このページは、まだ日本語ではご利用いただけません。翻訳中です。
古いプラグインバージョンのドキュメントを閲覧しています。
構成
このプラグインはDBレスモードに対応しています。
互換性のあるプロトコル
SAMLプラグインは以下のプロトコルに対応しています:
grpc
, grpcs
, http
, https
パラメータ
このプラグインの設定で使用できるすべてのパラメータのリストは次のとおりです。
-
string required
プラグイン名。この場合は
saml
。- Kong Admin API、Kong Konnect API、宣言型構成、または decK ファイルを使用する場合、フィールドは
name
です。 - Kubernetes で KongPlugin オブジェクトを使用する場合、フィールドは
plugin
です。
- Kong Admin API、Kong Konnect API、宣言型構成、または decK ファイルを使用する場合、フィールドは
-
string
プラグインのインスタンスを識別するための任意のカスタム名 (例:
saml_my-service
。インスタンス名はKong ManagerとKonnectに表示されるので、 例えば複数のサービスで同じプラグインを複数のコンテキストで実行する場合に便利です。また、Kong Admin API経由で特定のプラグインインスタンスに アクセスするためにも使用できます。
インスタンス名は、次のコンテキスト内で一意である必要があります。
- Kong Gateway Enterpriseのワークスペース内
- Konnectのコントロールプレーン(CP)またはコントロールプレーン(CP)グループ内
- Kong Gateway (OSS)の全世界
-
string
プラグインが対象とするサービス名または ID。最上位の
/plugins
エンドポイント. からプラグインをサービスに追加する場合は、これらのパラメータのいずれかを設定してください/services/{serviceName|Id}/plugins
を使用する場合は必要ありません。 -
string
プラグインがターゲットとするルート名または ID。最上位の
/plugins
エンドポイント. を通るルートにプラグインを追加する場合は、これらのパラメータのいずれかを設定してください/routes/{routeName|Id}/plugins
を使用する場合は必要ありません。 -
boolean default:
true
このプラグインが適用されるかどうか。
-
record required
-
string required starts_with:
/
The relative path the SAML IdP provider uses when responding with an authentication response.
-
string required
The Single Sign-On URL exposed by the IdP provider. This is where SAML requests are posted. The IdP provides this information.
-
string referenceable encrypted
The public certificate provided by the IdP. This is used to validate responses from the IdP.
Only include the contents of the certificate. Do not include the header (
BEGIN CERTIFICATE
) and footer (END CERTIFICATE
) lines.
-
string referenceable encrypted
The private encryption key required to decrypt encrypted assertions.
-
string referenceable encrypted
The private key for signing requests. If this parameter is set, requests sent to the IdP are signed. The
request_signing_certificate
parameter must be set as well.
-
string referenceable encrypted
The certificate for signing requests.
-
string default:
SHA256
Must be one of:SHA256
,SHA384
,SHA512
The signature algorithm for signing Authn requests. Options available are:
SHA256
SHA384
SHA512
-
string default:
SHA256
Must be one of:SHA256
,SHA1
The digest algorithm for Authn requests:
SHA256
SHA1
-
string default:
SHA256
Must be one of:SHA256
,SHA384
,SHA512
The algorithm for validating signatures in SAML responses. Options available are:
SHA256
SHA384
SHA512
-
string default:
SHA256
Must be one of:SHA256
,SHA1
The algorithm for verifying digest in SAML responses:
SHA256
SHA1
-
string required
The unique identifier of the IdP application. Formatted as a URL containing information about the IdP so the SP can validate that the SAML assertions it receives are issued from the correct IdP.
-
string default:
EmailAddress
Must be one of:Unspecified
,EmailAddress
,Persistent
,Transient
The requested
NameId
format. Options available are:Unspecified
EmailAddress
Persistent
Transient
-
boolean default:
true
Enable signature validation for SAML responses.
-
string
An optional string (consumer UUID or username) value to use as an “anonymous” consumer. If not set, a Kong Consumer must exist for the SAML IdP user credentials, mapping the username format to the Kong Consumer username.
-
string required referenceable encrypted matches:
^[0-9a-zA-Z/_+]+$
len_min:32
len_max:32
The session secret. This must be a random string of 32 characters from the base64 alphabet (letters, numbers,
/
,_
and+
). It is used as the secret key for encrypting session data as well as state information that is sent to the IdP in the authentication exchange.
-
string default:
default
The session audience, for example “my-application”
-
string default:
session
The session cookie name.
-
boolean default:
false
Enables or disables persistent sessions
-
string default:
remember
Persistent session cookie name
-
number default:
604800
Persistent session rolling timeout in seconds.
-
number default:
2592000
Persistent session absolute timeout in seconds.
-
number default:
900
The session cookie idle time in seconds.
-
number default:
3600
The session cookie absolute timeout in seconds. Specifies how long the session can be used until it is no longer valid.
-
number default:
86400
The session cookie absolute timeout in seconds. Specifies how long the session can be used until it is no longer valid.
-
string default:
/
starts_with:/
The session cookie path flag.
-
string
The session cookie domain flag.
-
string default:
Lax
Must be one of:Strict
,Lax
,None
,Default
Controls whether a cookie is sent with cross-origin requests, providing some protection against cross-site request forgery attacks:
-
Strict
: Cookies will only be sent in a first-party context and aren’t sent along with requests initiated by third party websites. -
Lax
: Cookies are not sent on normal cross-site subrequests, like loading images or frames into a third party site, but are sent when a user is navigating to the origin site, like when they are following a link. -
None
: Cookies will be sent in all contexts, including responses to both first party and cross-origin requests. IfSameSite=None
is set, the cookie secure attribute must also be set or the cookie will be blocked. -
Default
: Do not explicitly specify a Same-Site attribute.
-
-
boolean default:
true
Forbids JavaScript from accessing the cookie, for example, through the
Document.cookie
property.
-
boolean
The cookie is only sent to the server when a request is made with the https:scheme (except on localhost), and therefore is more resistant to man-in-the-middle attacks.
-
set of type
string
Must be one of:id
,audience
,subject
,timeout
,idling-timeout
,rolling-timeout
,absolute-timeout
List of information to include (as headers) in the request to upstream. Accepted values are:
id
,audience
,subject
,timeout
,idling-timeout
,rolling-timeout
, andabsolute-timeout
. For example, { “id”, “timeout” } will set bothSession-Id
andSession-Timeout
in the request headers.
-
set of type
string
Must be one of:id
,audience
,subject
,timeout
,idling-timeout
,rolling-timeout
,absolute-timeout
List of information to include (as headers) in the response to downstream. Accepted values are:
id
,audience
,subject
,timeout
,idling-timeout
,rolling-timeout
, andabsolute-timeout
. For example: { “id”, “timeout” } will inject bothSession-Id
andSession-Timeout
in the response headers.
-
string default:
cookie
Must be one of:cookie
,memcache
,memcached
,redis
The session storage for session data:
-
cookie
: stores session data with the session cookie. The session cannot be invalidated or revoked without changing the session secret, but is stateless, and doesn’t require a database. -
memcached
: stores session data in memcached -
redis
: stores session data in Redis
-
-
boolean default:
false
Configures whether or not session metadata should be stored. This includes information about the active sessions for the
specific_audience
belonging to a specific subject.
-
boolean default:
false
When set to
true
, audiences are forced to share the same subject.
-
boolean default:
false
When set to
true
, the value of subject is hashed before being stored. Only applies whensession_store_metadata
is enabled.
-
boolean default:
false
When set to
true
, the storage key (session ID) is hashed for extra security. Hashing the storage key means it is impossible to decrypt data from the storage without a cookie.
-
string
The memcached session key prefix.
-
string
The memcached unix socket path.
-
string default:
127.0.0.1
The memcached host.
-
integer default:
11211
between:0
65535
The memcached port.
-
string
The Redis session key prefix.
-
string
The Redis unix socket path.
-
string default:
127.0.0.1
The Redis host IP.
-
integer default:
6379
between:0
65535
The Redis port.
-
string referenceable
Redis username if the
redis
session storage is defined and ACL authentication is desired.If undefined, ACL authentication will not be performed.This requires Redis v6.0.0+. The username cannot be set to
default
.
-
string referenceable encrypted
Password to use for Redis connection when the
redis
session storage is defined. If undefined, no auth commands are sent to Redis. This value is pulled from
-
integer
The Redis connection timeout in milliseconds.
-
integer
The Redis read timeout in milliseconds.
-
integer
The Redis send timeout in milliseconds.
-
boolean default:
false
Use SSL/TLS for the Redis connection.
-
boolean default:
false
Verify the Redis server certificate.
-
string
The SNI used for connecting to the Redis server.
-
array of type
record
-
integer
The Redis cluster maximum redirects.
-
-
number
Deprecation notice:
-
number
The session cookie idle time in seconds.
Deprecation notice:
-
string
Deprecation notice:
-
boolean
Deprecation notice:
-
string
Deprecation notice:
-
string
Deprecation notice:
-
string
Deprecation notice:
-
integer
Deprecation notice:
-
integer
Deprecation notice:
-
number
The session cookie renew time in seconds.
Deprecation notice:
-
integer
The maximum size of each cookie in bytes.
Deprecation notice:
-
string
Deprecation notice:
-
string
Deprecation notice:
-
string
Deprecation notice: