqnjwuN+gayjxgB4cKLkGuLbKiLt3GfwiuUSJk\n3N0UDL2R40GBWt/1X4LgjRMRsXrXm79xyZvivLR4MJjAQwSYnqV3L+tmxczAQpdN\ne9fQHCwX6Fw+zvIbVZevleCMyt7psaTF\n-----END CERTIFICATE-----\n",
	"single_logout_url": "https://idp.local-ngrok.com/saml/edghtsrt_2gsqMdzQXlfx0PtsKe4p6VQhf4L/slo"
}

Fields

Name	Type	Description
enabled	boolean	true if the module will be applied to traffic, false to disable. default true if unspecified
options_passthrough	boolean	Do not enforce authentication on HTTP OPTIONS requests. necessary if you are supporting CORS.
cookie_prefix	string	the prefix of the session cookie that ngrok sets on the http client to cache authentication. default is 'ngrok.'
inactivity_timeout	uint32	Integer number of seconds of inactivity after which if the user has not accessed the endpoint, their session will time out and they will be forced to reauthenticate.
maximum_duration	uint32	Integer number of seconds of the maximum duration of an authenticated session. After this period is exceeded, a user must reauthenticate.
idp_metadata	string	The full XML IdP EntityDescriptor. Your IdP may provide this to you as a a file to download or as a URL.
force_authn	boolean	If true, indicates that whenever we redirect a user to the IdP for authentication that the IdP must prompt the user for authentication credentials even if the user already has a valid session with the IdP.
allow_idp_initiated	boolean	If true, the IdP may initiate a login directly (e.g. the user does not need to visit the endpoint first and then be redirected). The IdP should set the RelayState parameter to the target URL of the resource they want the user to be redirected to after the SAML login assertion has been processed.
authorized_groups	List<string>	If present, only users who are a member of one of the listed groups may access the target endpoint.
entity_id	string	The SP Entity's unique ID. This always takes the form of a URL. In ngrok's implementation, this URL is the same as the metadata URL. This will need to be specified to the IdP as configuration.
assertion_consumer_service_url	string	The public URL of the SP's Assertion Consumer Service. This is where the IdP will redirect to during an authentication flow. This will need to be specified to the IdP as configuration.
single_logout_url	string	The public URL of the SP's Single Logout Service. This is where the IdP will redirect to during a single logout flow. This will optionally need to be specified to the IdP as configuration.
request_signing_certificate_pem	string	PEM-encoded x.509 certificate of the key pair that is used to sign all SAML requests that the ngrok SP makes to the IdP. Many IdPs do not support request signing verification, but we highly recommend specifying this in the IdP's configuration if it is supported.
metadata_url	string	A public URL where the SP's metadata is hosted. If an IdP supports dynamic configuration, this is the URL it can use to retrieve the SP metadata.
nameid_format	string	Defines the name identifier format the SP expects the IdP to use in its assertions to identify subjects. If unspecified, a default value of urn:oasis:names:tc:SAML:2.0:nameid-format:persistent will be used. A subset of the allowed values enumerated by the SAML specification are supported.

Get HTTPS Edge Route SAML Module

Request

GET /edges/https/{edge_id}/routes/{id}/saml

Example Request

curl \
-X GET \
-H "Authorization: Bearer {API_KEY}" \
-H "Ngrok-Version: 2" \
https://api.ngrok.com/edges/https/edghts_2gsqMavmAlWY3WXCUK9pHGA9pEX/routes/edghtsrt_2gsqMdzQXlfx0PtsKe4p6VQhf4L/saml

Response

Returns a 200 response on success

Example Response

{
	"allow_idp_initiated": true,
	"assertion_consumer_service_url": "https://idp.local-ngrok.com/saml/edghtsrt_2gsqMdzQXlfx0PtsKe4p6VQhf4L/acs",
	"authorized_groups": [],
	"cookie_prefix": "",
	"enabled": true,
	"entity_id": "https://idp.local-ngrok.com/saml/edghtsrt_2gsqMdzQXlfx0PtsKe4p6VQhf4L",
	"force_authn": false,
	"idp_metadata": "\n<EntityDescriptor xmlns=\"urn:oasis:names:tc:SAML:2.0:metadata\" validUntil=\"2020-09-14T12:53:23.691Z\" cacheDuration=\"PT1M\" entityID=\"http://127.0.0.1:12345/metadata\"><IDPSSODescriptor xmlns=\"urn:oasis:names:tc:SAML:2.0:metadata\" protocolSupportEnumeration=\"urn:oasis:names:tc:SAML:2.0:protocol\"><NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</NameIDFormat><SingleSignOnService Binding=\"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect\" Location=\"http://127.0.0.1:12345/sso\"></SingleSignOnService><SingleSignOnService Binding=\"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST\" Location=\"http://127.0.0.1:12345/sso\"></SingleSignOnService></IDPSSODescriptor></EntityDescriptor>\n",
	"idp_metadata_url": "",
	"inactivity_timeout": 0,
	"maximum_duration": 0,
	"metadata_url": "https://idp.local-ngrok.com/saml/edghtsrt_2gsqMdzQXlfx0PtsKe4p6VQhf4L",
	"nameid_format": "urn:oasis:names:tc:SAML:2.0:nameid-format:persistent",
	"options_passthrough": false,
	"request_signing_certificate_pem": "-----BEGIN CERTIFICATE-----\nMIIEBDCCAuygAwIBAgIRAP5xfA+/650720vwWbPSa44wDQYJKoZIhvcNAQELBQAw\ngaAxTjBMBgNVBAoMRWh0dHBzOi8vaWRwLmxvY2FsLW5ncm9rLmNvbS9zYW1sL2Vk\nZ2h0c3J0XzJnc3FNZHpRWGxmeDBQdHNLZTRwNlZRaGY0TDFOMEwGA1UEAwxFaHR0\ncHM6Ly9pZHAubG9jYWwtbmdyb2suY29tL3NhbWwvZWRnaHRzcnRfMmdzcU1kelFY\nbGZ4MFB0c0tlNHA2VlFoZjRMMCAXDTI0MDUyMzIwMzYyNloYDzIwNTkwNTE1MjAz\nNjI2WjCBoDFOMEwGA1UECgxFaHR0cHM6Ly9pZHAubG9jYWwtbmdyb2suY29tL3Nh\nbWwvZWRnaHRzcnRfMmdzcU1kelFYbGZ4MFB0c0tlNHA2VlFoZjRMMU4wTAYDVQQD\nDEVodHRwczovL2lkcC5sb2NhbC1uZ3Jvay5jb20vc2FtbC9lZGdodHNydF8yZ3Nx\nTWR6UVhsZngwUHRzS2U0cDZWUWhmNEwwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAw\nggEKAoIBAQDVLWdhOM544l+MDBk2cKSmUSIAXF3Sqdh7diagwm7M76bQGK5Dj1uB\nVCDT3iFuJEBt5K9mXiZa9dUkqMr//dBVlubh6WkrxU8VsYeSXE7ItlTKpCwqG83y\nMhsLiRnYecrv/eK/6polSpFXsZLyyx8npu4/ORkJICZQF9pdVzChcE4Xwsdty2O4\nPlxmIBR6EobaQia3k20mSNOkAWgQiAgQBfY54RrA2YCBu6aB6BMOx2uf6HoOLQ/H\nsRzu0sm6mweb8BdXCIBJrEdJikI6MhTp2ni2sV6lzjEo9fdpU+nR5Z5wkl/Ds9/v\ntfq34OmO9i5Iimq7WLRgOfj8vlbGS2SJAgMBAAGjNTAzMA4GA1UdDwEB/wQEAwIH\ngDATBgNVHSUEDDAKBggrBgEFBQcDATAMBgNVHRMBAf8EAjAAMA0GCSqGSIb3DQEB\nCwUAA4IBAQACyKyRuJ122KttIdMlXIenuf2N9T9ElwLco1ov/k3xDnYenTN9Zria\nACwWuONX0mLXeB+PAnPdnUKvQYzenHlsGA7tv1SMhiSd6tRQsfTeu0he/olqErFf\nSmKiapvzbccQPuPypaYp8dKq8C28RJScVG6RFINegW++OiI7cNeeR8S4jmBVdSYG\ndpVZ1PlIdq/6pOQGMPTQ6FUyM0lqnjwuN+gayjxgB4cKLkGuLbKiLt3GfwiuUSJk\n3N0UDL2R40GBWt/1X4LgjRMRsXrXm79xyZvivLR4MJjAQwSYnqV3L+tmxczAQpdN\ne9fQHCwX6Fw+zvIbVZevleCMyt7psaTF\n-----END CERTIFICATE-----\n",
	"single_logout_url": "https://idp.local-ngrok.com/saml/edghtsrt_2gsqMdzQXlfx0PtsKe4p6VQhf4L/slo"
}

Fields

Name	Type	Description
enabled	boolean	true if the module will be applied to traffic, false to disable. default true if unspecified
options_passthrough	boolean	Do not enforce authentication on HTTP OPTIONS requests. necessary if you are supporting CORS.
cookie_prefix	string	the prefix of the session cookie that ngrok sets on the http client to cache authentication. default is 'ngrok.'
inactivity_timeout	uint32	Integer number of seconds of inactivity after which if the user has not accessed the endpoint, their session will time out and they will be forced to reauthenticate.
maximum_duration	uint32	Integer number of seconds of the maximum duration of an authenticated session. After this period is exceeded, a user must reauthenticate.
idp_metadata	string	The full XML IdP EntityDescriptor. Your IdP may provide this to you as a a file to download or as a URL.
force_authn	boolean	If true, indicates that whenever we redirect a user to the IdP for authentication that the IdP must prompt the user for authentication credentials even if the user already has a valid session with the IdP.
allow_idp_initiated	boolean	If true, the IdP may initiate a login directly (e.g. the user does not need to visit the endpoint first and then be redirected). The IdP should set the RelayState parameter to the target URL of the resource they want the user to be redirected to after the SAML login assertion has been processed.
authorized_groups	List<string>	If present, only users who are a member of one of the listed groups may access the target endpoint.
entity_id	string	The SP Entity's unique ID. This always takes the form of a URL. In ngrok's implementation, this URL is the same as the metadata URL. This will need to be specified to the IdP as configuration.
assertion_consumer_service_url	string	The public URL of the SP's Assertion Consumer Service. This is where the IdP will redirect to during an authentication flow. This will need to be specified to the IdP as configuration.
single_logout_url	string	The public URL of the SP's Single Logout Service. This is where the IdP will redirect to during a single logout flow. This will optionally need to be specified to the IdP as configuration.
request_signing_certificate_pem	string	PEM-encoded x.509 certificate of the key pair that is used to sign all SAML requests that the ngrok SP makes to the IdP. Many IdPs do not support request signing verification, but we highly recommend specifying this in the IdP's configuration if it is supported.
metadata_url	string	A public URL where the SP's metadata is hosted. If an IdP supports dynamic configuration, this is the URL it can use to retrieve the SP metadata.
nameid_format	string	Defines the name identifier format the SP expects the IdP to use in its assertions to identify subjects. If unspecified, a default value of urn:oasis:names:tc:SAML:2.0:nameid-format:persistent will be used. A subset of the allowed values enumerated by the SAML specification are supported.

Delete HTTPS Edge Route SAML Module

Request

DELETE /edges/https/{edge_id}/routes/{id}/saml

Example Request

curl \
-X DELETE \
-H "Authorization: Bearer {API_KEY}" \
-H "Ngrok-Version: 2" \
https://api.ngrok.com/edges/https/edghts_2gsqMavmAlWY3WXCUK9pHGA9pEX/routes/edghtsrt_2gsqMdzQXlfx0PtsKe4p6VQhf4L/saml

Response

Returns a 204 response with no body on success