Status on the hosted Gate
Not yet connectable. Before Obelisk can send an assertion, it has to know each service provider's ACS URL and entity ID. The hosted Gate at obeliskgate.com has no way to register a service provider yet, so its sign-on endpoint answers unknown_sp for every platform. The metadata URL below is live; the connection is not.
How it works
In SAML terms, the platform you're protecting (GitHub, Slack, AWS, …) is the service provider (SP), and Obelisk is the identity provider (IdP). When a user signs in, the SP hands them to Obelisk, Obelisk checks that they have an Obelisk session (asking them to sign in if not), and then auto-POSTs a signed SAML assertion back to the SP's Assertion Consumer Service (ACS). The SP trusts the assertion because it's signed by Obelisk's pinned certificate.
It's a two-way exchange. You give the SP Obelisk's IdP values (metadata URL, entity ID, SSO URL, certificate). The SP gives you its SP values (ACS URL, entity ID), which have to be registered with Obelisk, the step the hosted Gate can't do yet. Once both sides know each other, the SP can send people to Obelisk to sign in.
Obelisk's IdP values
These are the values a service provider asks you to supply. They're stable for the obeliskgate.com tenant:
| Field the SP asks for | Obelisk value |
|---|---|
| IdP metadata URL | https://obeliskgate.com/saml/idp/metadata |
| IdP Entity ID / Issuer | https://obeliskgate.com |
| SSO / Sign-on URL | https://obeliskgate.com/saml/idp/sso |
| Signing certificate | X.509 cert embedded in the metadata above |
| Binding | HTTP-POST (the assertion is POSTed to your ACS) |
| Signature algorithm | RSA-SHA256, certificate-pinned |
The fastest path is to hand the SP the metadata URL — most platforms parse the entity ID, SSO URL, and certificate out of it automatically, so there's nothing to copy by hand. Where a platform only accepts pasted values, read them from /saml/idp/metadata.
How setup will work once SAML apps can connect
- Open SSO settings at the service provider. Find its SAML / single sign-on configuration (e.g. GitHub org or enterprise SSO, Slack Configure SAML, AWS IAM Identity Center external IdP). It will show you the SP's ACS URL (a.k.a. Reply / Consume URL) and its Entity ID / Audience.
- Register the SP with Obelisk (not available on the hosted Gate yet). Obelisk needs the SP's
acsUrlandspEntityIdto know where to POST the signed assertion and which audience to stamp. This is the step the hosted Gate can't do yet: there is no way to register a service provider on obeliskgate.com today. - Give the SP Obelisk's IdP values. Provide the metadata URL
https://obeliskgate.com/saml/idp/metadata(preferred — it carries the SSO URL and certificate), or paste the entity ID, SSO URL, and X.509 certificate manually. - Map the nameID and attributes. Obelisk asserts a stable subject as the SAML
NameID(most platforms expectemailAddressformat) and can carryemailandnameattributes. Match these to the SP's expected attribute names. - Test before you enforce. Do a test sign-in before turning SSO on for everyone — a misconfigured ACS or audience is the most common way to lock admins out. Keep a break-glass admin path until the test passes.
- Enforce. Once a test sign-in works end to end, turn on SSO enforcement at the SP. Each SAML sign-in then also writes a hash-chained receipt to Obelisk's ledger.
How the assertion is secured
Each SAML Response the IdP issues is signed with RSA-SHA256 via node-native crypto and pinned to a specific X.509 certificate — there is no homemade signing. The signing path is tamper-rejecting: an altered assertion fails verification, which Obelisk's own test suite checks.
What a SAML sign-in does not carry. The SAML sign-on accepts any valid Obelisk session, including one from an emailed sign-in link or an authenticator code, and every assertion states the generic PasswordProtectedTransport context rather than how the person signed in. So a SAML app could not require a passkey through Obelisk. An OpenID Connect app can: each ID token's obelisk.assurance claim says how the person signed in. More on sessions and assurance →
Next
Browse the connector catalogue to see which platforms work over OpenID Connect today, or read the developer integration guide for putting Obelisk in front of your own app. Need a specific SAML platform? hello@obeliskgate.com.