NAV Navbar
  • Overview
  • Authorization
  • Token
  • Check Token
  • Introspect Token
  • Token Key(s)
  • Identity Zones
  • Identity Providers
  • Service Providers
  • MFA Providers
  • Users
  • Groups
  • Clients
  • Server Information
  • External Login Server
  • Overview

    The User Account and Authentication Service (UAA):

    Authorization

    Authorization Code Grant

    Browser flow

    $ curl 'http://localhost/oauth/authorize?response_type=code&client_id=login&scope=openid+oauth.approvals&redirect_uri=http%3A%2F%2Flocalhost%2Fapp' -i \
        -H 'Accept: application/x-www-form-urlencoded'
    
    GET /oauth/authorize?response_type=code&client_id=login&scope=openid+oauth.approvals&redirect_uri=http%3A%2F%2Flocalhost%2Fapp HTTP/1.1
    Accept: application/x-www-form-urlencoded
    Host: localhost
    
    
    HTTP/1.1 302 Found
    X-B3-TraceId: f41f16ad-d34a-4fd5-97bf-51b0780e3a17
    Strict-Transport-Security: max-age=31536000
    Cache-Control: no-cache, no-store, max-age=0, must-revalidate
    Pragma: no-cache
    Expires: 0
    X-XSS-Protection: 1; mode=block
    X-Frame-Options: DENY
    X-Content-Type-Options: nosniff
    Location: http://localhost/app?code=KGniMDz8kw
    Set-Cookie: X-Uaa-Csrf=iixGLOphgOWlEX2G4WR63L;Max-Age=86400;HttpOnly
    
    

    Request Parameters

    Parameter Type Constraints Description
    response_type String Required Space-delimited list of response types. Here, code for requesting an authorization code for an access token, as per OAuth spec
    client_id String Required a unique string representing the registration information provided by the client
    scope String Optional requested scopes, space-delimited
    redirect_uri String Optional redirection URI to which the authorization server will send the user-agent back once access is granted (or denied), optional if pre-registered by the client

    Api flow

    $ curl 'http://localhost/oauth/authorize?response_type=code&client_id=login&redirect_uri=http%3A%2F%2Flocalhost%2Fredirect%2Fcf&state=Cwei7m' -i \
        -H 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsImtpZCI6ImxlZ2FjeS10b2tlbi1rZXkiLCJ0eXAiOiJKV1QifQ.eyJqdGkiOiJlZTBhOTg1Y2I2OTk0MjU3OWYxNDVjOTA5MTNhM2VlMCIsInN1YiI6IjkxOGNkNGM1LWM0MDctNGMxMi1hZmJkLTZlYzMyNDA0MTQ4NyIsInNjb3BlIjpbInVhYS51c2VyIl0sImNsaWVudF9pZCI6ImNmIiwiY2lkIjoiY2YiLCJhenAiOiJjZiIsImdyYW50X3R5cGUiOiJwYXNzd29yZCIsInVzZXJfaWQiOiI5MThjZDRjNS1jNDA3LTRjMTItYWZiZC02ZWMzMjQwNDE0ODciLCJvcmlnaW4iOiJ1YWEiLCJ1c2VyX25hbWUiOiJtYXJpc3NhIiwiZW1haWwiOiJtYXJpc3NhQHRlc3Qub3JnIiwiYXV0aF90aW1lIjoxNTI1MjE3MDc5LCJyZXZfc2lnIjoiN2ZkZDQwNTQiLCJpYXQiOjE1MjUyMTcwNzksImV4cCI6MTUyNTI2MDI3OSwiaXNzIjoiaHR0cDovL2xvY2FsaG9zdDo4MDgwL3VhYS9vYXV0aC90b2tlbiIsInppZCI6InVhYSIsImF1ZCI6WyJjZiIsInVhYSJdfQ.tgbOtygG9b_qKXXz8zssYSYU5l2p2nZL7JEPOzUVd6o'
    
    GET /oauth/authorize?response_type=code&client_id=login&redirect_uri=http%3A%2F%2Flocalhost%2Fredirect%2Fcf&state=Cwei7m HTTP/1.1
    Authorization: Bearer eyJhbGciOiJIUzI1NiIsImtpZCI6ImxlZ2FjeS10b2tlbi1rZXkiLCJ0eXAiOiJKV1QifQ.eyJqdGkiOiJlZTBhOTg1Y2I2OTk0MjU3OWYxNDVjOTA5MTNhM2VlMCIsInN1YiI6IjkxOGNkNGM1LWM0MDctNGMxMi1hZmJkLTZlYzMyNDA0MTQ4NyIsInNjb3BlIjpbInVhYS51c2VyIl0sImNsaWVudF9pZCI6ImNmIiwiY2lkIjoiY2YiLCJhenAiOiJjZiIsImdyYW50X3R5cGUiOiJwYXNzd29yZCIsInVzZXJfaWQiOiI5MThjZDRjNS1jNDA3LTRjMTItYWZiZC02ZWMzMjQwNDE0ODciLCJvcmlnaW4iOiJ1YWEiLCJ1c2VyX25hbWUiOiJtYXJpc3NhIiwiZW1haWwiOiJtYXJpc3NhQHRlc3Qub3JnIiwiYXV0aF90aW1lIjoxNTI1MjE3MDc5LCJyZXZfc2lnIjoiN2ZkZDQwNTQiLCJpYXQiOjE1MjUyMTcwNzksImV4cCI6MTUyNTI2MDI3OSwiaXNzIjoiaHR0cDovL2xvY2FsaG9zdDo4MDgwL3VhYS9vYXV0aC90b2tlbiIsInppZCI6InVhYSIsImF1ZCI6WyJjZiIsInVhYSJdfQ.tgbOtygG9b_qKXXz8zssYSYU5l2p2nZL7JEPOzUVd6o
    Host: localhost
    
    
    HTTP/1.1 302 Found
    X-B3-TraceId: 2489b2fa-549f-44d3-9636-331620eced4b
    Cache-Control: no-cache, no-store, max-age=0, must-revalidate
    Pragma: no-cache
    Expires: 0
    X-XSS-Protection: 1; mode=block
    X-Frame-Options: DENY
    X-Content-Type-Options: nosniff
    Location: http://localhost/redirect/cf?code=QIbAeQBBl7&state=Cwei7m
    
    

    Request Parameters

    Parameter Type Constraints Description
    response_type String Required Space-delimited list of response types. Here, code for requesting an authorization code for an access token, as per OAuth spec
    client_id String Required a unique string representing the registration information provided by the client
    redirect_uri String Optional redirection URI to which the authorization server will send the user-agent back once access is granted (or denied), optional if pre-registered by the client
    state String Required any random string to be returned in the Location header as a query parameter, used to achieve per-request customization

    Request Headers

    Name Description
    Authorization Bearer token containing uaa.user scope - the authentication for this user

    Implicit Grant

    $ curl 'http://localhost/oauth/authorize?response_type=token&client_id=app&scope=openid&redirect_uri=http%3A%2F%2Flocalhost%3A8080%2Fapp%2F' -i \
        -H 'Accept: application/x-www-form-urlencoded'
    
    GET /oauth/authorize?response_type=token&client_id=app&scope=openid&redirect_uri=http%3A%2F%2Flocalhost%3A8080%2Fapp%2F HTTP/1.1
    Accept: application/x-www-form-urlencoded
    Host: localhost
    
    
    HTTP/1.1 302 Found
    X-B3-TraceId: d03dbcda-28ab-44b9-bd43-9e4eae1a88c7
    Strict-Transport-Security: max-age=31536000
    Cache-Control: no-cache, no-store, max-age=0, must-revalidate
    Pragma: no-cache
    Expires: 0
    X-XSS-Protection: 1; mode=block
    X-Frame-Options: DENY
    X-Content-Type-Options: nosniff
    Location: http://localhost:8080/app/#token_type=bearer&access_token=eyJhbGciOiJIUzI1NiIsImtpZCI6ImxlZ2FjeS10b2tlbi1rZXkiLCJ0eXAiOiJKV1QifQ.eyJqdGkiOiI1YTYxZDk2MTQwNzQ0MGIwYjYwNzVlYTkxYTVhNDE3ZiIsInN1YiI6IjkxOGNkNGM1LWM0MDctNGMxMi1hZmJkLTZlYzMyNDA0MTQ4NyIsInNjb3BlIjpbIm9wZW5pZCJdLCJjbGllbnRfaWQiOiJhcHAiLCJjaWQiOiJhcHAiLCJhenAiOiJhcHAiLCJ1c2VyX2lkIjoiOTE4Y2Q0YzUtYzQwNy00YzEyLWFmYmQtNmVjMzI0MDQxNDg3Iiwib3JpZ2luIjoidWFhIiwidXNlcl9uYW1lIjoibWFyaXNzYSIsImVtYWlsIjoibWFyaXNzYUB0ZXN0Lm9yZyIsImF1dGhfdGltZSI6MTUyNTIxNzA3OSwicmV2X3NpZyI6IjdkZGU3MmYyIiwiaWF0IjoxNTI1MjE3MDc5LCJleHAiOjE1MjUyNjAyNzksImlzcyI6Imh0dHA6Ly9sb2NhbGhvc3Q6ODA4MC91YWEvb2F1dGgvdG9rZW4iLCJ6aWQiOiJ1YWEiLCJhdWQiOlsiYXBwIiwib3BlbmlkIl19.KYMsK9ZJFmtrCNyDiyMq4jC23reY56ussESTT5bwM1Y&expires_in=43199&jti=5a61d961407440b0b6075ea91a5a417f
    Set-Cookie: X-Uaa-Csrf=jOBRM4NhDG77B5Ii3LBWS4;Max-Age=86400;HttpOnly
    
    

    Request Parameters

    Parameter Type Constraints Description
    response_type String Required Space-delimited list of response types. Here, token, i.e. an access token
    client_id String Required a unique string representing the registration information provided by the client
    scope String Optional requested scopes, space-delimited
    redirect_uri String Optional redirection URI to which the authorization server will send the user-agent back once access is granted (or denied), optional if pre-registered by the client

    Response Headers

    Name Description
    Location Location as defined in the spec includes access_token in the reply fragment if successful

    Implicit Grant with prompt

    $ curl 'http://localhost/oauth/authorize?response_type=token&client_id=app&scope=openid&prompt=none&redirect_uri=http%3A%2F%2Flocalhost%3A8080%2Fapp%2F' -i \
        -H 'Accept: application/x-www-form-urlencoded'
    
    GET /oauth/authorize?response_type=token&client_id=app&scope=openid&prompt=none&redirect_uri=http%3A%2F%2Flocalhost%3A8080%2Fapp%2F HTTP/1.1
    Accept: application/x-www-form-urlencoded
    Host: localhost
    
    
    HTTP/1.1 302 Found
    X-B3-TraceId: 22f3beeb-3f7e-4125-a870-48ff8aa1f021
    Cache-Control: no-cache, no-store, max-age=0, must-revalidate
    Pragma: no-cache
    Expires: 0
    X-XSS-Protection: 1; mode=block
    X-Frame-Options: DENY
    X-Content-Type-Options: nosniff
    Location: http://localhost:8080/app/#error=login_required&session_state=03ef4d38aaa423f1d98b6270fafedc5e3d489534bf13847a79b9546f66ec0246.2f9ce52f92aeb61b018e30613b452a66822cefb11523b0aebf9b4b3cdfdb2f35
    
    

    Request Parameters

    Parameter Type Constraints Description
    response_type String Required Space-delimited list of response types. Here, token, i.e. an access token
    client_id String Required a unique string representing the registration information provided by the client
    scope String Optional requested scopes, space-delimited
    redirect_uri String Optional redirection URI to which the authorization server will send the user-agent back once access is granted (or denied), optional if pre-registered by the client
    prompt String Optional specifies whether to prompt for user authentication. Only value none is supported.

    Response Headers

    Name Description
    Location Redirect url specified in the request parameters.

    OpenID Connect flow

    OpenID Provider Configuration Request

    An OpenID Provider Configuration Document MUST be queried using an HTTP GET request at the previously specified path.

    $ curl 'http://localhost/.well-known/openid-configuration' -i \
        -H 'Accept: application/json'
    
    GET /.well-known/openid-configuration HTTP/1.1
    Accept: application/json
    Host: localhost
    
    
    HTTP/1.1 200 OK
    X-B3-TraceId: 3d8abd7f-9f2a-44c9-a98a-7d839150e93b
    Content-Type: application/json;charset=UTF-8
    Content-Length: 1239
    
    {
      "issuer" : "http://localhost:8080/uaa/oauth/token",
      "authorization_endpoint" : "http://localhost/oauth/authorize",
      "token_endpoint" : "http://localhost/oauth/token",
      "token_endpoint_auth_methods_supported" : [ "client_secret_basic", "client_secret_post" ],
      "token_endpoint_auth_signing_alg_values_supported" : [ "RS256", "HS256" ],
      "userinfo_endpoint" : "http://localhost/userinfo",
      "jwks_uri" : "http://localhost/token_keys",
      "scopes_supported" : [ "openid", "profile", "email", "phone", "roles", "user_attributes" ],
      "response_types_supported" : [ "code", "code id_token", "id_token", "token id_token" ],
      "subject_types_supported" : [ "public" ],
      "id_token_signing_alg_values_supported" : [ "RS256", "HS256" ],
      "id_token_encryption_alg_values_supported" : [ "none" ],
      "claim_types_supported" : [ "normal" ],
      "claims_supported" : [ "sub", "user_name", "origin", "iss", "auth_time", "amr", "acr", "client_id", "aud", "zid", "grant_type", "user_id", "azp", "scope", "exp", "iat", "jti", "rev_sig", "cid", "given_name", "family_name", "phone_number", "email" ],
      "claims_parameter_supported" : false,
      "service_documentation" : "http://docs.cloudfoundry.org/api/uaa/",
      "ui_locales_supported" : [ "en-US" ]
    }
    

    Response Fields

    Path Type Description
    issuer String URL using the https scheme with no query or fragment component that the OP asserts as its Issuer Identifier.
    authorization_endpoint String URL of authorization endpoint.
    token_endpoint String URL of token endpoint.
    userinfo_endpoint String URL of the OP's UserInfo Endpoint.
    jwks_uri String URL of the OP's JSON Web Key Set document.
    scopes_supported Array JSON array containing a list of the OAuth 2.0 scope values that this server supports.
    subject_types_supported Array JSON array containing a list of the Subject Identifier types that this OP supports.
    token_endpoint_auth_methods_supported Array JSON array containing a list of Client Authentication methods supported by this Token Endpoint.
    token_endpoint_auth_signing_alg_values_supported Array JSON array containing a list of the JWS signing algorithms.
    response_types_supported Array JSON array containing a list of the OAuth 2.0 response_type values that this OP supports.
    id_token_signing_alg_values_supported Array JSON array containing a list of the JWS signing algorithms (alg values) supported by the OP for the ID Token to encode the Claims in a JWT.
    id_token_encryption_alg_values_supported Array JSON array containing a list of the JWE encryption algorithms (alg values) supported by the OP.
    claim_types_supported Array JSON array containing a list of the Claim Types that the OpenID Provider supports.
    claims_supported Array JSON array containing a list of the Claim Names of the Claims that the OpenID Provider MAY be able to supply values for.
    claims_parameter_supported Boolean Boolean value specifying whether the OP supports use of the claims parameter.
    service_documentation String URL of a page containing human-readable information that developers might want or need to know when using the OpenID Provider.
    ui_locales_supported Array Languages and scripts supported for the user interface.

    ID token

    The authorization request may specify a response type of id_token, and an ID token as defined by OpenID Connect will be included in the fragment of the redirect URL.

    $ curl 'http://localhost/oauth/authorize?response_type=id_token&client_id=app&scope=openid&redirect_uri=http%3A%2F%2Flocalhost%3A8080%2Fapp%2F' -i \
        -H 'Accept: application/x-www-form-urlencoded'
    
    GET /oauth/authorize?response_type=id_token&client_id=app&scope=openid&redirect_uri=http%3A%2F%2Flocalhost%3A8080%2Fapp%2F HTTP/1.1
    Accept: application/x-www-form-urlencoded
    Host: localhost
    
    
    HTTP/1.1 302 Found
    X-B3-TraceId: 9617b863-ad58-4acc-95ad-4c83cd9bbdde
    Strict-Transport-Security: max-age=31536000
    Cache-Control: no-cache, no-store, max-age=0, must-revalidate
    Pragma: no-cache
    Expires: 0
    X-XSS-Protection: 1; mode=block
    X-Frame-Options: DENY
    X-Content-Type-Options: nosniff
    Location: http://localhost:8080/app/#token_type=bearer&id_token=eyJhbGciOiJIUzI1NiIsImtpZCI6ImxlZ2FjeS10b2tlbi1rZXkiLCJ0eXAiOiJKV1QifQ.eyJzdWIiOiI5MThjZDRjNS1jNDA3LTRjMTItYWZiZC02ZWMzMjQwNDE0ODciLCJwcmV2aW91c19sb2dvbl90aW1lIjpudWxsLCJ1c2VyX25hbWUiOiJtYXJpc3NhIiwib3JpZ2luIjoidWFhIiwiaXNzIjoiaHR0cDovL2xvY2FsaG9zdDo4MDgwL3VhYS9vYXV0aC90b2tlbiIsImNsaWVudF9pZCI6ImFwcCIsImF1ZCI6WyJhcHAiXSwiemlkIjoidWFhIiwidXNlcl9pZCI6IjkxOGNkNGM1LWM0MDctNGMxMi1hZmJkLTZlYzMyNDA0MTQ4NyIsImF6cCI6ImFwcCIsInNjb3BlIjpbIm9wZW5pZCJdLCJhdXRoX3RpbWUiOjE1MjUyMTcwNzksImV4cCI6MTUyNTI2MDI3OSwiaWF0IjoxNTI1MjE3MDc5LCJqdGkiOiIwZGU4MzdkNmMzNjc0MjExYmY3YjM0YTVlNzg4N2VjZSIsImVtYWlsIjoibWFyaXNzYUB0ZXN0Lm9yZyIsInJldl9zaWciOiI3ZGRlNzJmMiIsImNpZCI6ImFwcCJ9.LmQIcIChn_z4mBCbSlO2P3x21WRulF7lRxP6JfoutBI&expires_in=43199&jti=0de837d6c3674211bf7b34a5e7887ece
    Set-Cookie: X-Uaa-Csrf=z6fdadtNjzcD2fBI2bGLGe;Max-Age=86400;HttpOnly
    
    

    Request Parameters

    Parameter Type Constraints Description
    response_type String Required Space-delimited list of response types. Here, id_token
    client_id String Required a unique string representing the registration information provided by the client
    scope String Optional requested scopes, space-delimited
    redirect_uri String Optional redirection URI to which the authorization server will send the user-agent back once access is granted (or denied), optional if pre-registered by the client

    Response Headers

    Name Description
    Location Location as defined in the spec includes id_token in the reply fragment if successful

    ID token and Access token

    The request may specify that the client expects an ID token as defined by OpenID Connect, and this ID token will be included alongside the access token.

    $ curl 'http://localhost/oauth/authorize?response_type=token+id_token&client_id=app&scope=openid&redirect_uri=http%3A%2F%2Flocalhost%3A8080%2Fapp%2F' -i \
        -H 'Accept: application/x-www-form-urlencoded'
    
    GET /oauth/authorize?response_type=token+id_token&client_id=app&scope=openid&redirect_uri=http%3A%2F%2Flocalhost%3A8080%2Fapp%2F HTTP/1.1
    Accept: application/x-www-form-urlencoded
    Host: localhost
    
    
    HTTP/1.1 302 Found
    X-B3-TraceId: 86ce512e-b9fb-4580-b19d-107407eb8416
    Strict-Transport-Security: max-age=31536000
    Cache-Control: no-cache, no-store, max-age=0, must-revalidate
    Pragma: no-cache
    Expires: 0
    X-XSS-Protection: 1; mode=block
    X-Frame-Options: DENY
    X-Content-Type-Options: nosniff
    Location: http://localhost:8080/app/#token_type=bearer&access_token=eyJhbGciOiJIUzI1NiIsImtpZCI6ImxlZ2FjeS10b2tlbi1rZXkiLCJ0eXAiOiJKV1QifQ.eyJqdGkiOiI0MDk0YzllN2Y5ZjI0ZTU3YmNkYzYzYzIwN2ZlYzQyNiIsInN1YiI6IjkxOGNkNGM1LWM0MDctNGMxMi1hZmJkLTZlYzMyNDA0MTQ4NyIsInNjb3BlIjpbIm9wZW5pZCJdLCJjbGllbnRfaWQiOiJhcHAiLCJjaWQiOiJhcHAiLCJhenAiOiJhcHAiLCJ1c2VyX2lkIjoiOTE4Y2Q0YzUtYzQwNy00YzEyLWFmYmQtNmVjMzI0MDQxNDg3Iiwib3JpZ2luIjoidWFhIiwidXNlcl9uYW1lIjoibWFyaXNzYSIsImVtYWlsIjoibWFyaXNzYUB0ZXN0Lm9yZyIsImF1dGhfdGltZSI6MTUyNTIxNzA3OSwicmV2X3NpZyI6IjdkZGU3MmYyIiwiaWF0IjoxNTI1MjE3MDgwLCJleHAiOjE1MjUyNjAyODAsImlzcyI6Imh0dHA6Ly9sb2NhbGhvc3Q6ODA4MC91YWEvb2F1dGgvdG9rZW4iLCJ6aWQiOiJ1YWEiLCJhdWQiOlsiYXBwIiwib3BlbmlkIl19.UHhTduDLV0KRLpZtCZoXv4EaBVna11nNJ09OC6hqyMc&id_token=eyJhbGciOiJIUzI1NiIsImtpZCI6ImxlZ2FjeS10b2tlbi1rZXkiLCJ0eXAiOiJKV1QifQ.eyJzdWIiOiI5MThjZDRjNS1jNDA3LTRjMTItYWZiZC02ZWMzMjQwNDE0ODciLCJwcmV2aW91c19sb2dvbl90aW1lIjpudWxsLCJ1c2VyX25hbWUiOiJtYXJpc3NhIiwib3JpZ2luIjoidWFhIiwiaXNzIjoiaHR0cDovL2xvY2FsaG9zdDo4MDgwL3VhYS9vYXV0aC90b2tlbiIsImNsaWVudF9pZCI6ImFwcCIsImF1ZCI6WyJhcHAiXSwiemlkIjoidWFhIiwidXNlcl9pZCI6IjkxOGNkNGM1LWM0MDctNGMxMi1hZmJkLTZlYzMyNDA0MTQ4NyIsImF6cCI6ImFwcCIsInNjb3BlIjpbIm9wZW5pZCJdLCJhdXRoX3RpbWUiOjE1MjUyMTcwNzksImV4cCI6MTUyNTI2MDI4MCwiaWF0IjoxNTI1MjE3MDgwLCJqdGkiOiI0MDk0YzllN2Y5ZjI0ZTU3YmNkYzYzYzIwN2ZlYzQyNiIsImVtYWlsIjoibWFyaXNzYUB0ZXN0Lm9yZyIsInJldl9zaWciOiI3ZGRlNzJmMiIsImNpZCI6ImFwcCJ9.UFvflJnENhLdVf4meyoXhNV2M0AcFfUpE43c5ephqMw&expires_in=43199&jti=4094c9e7f9f24e57bcdc63c207fec426
    Set-Cookie: X-Uaa-Csrf=1FxXZhOBAbAUFw0JDhHKg3;Max-Age=86400;HttpOnly
    
    

    Request Parameters

    Parameter Type Constraints Description
    response_type String Required Space-delimited list of response types. Here, token id_token, indicating both an access token and an ID token.
    client_id String Required a unique string representing the registration information provided by the client
    scope String Optional requested scopes, space-delimited
    redirect_uri String Optional redirection URI to which the authorization server will send the user-agent back once access is granted (or denied), optional if pre-registered by the client

    Response Headers

    Name Description
    Location Location as defined in the spec includes access_token and id_token in the reply fragment if successful

    Hybrid flow

    The request may specify that the client expects an ID token as defined by OpenID Connect, and this ID token will be included alongside the authorization code.

    $ curl 'http://localhost/oauth/authorize?response_type=code+id_token&client_id=app&scope=openid&redirect_uri=http%3A%2F%2Flocalhost%3A8080%2Fapp%2F' -i \
        -H 'Accept: application/x-www-form-urlencoded'
    
    GET /oauth/authorize?response_type=code+id_token&client_id=app&scope=openid&redirect_uri=http%3A%2F%2Flocalhost%3A8080%2Fapp%2F HTTP/1.1
    Accept: application/x-www-form-urlencoded
    Host: localhost
    
    
    HTTP/1.1 302 Found
    X-B3-TraceId: cfbf0861-6da1-4b02-a943-06eca0a6fbeb
    Strict-Transport-Security: max-age=31536000
    Cache-Control: no-cache, no-store, max-age=0, must-revalidate
    Pragma: no-cache
    Expires: 0
    X-XSS-Protection: 1; mode=block
    X-Frame-Options: DENY
    X-Content-Type-Options: nosniff
    Location: http://localhost:8080/app/#token_type=bearer&id_token=eyJhbGciOiJIUzI1NiIsImtpZCI6ImxlZ2FjeS10b2tlbi1rZXkiLCJ0eXAiOiJKV1QifQ.eyJzdWIiOiI5MThjZDRjNS1jNDA3LTRjMTItYWZiZC02ZWMzMjQwNDE0ODciLCJwcmV2aW91c19sb2dvbl90aW1lIjpudWxsLCJ1c2VyX25hbWUiOiJtYXJpc3NhIiwib3JpZ2luIjoidWFhIiwiaXNzIjoiaHR0cDovL2xvY2FsaG9zdDo4MDgwL3VhYS9vYXV0aC90b2tlbiIsImNsaWVudF9pZCI6ImFwcCIsImF1ZCI6WyJhcHAiXSwiemlkIjoidWFhIiwidXNlcl9pZCI6IjkxOGNkNGM1LWM0MDctNGMxMi1hZmJkLTZlYzMyNDA0MTQ4NyIsImF6cCI6ImFwcCIsInNjb3BlIjpbIm9wZW5pZCJdLCJhdXRoX3RpbWUiOjE1MjUyMTcwODAsImV4cCI6MTUyNTI2MDI4MCwiaWF0IjoxNTI1MjE3MDgwLCJqdGkiOiI5ZDVmNjI4ZmVhZjM0MzQxODliYmIzODkxYWM0YWRmMCIsImVtYWlsIjoibWFyaXNzYUB0ZXN0Lm9yZyIsInJldl9zaWciOiI3ZGRlNzJmMiIsImNpZCI6ImFwcCJ9.wxeAGzokJQocbzC3Z6jIMFCFd43cp_XDYICF-atFkSY&code=hklpM7rh2V&expires_in=43199&jti=9d5f628feaf3434189bbb3891ac4adf0
    Set-Cookie: X-Uaa-Csrf=wGIrqPdMUKcX3bG8kwILBB;Max-Age=86400;HttpOnly
    
    

    Request Parameters

    Parameter Type Constraints Description
    response_type String Required Space-delimited list of response types. Here, id_token code, indicating a request for an ID token and an authorization code.
    client_id String Required a unique string representing the registration information provided by the client
    scope String Optional requested scopes, space-delimited
    redirect_uri String Optional redirection URI to which the authorization server will send the user-agent back once access is granted (or denied), optional if pre-registered by the client

    Response Headers

    Name Description
    Location Location as defined in the spec includes code and id_token in the reply fragment if successful

    Token

    The /oauth/token endpoint requires client authentication to be accessed. Client Authentication can be passed as as part of the request authorization header, using basic authentication, or as part of the request parameters, using the client_id and client_secret parameter names.

    Authorization Code Grant

    $ curl 'http://localhost/oauth/token' -i -u 'login:loginsecret' -X POST \
        -H 'Content-Type: application/x-www-form-urlencoded' \
        -H 'Accept: application/json' \
        -d 'client_id=login&client_secret=loginsecret&grant_type=authorization_code&response_type=token&code=hhyHJQdHiU&token_format=opaque&redirect_uri=http%3A%2F%2Flocalhost%2Fredirect%2Fcf'
    
    POST /oauth/token HTTP/1.1
    Content-Type: application/x-www-form-urlencoded
    Authorization: Basic bG9naW46bG9naW5zZWNyZXQ=
    Accept: application/json
    Host: localhost
    
    client_id=login&client_secret=loginsecret&grant_type=authorization_code&response_type=token&code=hhyHJQdHiU&token_format=opaque&redirect_uri=http%3A%2F%2Flocalhost%2Fredirect%2Fcf
    
    HTTP/1.1 200 OK
    X-B3-TraceId: fec5d802-6a4f-44fb-af4a-9d57d5f45e48
    Cache-Control: no-cache, no-store, max-age=0, must-revalidate
    Cache-Control: no-store
    Pragma: no-cache
    Pragma: no-cache
    Expires: 0
    X-XSS-Protection: 1; mode=block
    X-Frame-Options: DENY
    X-Content-Type-Options: nosniff
    Content-Type: application/json;charset=UTF-8
    Content-Length: 250
    
    {
      "access_token" : "9cbd56c4e92e46f897b9c9ff8f7cf799",
      "token_type" : "bearer",
      "refresh_token" : "3a60ec6692ea420ea5ef63f776e82e59-r",
      "expires_in" : 43199,
      "scope" : "openid oauth.approvals",
      "jti" : "9cbd56c4e92e46f897b9c9ff8f7cf799"
    }
    

    Request Headers

    Name Description
    Authorization Client ID and secret may be passed as a basic authorization header, per RFC 6749 or as request parameters.

    Request Parameters

    Parameter Type Constraints Description
    response_type String Required The type of token that should be issued.
    client_id String Optional A unique string representing the registration information provided by the client, the recipient of the token. Optional if it is passed as part of the Basic Authorization header.
    redirect_uri String Required if provided on authorization request redirection URI to which the authorization server will send the user-agent back once access is granted (or denied)
    code String Required the authorization code, obtained from /oauth/authorize, issued for the user
    grant_type String Required the type of authentication being used to obtain the token, in this case authorization_code
    client_secret String Optional The secret passphrase configured for the OAuth client. Optional if it is passed as part of the Basic Authorization header.
    token_format String Optional UAA 3.3.0 Can be set to 'opaque' to retrieve an opaque and revocable token.

    Response Fields

    Path Type Description
    access_token String the access token for the user to whom the authorization code was issued
    token_type String the type of the access token issued, i.e. bearer
    expires_in Number number of seconds until token expiry
    scope String space-delimited list of scopes authorized by the user for this client
    refresh_token String an OAuth refresh token for refresh grants
    jti String a globally unique identifier for this token

    Client Credentials Grant

    Without Authorization

    $ curl 'http://localhost/oauth/token' -i -X POST \
        -H 'Content-Type: application/x-www-form-urlencoded' \
        -H 'Accept: application/json' \
        -d 'client_id=login&client_secret=loginsecret&grant_type=client_credentials&token_format=opaque&response_type=token'
    
    POST /oauth/token HTTP/1.1
    Content-Type: application/x-www-form-urlencoded
    Accept: application/json
    Host: localhost
    
    client_id=login&client_secret=loginsecret&grant_type=client_credentials&token_format=opaque&response_type=token
    
    HTTP/1.1 200 OK
    X-B3-TraceId: 411f35bd-3e38-4c17-8f24-ed6d544d8828
    Cache-Control: no-cache, no-store, max-age=0, must-revalidate
    Cache-Control: no-store
    Pragma: no-cache
    Pragma: no-cache
    Expires: 0
    X-XSS-Protection: 1; mode=block
    X-Frame-Options: DENY
    X-Content-Type-Options: nosniff
    Content-Type: application/json;charset=UTF-8
    Content-Length: 306
    
    {
      "access_token" : "626fba1c2acf470aa67a735c8a396ec1",
      "token_type" : "bearer",
      "expires_in" : 43199,
      "scope" : "clients.read emails.write scim.userids password.write idps.write notifications.write oauth.login scim.write critical_notifications.write",
      "jti" : "626fba1c2acf470aa67a735c8a396ec1"
    }
    

    Request Parameters

    Parameter Type Constraints Description
    client_id String Optional A unique string representing the registration information provided by the client, the recipient of the token. Optional if it is passed as part of the Basic Authorization header.
    grant_type String Required the type of authentication being used to obtain the token, in this case client_credentials
    client_secret String Optional The secret passphrase configured for the OAuth client. Optional if it is passed as part of the Basic Authorization header.
    response_type String Optional The type of token that should be issued.
    token_format String Optional UAA 3.3.0 Can be set to 'opaque' to retrieve an opaque and revocable token.

    Response Fields

    Path Type Description
    access_token String the access token
    token_type String the type of the access token issued, i.e. bearer
    expires_in Number number of seconds until token expiry
    scope String space-delimited list of scopes authorized by the user for this client
    jti String a globally unique identifier for this token

    With Authorization

    $ curl 'http://localhost/oauth/token' -i -u 'login:loginsecret' -X POST \
        -H 'Content-Type: application/x-www-form-urlencoded' \
        -H 'Accept: application/json' \
        -d 'grant_type=client_credentials&response_type=token&token_format=opaque'
    
    POST /oauth/token HTTP/1.1
    Content-Type: application/x-www-form-urlencoded
    Accept: application/json
    Authorization: Basic bG9naW46bG9naW5zZWNyZXQ=
    Host: localhost
    
    grant_type=client_credentials&response_type=token&token_format=opaque
    
    HTTP/1.1 200 OK
    X-B3-TraceId: 30041da1-3a6c-44df-a257-4522e77d2670
    Cache-Control: no-cache, no-store, max-age=0, must-revalidate
    Cache-Control: no-store
    Pragma: no-cache
    Pragma: no-cache
    Expires: 0
    X-XSS-Protection: 1; mode=block
    X-Frame-Options: DENY
    X-Content-Type-Options: nosniff
    Content-Type: application/json;charset=UTF-8
    Content-Length: 306
    
    {
      "access_token" : "aae3c97e694244d991ace12bf9a6b4ab",
      "token_type" : "bearer",
      "expires_in" : 43199,
      "scope" : "clients.read emails.write scim.userids password.write idps.write notifications.write oauth.login scim.write critical_notifications.write",
      "jti" : "aae3c97e694244d991ace12bf9a6b4ab"
    }
    

    Request Header

    Name Description
    Authorization Base64 encoded client details in the format: Basic client_id:client_secret

    Request Parameters

    Parameter Type Constraints Description
    grant_type String Required the type of authentication being used to obtain the token, in this case client_credentials
    response_type String Optional The type of token that should be issued.
    token_format String Optional UAA 3.3.0 Can be set to 'opaque' to retrieve an opaque and revocable token.

    Response Fields

    Path Type Description
    access_token String the access token
    token_type String the type of the access token issued, i.e. bearer
    expires_in Number number of seconds until token expiry
    scope String space-delimited list of scopes authorized by the user for this client
    jti String a globally unique identifier for this token

    Password Grant

    $ curl 'http://localhost/oauth/token' -i -X POST \
        -H 'Content-Type: application/x-www-form-urlencoded' \
        -H 'Accept: application/json' \
        -d 'client_id=app&client_secret=appclientsecret&grant_type=password&username=5pAb3q%40test.org&password=secr3T&token_format=opaque&response_type=token'
    
    POST /oauth/token HTTP/1.1
    Content-Type: application/x-www-form-urlencoded
    Accept: application/json
    Host: localhost
    
    client_id=app&client_secret=appclientsecret&grant_type=password&username=5pAb3q%40test.org&password=secr3T&token_format=opaque&response_type=token
    
    HTTP/1.1 200 OK
    X-B3-TraceId: 8c8e0c9d-5560-4b6b-a831-c23e9f6f4260
    Cache-Control: no-cache, no-store, max-age=0, must-revalidate
    Cache-Control: no-store
    Pragma: no-cache
    Pragma: no-cache
    Expires: 0
    X-XSS-Protection: 1; mode=block
    X-Frame-Options: DENY
    X-Content-Type-Options: nosniff
    Content-Type: application/json;charset=UTF-8
    Content-Length: 307
    
    {
      "access_token" : "ffdf3854cb4b4f2ab48b3539d0697401",
      "token_type" : "bearer",
      "refresh_token" : "0d5f3387171040b886c809e9cb0992b5-r",
      "expires_in" : 43199,
      "scope" : "scim.userids openid cloud_controller.read password.write cloud_controller.write",
      "jti" : "ffdf3854cb4b4f2ab48b3539d0697401"
    }
    

    Request Parameters

    Parameter Type Constraints Description
    response_type String Required The type of token that should be issued.
    client_id String Optional A unique string representing the registration information provided by the client, the recipient of the token. Optional if it is passed as part of the Basic Authorization header.
    grant_type String Required the type of authentication being used to obtain the token, in this case password
    client_secret String Optional The secret passphrase configured for the OAuth client. Optional if it is passed as part of the Basic Authorization header.
    username String Required the username for the user trying to get a token
    password String Required the password for the user trying to get a token
    token_format String Optional UAA 3.3.0 Can be set to 'opaque' to retrieve an opaque and revocable token.

    Response Fields

    Path Type Description
    access_token String the access token
    token_type String the type of the access token issued, i.e. bearer
    expires_in Number number of seconds until token expiry
    scope String space-delimited list of scopes authorized by the user for this client
    refresh_token String an OAuth refresh token for refresh grants
    jti String a globally unique identifier for this token

    One-time Passcode

    $ curl 'http://localhost/oauth/token' -i -u 'app:appclientsecret' -X POST \
        -H 'Content-Type: application/x-www-form-urlencoded' \
        -H 'Accept: application/json' \
        -d 'grant_type=password&passcode=gR8sNhWCxB&token_format=opaque&response_type=token'
    
    POST /oauth/token HTTP/1.1
    Content-Type: application/x-www-form-urlencoded
    Accept: application/json
    Authorization: Basic YXBwOmFwcGNsaWVudHNlY3JldA==
    Host: localhost
    
    grant_type=password&passcode=gR8sNhWCxB&token_format=opaque&response_type=token
    
    HTTP/1.1 200 OK
    X-B3-TraceId: c14b6fa4-a268-479a-9041-577236950232
    Cache-Control: no-cache, no-store, max-age=0, must-revalidate
    Cache-Control: no-store
    Pragma: no-cache
    Pragma: no-cache
    Expires: 0
    X-XSS-Protection: 1; mode=block
    X-Frame-Options: DENY
    X-Content-Type-Options: nosniff
    Content-Type: application/json;charset=UTF-8
    Content-Length: 307
    
    {
      "access_token" : "f464346494ea45179869101f78fe7dce",
      "token_type" : "bearer",
      "refresh_token" : "53989c993e174a90b92c01a1007c5066-r",
      "expires_in" : 43199,
      "scope" : "scim.userids openid cloud_controller.read password.write cloud_controller.write",
      "jti" : "f464346494ea45179869101f78fe7dce"
    }
    

    Request Header

    Name Description
    Authorization Base64 encoded client details in the format: Basic client_id:client_secret

    Request Parameters

    Parameter Type Constraints Description
    response_type String Required The type of token that should be issued.
    grant_type String Required the type of authentication being used to obtain the token, in this case password
    passcode String Required the one-time passcode for the user which can be retrieved by going to /passcode
    token_format String Optional UAA 3.3.0 Can be set to 'opaque' to retrieve an opaque and revocable token.

    Response Fields

    Path Type Description
    access_token String the access token
    token_type String the type of the access token issued, i.e. bearer
    expires_in Number number of seconds until token expiry
    scope String space-delimited list of scopes authorized by the user for this client
    refresh_token String an OAuth refresh token for refresh grants
    jti String a globally unique identifier for this token

    User Token Grant

    A user_token grant, is a flow that allows the generation of a refresh_token for another client. The requesting client, must have grant_type=user_token and the bearer token for this request must have uaa.user and be a token that represents an authenticated user.

    The idea with this grant flow, is that a user can preapprove a token grant for another client, rather than having to participate in the approval process when the client needs the access token.

    The refresh_token that results from this grant, is opaque, and can only be exchanged by the client it was intended for.

    $ curl 'http://localhost/oauth/token' -i -X POST \
        -H 'Content-Type: application/x-www-form-urlencoded' \
        -H 'Authorization: Bearer 9157844934cd4f3885bd5d7ab3a811e4' \
        -H 'Accept: application/json' \
        -d 'client_id=app&grant_type=user_token&scope=openid&token_format=jwt&response_type=token'
    
    POST /oauth/token HTTP/1.1
    Content-Type: application/x-www-form-urlencoded
    Authorization: Bearer 9157844934cd4f3885bd5d7ab3a811e4
    Accept: application/json
    Host: localhost
    
    client_id=app&grant_type=user_token&scope=openid&token_format=jwt&response_type=token
    
    HTTP/1.1 200 OK
    X-B3-TraceId: 4832ce04-d54d-4a97-ab6d-03ec87827300
    Cache-Control: no-cache, no-store, max-age=0, must-revalidate
    Cache-Control: no-store
    Pragma: no-cache
    Pragma: no-cache
    Expires: 0
    X-XSS-Protection: 1; mode=block
    X-Frame-Options: DENY
    X-Content-Type-Options: nosniff
    Content-Type: application/json;charset=UTF-8
    Content-Length: 206
    
    {
      "access_token" : null,
      "token_type" : "bearer",
      "refresh_token" : "99ac317df3a74248ba4735056dd32430-r",
      "expires_in" : 43199,
      "scope" : "openid",
      "jti" : "99ac317df3a74248ba4735056dd32430-r"
    }
    

    Request Parameters

    Parameter Type Constraints Description
    response_type String Required Response type of the grant, should be set to token
    client_id String Optional The client ID of the receiving client, this client must have refresh_token grant type
    grant_type String Required The type of token grant requested, in this case user_token
    token_format String Optional This parameter is ignored. The refresh_token will always be opaque
    scope String Optional The list of scopes requested for the token. Use when you wish to reduce the number of scopes the token will have.

    Response Fields

    Path Type Description
    access_token Null Always null
    token_type String The type of the access token issued, always bearer
    expires_in Number Number of seconds of lifetime for an access_token, when retrieved
    scope String Space-delimited list of scopes authorized by the user for this client
    refresh_token String An OAuth refresh token for refresh grants
    jti String A globally unique identifier for this refresh token

    SAML2 Bearer Grant

    The SAML 2.0 bearer grant allows to request an OAuth 2.0 access token with a SAML 2.0 bearer assertion. The flow is defined in RFC 7522. The requesting client, must have grant_type=urn:ietf:params:oauth:grant-type:saml2-bearer. In addition the requesting client must either allow the IDP in allowedproviders or omit the property so that any trusted IDP is allowed. The trust to the assertion issuer is reused from the SAML 2.0 WebSSO profiles.

    This grant enables an App2App mechanism with SSO. Typical scenarios are applications outside of CF, which consume a service within the CF world. The endpoint of the bearer assertion is /oauth/token so the Recipient attribute in the bearer assertion must point to the corresponding URI, e.g. http://localhost:8080/uaa/oauth/token.

    $ curl 'http://ttwuei.localhost:8080/uaa/oauth/token/alias/ttwuei.cloudfoundry-saml-login' -i -X POST \
        -H 'Content-Type: application/x-www-form-urlencoded' \
        -H 'Accept: application/json' \
        -H 'Host: ttwuei.localhost' \
        -d 'grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Asaml2-bearer&client_id=testclientCLyfKl&client_secret=secret&assertion=PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48c2FtbDI6QXNzZXJ0aW9uIHhtbG5zOnNhbWwyPSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6YXNzZXJ0aW9uIiBJRD0iYTIwOWhnZzU3MTlkZjA3ZTJkMDNnYTA0ajliZTBmNyIgSXNzdWVJbnN0YW50PSIyMDE4LTA1LTAxVDIzOjI1OjE2Ljc2NFoiIFZlcnNpb249IjIuMCIgeG1sbnM6eHM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDEvWE1MU2NoZW1hIj48c2FtbDI6SXNzdWVyPnR0d3VlaS5jbG91ZGZvdW5kcnktc2FtbC1sb2dpbjwvc2FtbDI6SXNzdWVyPjxkczpTaWduYXR1cmUgeG1sbnM6ZHM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvMDkveG1sZHNpZyMiPjxkczpTaWduZWRJbmZvPjxkczpDYW5vbmljYWxpemF0aW9uTWV0aG9kIEFsZ29yaXRobT0iaHR0cDovL3d3dy53My5vcmcvMjAwMS8xMC94bWwtZXhjLWMxNG4jIi8-PGRzOlNpZ25hdHVyZU1ldGhvZCBBbGdvcml0aG09Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvMDkveG1sZHNpZyNyc2Etc2hhMSIvPjxkczpSZWZlcmVuY2UgVVJJPSIjYTIwOWhnZzU3MTlkZjA3ZTJkMDNnYTA0ajliZTBmNyI-PGRzOlRyYW5zZm9ybXM-PGRzOlRyYW5zZm9ybSBBbGdvcml0aG09Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvMDkveG1sZHNpZyNlbnZlbG9wZWQtc2lnbmF0dXJlIi8-PGRzOlRyYW5zZm9ybSBBbGdvcml0aG09Imh0dHA6Ly93d3cudzMub3JnLzIwMDEvMTAveG1sLWV4Yy1jMTRuIyI-PGVjOkluY2x1c2l2ZU5hbWVzcGFjZXMgeG1sbnM6ZWM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDEvMTAveG1sLWV4Yy1jMTRuIyIgUHJlZml4TGlzdD0ieHMiLz48L2RzOlRyYW5zZm9ybT48L2RzOlRyYW5zZm9ybXM-PGRzOkRpZ2VzdE1ldGhvZCBBbGdvcml0aG09Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvMDkveG1sZHNpZyNzaGExIi8-PGRzOkRpZ2VzdFZhbHVlPlRocDFic2hVR2haR205UEEwQWdtRUhGNE5COD08L2RzOkRpZ2VzdFZhbHVlPjwvZHM6UmVmZXJlbmNlPjwvZHM6U2lnbmVkSW5mbz48ZHM6U2lnbmF0dXJlVmFsdWU-ZysvSWdISzc4YS96WndGKzJpbTN6eTREK1pscUNWNHNMNzQ4b1lSQVp1eDVFM0FiTjR0NDUxdXU1aVd3ck90cER4cHk4NmhEalF4M3psdzd0UWFLeCtCUkEvWTR2eWoxNnRCMHNCUlhXdjVuQ1Jzclp6b1cwUHZ3RzdqWE1jYWxqQlh2dGRwazNjSXVDLzA2RTBqTHMxSTJEN3V4Nld3SE9kOWNwdjMzQUpjPTwvZHM6U2lnbmF0dXJlVmFsdWU-PGRzOktleUluZm8-PGRzOlg1MDlEYXRhPjxkczpYNTA5Q2VydGlmaWNhdGU-TUlJRFNUQ0NBcktnQXdJQkFnSUJBREFOQmdrcWhraUc5dzBCQVFRRkFEQjhNUXN3Q1FZRFZRUUdFd0poZHpFT01Bd0dBMVVFQ0JNRgpZWEoxWW1FeERqQU1CZ05WQkFvVEJXRnlkV0poTVE0d0RBWURWUVFIRXdWaGNuVmlZVEVPTUF3R0ExVUVDeE1GWVhKMVltRXhEakFNCkJnTlZCQU1UQldGeWRXSmhNUjB3R3dZSktvWklodmNOQVFrQkZnNWhjblZpWVVCaGNuVmlZUzVoY2pBZUZ3MHhOVEV4TWpBeU1qSTIKTWpkYUZ3MHhOakV4TVRreU1qSTJNamRhTUh3eEN6QUpCZ05WQkFZVEFtRjNNUTR3REFZRFZRUUlFd1ZoY25WaVlURU9NQXdHQTFVRQpDaE1GWVhKMVltRXhEakFNQmdOVkJBY1RCV0Z5ZFdKaE1RNHdEQVlEVlFRTEV3VmhjblZpWVRFT01Bd0dBMVVFQXhNRllYSjFZbUV4CkhUQWJCZ2txaGtpRzl3MEJDUUVXRG1GeWRXSmhRR0Z5ZFdKaExtRnlNSUdmTUEwR0NTcUdTSWIzRFFFQkFRVUFBNEdOQURDQmlRS0IKZ1FESHRDNWdVWHhCS3BFcVpUTGtOdkZ3TkduTklrZ2dOT3dPUVZOYnBPMFdWSElpdmlnNUwzOVdxUzl1MGhuQStPN01DQS9LbHJBUgo0YlhhZVZWaHdmVVBZQktJcGFhVFdGUVI1Y1RSMVVGWkpML09GOXZBZnBPd3pub0Q2NkREQ25RVnBiQ2p0RFlXWCt4NmlteG44SENZCnhoTW9sNlpuVGJTc0ZXNlZaakZNalFJREFRQUJvNEhhTUlIWE1CMEdBMVVkRGdRV0JCVHgwbER6akgvaU9Cbk9TUWFTRVdRTHgxc3kKR0RDQnB3WURWUjBqQklHZk1JR2NnQlR4MGxEempIL2lPQm5PU1FhU0VXUUx4MXN5R0tHQmdLUitNSHd4Q3pBSkJnTlZCQVlUQW1GMwpNUTR3REFZRFZRUUlFd1ZoY25WaVlURU9NQXdHQTFVRUNoTUZZWEoxWW1FeERqQU1CZ05WQkFjVEJXRnlkV0poTVE0d0RBWURWUVFMCkV3VmhjblZpWVRFT01Bd0dBMVVFQXhNRllYSjFZbUV4SFRBYkJna3Foa2lHOXcwQkNRRVdEbUZ5ZFdKaFFHRnlkV0poTG1GeWdnRUEKTUF3R0ExVWRFd1FGTUFNQkFmOHdEUVlKS29aSWh2Y05BUUVFQlFBRGdZRUFZdkJKMEhPWmJiSENsWG1HVWpHcytHUyt4QzFGTy9hbQoyc3VDU1lxTkI5ZHlNWGZPV2lKMStUTEprK28vWVp0OHZ1eENLZGNaWWdsNGwvTDZQeEo5ODJTUmhjODNaVzJka0FaSTRNMC9VZDNvCmVQZTg0azhqbTNBN0V2SDV3aTVodkNrS1JwdVJCd24zRWkrakNSb3V4VGJ6S1BzdUNWQisxc055eE1UWHpmMD08L2RzOlg1MDlDZXJ0aWZpY2F0ZT48L2RzOlg1MDlEYXRhPjwvZHM6S2V5SW5mbz48L2RzOlNpZ25hdHVyZT48c2FtbDI6U3ViamVjdD48c2FtbDI6TmFtZUlEIEZvcm1hdD0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6MS4xOm5hbWVpZC1mb3JtYXQ6dW5zcGVjaWZpZWQiPlNhbWwyQmVhcmVySW50ZWdyYXRpb25Vc2VyPC9zYW1sMjpOYW1lSUQ-PHNhbWwyOlN1YmplY3RDb25maXJtYXRpb24gTWV0aG9kPSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6Y206YmVhcmVyIj48c2FtbDI6U3ViamVjdENvbmZpcm1hdGlvbkRhdGEgTm90T25PckFmdGVyPSIyMDE4LTA1LTAyVDAwOjI1OjE2LjgxNFoiIFJlY2lwaWVudD0iaHR0cDovL3R0d3VlaS5sb2NhbGhvc3Q6ODA4MC91YWEvb2F1dGgvdG9rZW4vYWxpYXMvdHR3dWVpLmNsb3VkZm91bmRyeS1zYW1sLWxvZ2luIi8-PC9zYW1sMjpTdWJqZWN0Q29uZmlybWF0aW9uPjwvc2FtbDI6U3ViamVjdD48c2FtbDI6Q29uZGl0aW9ucyBOb3RCZWZvcmU9IjIwMTgtMDUtMDFUMjM6MjU6MTYuNzcwWiIgTm90T25PckFmdGVyPSIyMDE4LTA1LTAyVDAwOjI1OjE2LjgxNFoiPjxzYW1sMjpBdWRpZW5jZVJlc3RyaWN0aW9uPjxzYW1sMjpBdWRpZW5jZT50dHd1ZWkuY2xvdWRmb3VuZHJ5LXNhbWwtbG9naW48L3NhbWwyOkF1ZGllbmNlPjwvc2FtbDI6QXVkaWVuY2VSZXN0cmljdGlvbj48L3NhbWwyOkNvbmRpdGlvbnM-PHNhbWwyOkF1dGhuU3RhdGVtZW50IEF1dGhuSW5zdGFudD0iMjAxOC0wNS0wMVQyMzoyNToxNi43NjZaIiBTZXNzaW9uSW5kZXg9ImEzajZqYjEyZGJiNmhiODMyZGkzOGc5MzU2MGdkZTIiPjxzYW1sMjpBdXRobkNvbnRleHQ-PHNhbWwyOkF1dGhuQ29udGV4dENsYXNzUmVmPnVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDphYzpjbGFzc2VzOlBhc3N3b3JkPC9zYW1sMjpBdXRobkNvbnRleHRDbGFzc1JlZj48L3NhbWwyOkF1dGhuQ29udGV4dD48L3NhbWwyOkF1dGhuU3RhdGVtZW50PjxzYW1sMjpBdHRyaWJ1dGVTdGF0ZW1lbnQ-PHNhbWwyOkF0dHJpYnV0ZSBOYW1lPSJhdXRob3JpdGllcyI-PHNhbWwyOkF0dHJpYnV0ZVZhbHVlIHhtbG5zOnhzaT0iaHR0cDovL3d3dy53My5vcmcvMjAwMS9YTUxTY2hlbWEtaW5zdGFuY2UiIHhzaTp0eXBlPSJ4czpzdHJpbmciPnVhYS51c2VyPC9zYW1sMjpBdHRyaWJ1dGVWYWx1ZT48L3NhbWwyOkF0dHJpYnV0ZT48c2FtbDI6QXR0cmlidXRlIE5hbWU9ImVtYWlsIj48c2FtbDI6QXR0cmlidXRlVmFsdWUgeG1sbnM6eHNpPSJodHRwOi8vd3d3LnczLm9yZy8yMDAxL1hNTFNjaGVtYS1pbnN0YW5jZSIgeHNpOnR5cGU9InhzOnN0cmluZyI-bWFyaXNzYUB0ZXN0aW5nLm9yZzwvc2FtbDI6QXR0cmlidXRlVmFsdWU-PC9zYW1sMjpBdHRyaWJ1dGU-PHNhbWwyOkF0dHJpYnV0ZSBOYW1lPSJpZCI-PHNhbWwyOkF0dHJpYnV0ZVZhbHVlIHhtbG5zOnhzaT0iaHR0cDovL3d3dy53My5vcmcvMjAwMS9YTUxTY2hlbWEtaW5zdGFuY2UiIHhzaTp0eXBlPSJ4czpzdHJpbmciPjEwNDAyOWFmLTgzMTYtNGI5OS1iMTJjLWE3MTg5OWY4MWYxYzwvc2FtbDI6QXR0cmlidXRlVmFsdWU-PC9zYW1sMjpBdHRyaWJ1dGU-PHNhbWwyOkF0dHJpYnV0ZSBOYW1lPSJuYW1lIj48c2FtbDI6QXR0cmlidXRlVmFsdWUgeG1sbnM6eHNpPSJodHRwOi8vd3d3LnczLm9yZy8yMDAxL1hNTFNjaGVtYS1pbnN0YW5jZSIgeHNpOnR5cGU9InhzOnN0cmluZyI-bWFyaXNzYTwvc2FtbDI6QXR0cmlidXRlVmFsdWU-PC9zYW1sMjpBdHRyaWJ1dGU-PHNhbWwyOkF0dHJpYnV0ZSBOYW1lPSJvcmlnaW4iPjxzYW1sMjpBdHRyaWJ1dGVWYWx1ZSB4bWxuczp4c2k9Imh0dHA6Ly93d3cudzMub3JnLzIwMDEvWE1MU2NoZW1hLWluc3RhbmNlIiB4c2k6dHlwZT0ieHM6c3RyaW5nIj51YWE8L3NhbWwyOkF0dHJpYnV0ZVZhbHVlPjwvc2FtbDI6QXR0cmlidXRlPjxzYW1sMjpBdHRyaWJ1dGUgTmFtZT0iem9uZUlkIj48c2FtbDI6QXR0cmlidXRlVmFsdWUgeG1sbnM6eHNpPSJodHRwOi8vd3d3LnczLm9yZy8yMDAxL1hNTFNjaGVtYS1pbnN0YW5jZSIgeHNpOnR5cGU9InhzOnN0cmluZyI-dWFhPC9zYW1sMjpBdHRyaWJ1dGVWYWx1ZT48L3NhbWwyOkF0dHJpYnV0ZT48L3NhbWwyOkF0dHJpYnV0ZVN0YXRlbWVudD48L3NhbWwyOkFzc2VydGlvbj4&scope=openid'
    
    POST /uaa/oauth/token/alias/ttwuei.cloudfoundry-saml-login HTTP/1.1
    Content-Type: application/x-www-form-urlencoded
    Accept: application/json
    Host: ttwuei.localhost
    
    grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Asaml2-bearer&client_id=testclientCLyfKl&client_secret=secret&assertion=PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48c2FtbDI6QXNzZXJ0aW9uIHhtbG5zOnNhbWwyPSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6YXNzZXJ0aW9uIiBJRD0iYTIwOWhnZzU3MTlkZjA3ZTJkMDNnYTA0ajliZTBmNyIgSXNzdWVJbnN0YW50PSIyMDE4LTA1LTAxVDIzOjI1OjE2Ljc2NFoiIFZlcnNpb249IjIuMCIgeG1sbnM6eHM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDEvWE1MU2NoZW1hIj48c2FtbDI6SXNzdWVyPnR0d3VlaS5jbG91ZGZvdW5kcnktc2FtbC1sb2dpbjwvc2FtbDI6SXNzdWVyPjxkczpTaWduYXR1cmUgeG1sbnM6ZHM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvMDkveG1sZHNpZyMiPjxkczpTaWduZWRJbmZvPjxkczpDYW5vbmljYWxpemF0aW9uTWV0aG9kIEFsZ29yaXRobT0iaHR0cDovL3d3dy53My5vcmcvMjAwMS8xMC94bWwtZXhjLWMxNG4jIi8-PGRzOlNpZ25hdHVyZU1ldGhvZCBBbGdvcml0aG09Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvMDkveG1sZHNpZyNyc2Etc2hhMSIvPjxkczpSZWZlcmVuY2UgVVJJPSIjYTIwOWhnZzU3MTlkZjA3ZTJkMDNnYTA0ajliZTBmNyI-PGRzOlRyYW5zZm9ybXM-PGRzOlRyYW5zZm9ybSBBbGdvcml0aG09Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvMDkveG1sZHNpZyNlbnZlbG9wZWQtc2lnbmF0dXJlIi8-PGRzOlRyYW5zZm9ybSBBbGdvcml0aG09Imh0dHA6Ly93d3cudzMub3JnLzIwMDEvMTAveG1sLWV4Yy1jMTRuIyI-PGVjOkluY2x1c2l2ZU5hbWVzcGFjZXMgeG1sbnM6ZWM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDEvMTAveG1sLWV4Yy1jMTRuIyIgUHJlZml4TGlzdD0ieHMiLz48L2RzOlRyYW5zZm9ybT48L2RzOlRyYW5zZm9ybXM-PGRzOkRpZ2VzdE1ldGhvZCBBbGdvcml0aG09Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvMDkveG1sZHNpZyNzaGExIi8-PGRzOkRpZ2VzdFZhbHVlPlRocDFic2hVR2haR205UEEwQWdtRUhGNE5COD08L2RzOkRpZ2VzdFZhbHVlPjwvZHM6UmVmZXJlbmNlPjwvZHM6U2lnbmVkSW5mbz48ZHM6U2lnbmF0dXJlVmFsdWU-ZysvSWdISzc4YS96WndGKzJpbTN6eTREK1pscUNWNHNMNzQ4b1lSQVp1eDVFM0FiTjR0NDUxdXU1aVd3ck90cER4cHk4NmhEalF4M3psdzd0UWFLeCtCUkEvWTR2eWoxNnRCMHNCUlhXdjVuQ1Jzclp6b1cwUHZ3RzdqWE1jYWxqQlh2dGRwazNjSXVDLzA2RTBqTHMxSTJEN3V4Nld3SE9kOWNwdjMzQUpjPTwvZHM6U2lnbmF0dXJlVmFsdWU-PGRzOktleUluZm8-PGRzOlg1MDlEYXRhPjxkczpYNTA5Q2VydGlmaWNhdGU-TUlJRFNUQ0NBcktnQXdJQkFnSUJBREFOQmdrcWhraUc5dzBCQVFRRkFEQjhNUXN3Q1FZRFZRUUdFd0poZHpFT01Bd0dBMVVFQ0JNRgpZWEoxWW1FeERqQU1CZ05WQkFvVEJXRnlkV0poTVE0d0RBWURWUVFIRXdWaGNuVmlZVEVPTUF3R0ExVUVDeE1GWVhKMVltRXhEakFNCkJnTlZCQU1UQldGeWRXSmhNUjB3R3dZSktvWklodmNOQVFrQkZnNWhjblZpWVVCaGNuVmlZUzVoY2pBZUZ3MHhOVEV4TWpBeU1qSTIKTWpkYUZ3MHhOakV4TVRreU1qSTJNamRhTUh3eEN6QUpCZ05WQkFZVEFtRjNNUTR3REFZRFZRUUlFd1ZoY25WaVlURU9NQXdHQTFVRQpDaE1GWVhKMVltRXhEakFNQmdOVkJBY1RCV0Z5ZFdKaE1RNHdEQVlEVlFRTEV3VmhjblZpWVRFT01Bd0dBMVVFQXhNRllYSjFZbUV4CkhUQWJCZ2txaGtpRzl3MEJDUUVXRG1GeWRXSmhRR0Z5ZFdKaExtRnlNSUdmTUEwR0NTcUdTSWIzRFFFQkFRVUFBNEdOQURDQmlRS0IKZ1FESHRDNWdVWHhCS3BFcVpUTGtOdkZ3TkduTklrZ2dOT3dPUVZOYnBPMFdWSElpdmlnNUwzOVdxUzl1MGhuQStPN01DQS9LbHJBUgo0YlhhZVZWaHdmVVBZQktJcGFhVFdGUVI1Y1RSMVVGWkpML09GOXZBZnBPd3pub0Q2NkREQ25RVnBiQ2p0RFlXWCt4NmlteG44SENZCnhoTW9sNlpuVGJTc0ZXNlZaakZNalFJREFRQUJvNEhhTUlIWE1CMEdBMVVkRGdRV0JCVHgwbER6akgvaU9Cbk9TUWFTRVdRTHgxc3kKR0RDQnB3WURWUjBqQklHZk1JR2NnQlR4MGxEempIL2lPQm5PU1FhU0VXUUx4MXN5R0tHQmdLUitNSHd4Q3pBSkJnTlZCQVlUQW1GMwpNUTR3REFZRFZRUUlFd1ZoY25WaVlURU9NQXdHQTFVRUNoTUZZWEoxWW1FeERqQU1CZ05WQkFjVEJXRnlkV0poTVE0d0RBWURWUVFMCkV3VmhjblZpWVRFT01Bd0dBMVVFQXhNRllYSjFZbUV4SFRBYkJna3Foa2lHOXcwQkNRRVdEbUZ5ZFdKaFFHRnlkV0poTG1GeWdnRUEKTUF3R0ExVWRFd1FGTUFNQkFmOHdEUVlKS29aSWh2Y05BUUVFQlFBRGdZRUFZdkJKMEhPWmJiSENsWG1HVWpHcytHUyt4QzFGTy9hbQoyc3VDU1lxTkI5ZHlNWGZPV2lKMStUTEprK28vWVp0OHZ1eENLZGNaWWdsNGwvTDZQeEo5ODJTUmhjODNaVzJka0FaSTRNMC9VZDNvCmVQZTg0azhqbTNBN0V2SDV3aTVodkNrS1JwdVJCd24zRWkrakNSb3V4VGJ6S1BzdUNWQisxc055eE1UWHpmMD08L2RzOlg1MDlDZXJ0aWZpY2F0ZT48L2RzOlg1MDlEYXRhPjwvZHM6S2V5SW5mbz48L2RzOlNpZ25hdHVyZT48c2FtbDI6U3ViamVjdD48c2FtbDI6TmFtZUlEIEZvcm1hdD0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6MS4xOm5hbWVpZC1mb3JtYXQ6dW5zcGVjaWZpZWQiPlNhbWwyQmVhcmVySW50ZWdyYXRpb25Vc2VyPC9zYW1sMjpOYW1lSUQ-PHNhbWwyOlN1YmplY3RDb25maXJtYXRpb24gTWV0aG9kPSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6Y206YmVhcmVyIj48c2FtbDI6U3ViamVjdENvbmZpcm1hdGlvbkRhdGEgTm90T25PckFmdGVyPSIyMDE4LTA1LTAyVDAwOjI1OjE2LjgxNFoiIFJlY2lwaWVudD0iaHR0cDovL3R0d3VlaS5sb2NhbGhvc3Q6ODA4MC91YWEvb2F1dGgvdG9rZW4vYWxpYXMvdHR3dWVpLmNsb3VkZm91bmRyeS1zYW1sLWxvZ2luIi8-PC9zYW1sMjpTdWJqZWN0Q29uZmlybWF0aW9uPjwvc2FtbDI6U3ViamVjdD48c2FtbDI6Q29uZGl0aW9ucyBOb3RCZWZvcmU9IjIwMTgtMDUtMDFUMjM6MjU6MTYuNzcwWiIgTm90T25PckFmdGVyPSIyMDE4LTA1LTAyVDAwOjI1OjE2LjgxNFoiPjxzYW1sMjpBdWRpZW5jZVJlc3RyaWN0aW9uPjxzYW1sMjpBdWRpZW5jZT50dHd1ZWkuY2xvdWRmb3VuZHJ5LXNhbWwtbG9naW48L3NhbWwyOkF1ZGllbmNlPjwvc2FtbDI6QXVkaWVuY2VSZXN0cmljdGlvbj48L3NhbWwyOkNvbmRpdGlvbnM-PHNhbWwyOkF1dGhuU3RhdGVtZW50IEF1dGhuSW5zdGFudD0iMjAxOC0wNS0wMVQyMzoyNToxNi43NjZaIiBTZXNzaW9uSW5kZXg9ImEzajZqYjEyZGJiNmhiODMyZGkzOGc5MzU2MGdkZTIiPjxzYW1sMjpBdXRobkNvbnRleHQ-PHNhbWwyOkF1dGhuQ29udGV4dENsYXNzUmVmPnVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDphYzpjbGFzc2VzOlBhc3N3b3JkPC9zYW1sMjpBdXRobkNvbnRleHRDbGFzc1JlZj48L3NhbWwyOkF1dGhuQ29udGV4dD48L3NhbWwyOkF1dGhuU3RhdGVtZW50PjxzYW1sMjpBdHRyaWJ1dGVTdGF0ZW1lbnQ-PHNhbWwyOkF0dHJpYnV0ZSBOYW1lPSJhdXRob3JpdGllcyI-PHNhbWwyOkF0dHJpYnV0ZVZhbHVlIHhtbG5zOnhzaT0iaHR0cDovL3d3dy53My5vcmcvMjAwMS9YTUxTY2hlbWEtaW5zdGFuY2UiIHhzaTp0eXBlPSJ4czpzdHJpbmciPnVhYS51c2VyPC9zYW1sMjpBdHRyaWJ1dGVWYWx1ZT48L3NhbWwyOkF0dHJpYnV0ZT48c2FtbDI6QXR0cmlidXRlIE5hbWU9ImVtYWlsIj48c2FtbDI6QXR0cmlidXRlVmFsdWUgeG1sbnM6eHNpPSJodHRwOi8vd3d3LnczLm9yZy8yMDAxL1hNTFNjaGVtYS1pbnN0YW5jZSIgeHNpOnR5cGU9InhzOnN0cmluZyI-bWFyaXNzYUB0ZXN0aW5nLm9yZzwvc2FtbDI6QXR0cmlidXRlVmFsdWU-PC9zYW1sMjpBdHRyaWJ1dGU-PHNhbWwyOkF0dHJpYnV0ZSBOYW1lPSJpZCI-PHNhbWwyOkF0dHJpYnV0ZVZhbHVlIHhtbG5zOnhzaT0iaHR0cDovL3d3dy53My5vcmcvMjAwMS9YTUxTY2hlbWEtaW5zdGFuY2UiIHhzaTp0eXBlPSJ4czpzdHJpbmciPjEwNDAyOWFmLTgzMTYtNGI5OS1iMTJjLWE3MTg5OWY4MWYxYzwvc2FtbDI6QXR0cmlidXRlVmFsdWU-PC9zYW1sMjpBdHRyaWJ1dGU-PHNhbWwyOkF0dHJpYnV0ZSBOYW1lPSJuYW1lIj48c2FtbDI6QXR0cmlidXRlVmFsdWUgeG1sbnM6eHNpPSJodHRwOi8vd3d3LnczLm9yZy8yMDAxL1hNTFNjaGVtYS1pbnN0YW5jZSIgeHNpOnR5cGU9InhzOnN0cmluZyI-bWFyaXNzYTwvc2FtbDI6QXR0cmlidXRlVmFsdWU-PC9zYW1sMjpBdHRyaWJ1dGU-PHNhbWwyOkF0dHJpYnV0ZSBOYW1lPSJvcmlnaW4iPjxzYW1sMjpBdHRyaWJ1dGVWYWx1ZSB4bWxuczp4c2k9Imh0dHA6Ly93d3cudzMub3JnLzIwMDEvWE1MU2NoZW1hLWluc3RhbmNlIiB4c2k6dHlwZT0ieHM6c3RyaW5nIj51YWE8L3NhbWwyOkF0dHJpYnV0ZVZhbHVlPjwvc2FtbDI6QXR0cmlidXRlPjxzYW1sMjpBdHRyaWJ1dGUgTmFtZT0iem9uZUlkIj48c2FtbDI6QXR0cmlidXRlVmFsdWUgeG1sbnM6eHNpPSJodHRwOi8vd3d3LnczLm9yZy8yMDAxL1hNTFNjaGVtYS1pbnN0YW5jZSIgeHNpOnR5cGU9InhzOnN0cmluZyI-dWFhPC9zYW1sMjpBdHRyaWJ1dGVWYWx1ZT48L3NhbWwyOkF0dHJpYnV0ZT48L3NhbWwyOkF0dHJpYnV0ZVN0YXRlbWVudD48L3NhbWwyOkFzc2VydGlvbj4&scope=openid
    
    HTTP/1.1 200 OK
    X-B3-TraceId: 16c89ee2-de49-46dc-8d78-4fb59aaae7f1
    Cache-Control: no-cache, no-store, max-age=0, must-revalidate
    Cache-Control: no-store
    Pragma: no-cache
    Pragma: no-cache
    Expires: 0
    X-XSS-Protection: 1; mode=block
    X-Frame-Options: DENY
    X-Content-Type-Options: nosniff
    Content-Disposition: inline;filename=f.txt
    Content-Type: application/json;charset=UTF-8
    Content-Length: 1796
    
    {
      "access_token" : "eyJhbGciOiJIUzI1NiIsImtpZCI6ImxlZ2FjeS10b2tlbi1rZXkiLCJ0eXAiOiJKV1QifQ.eyJqdGkiOiI2YjBkMzk5NjYxOTE0ZDk4YWI0MDBmODBmNGE0OTkyZSIsInN1YiI6IjU3Mzk2NDU3LTdjOTYtNDg3Ni05ZGRlLTEyNzg0YTAwZjM2YiIsInNjb3BlIjpbIm9wZW5pZCJdLCJjbGllbnRfaWQiOiJ0ZXN0Y2xpZW50Q0x5ZktsIiwiY2lkIjoidGVzdGNsaWVudENMeWZLbCIsImF6cCI6InRlc3RjbGllbnRDTHlmS2wiLCJncmFudF90eXBlIjoidXJuOmlldGY6cGFyYW1zOm9hdXRoOmdyYW50LXR5cGU6c2FtbDItYmVhcmVyIiwidXNlcl9pZCI6IjU3Mzk2NDU3LTdjOTYtNDg3Ni05ZGRlLTEyNzg0YTAwZjM2YiIsIm9yaWdpbiI6InR0d3VlaS5jbG91ZGZvdW5kcnktc2FtbC1sb2dpbiIsInVzZXJfbmFtZSI6IlNhbWwyQmVhcmVySW50ZWdyYXRpb25Vc2VyIiwiZW1haWwiOiJTYW1sMkJlYXJlckludGVncmF0aW9uVXNlckB1bmtub3duLm9yZyIsInJldl9zaWciOiI5NGVkMWZiOSIsImlhdCI6MTUyNTIxNzExNywiZXhwIjoxNTI1MjE3NzE3LCJpc3MiOiJodHRwOi8vdHR3dWVpLmxvY2FsaG9zdDo4MDgwL3VhYS9vYXV0aC90b2tlbiIsInppZCI6InR0d3VlaSIsImF1ZCI6W119.6qImGEMQhrSDhFqdc15zZEsRsPuKUerkmFKj78f6Xsw",
      "token_type" : "bearer",
      "refresh_token" : "eyJhbGciOiJIUzI1NiIsImtpZCI6ImxlZ2FjeS10b2tlbi1rZXkiLCJ0eXAiOiJKV1QifQ.eyJqdGkiOiI0NjNkODBlOTc4NTU0MmIwYmEzYjIwMTY2ZjY2ZTVmNy1yIiwic3ViIjoiNTczOTY0NTctN2M5Ni00ODc2LTlkZGUtMTI3ODRhMDBmMzZiIiwic2NvcGUiOlsib3BlbmlkIl0sImlhdCI6MTUyNTIxNzExNywiZXhwIjoxNTI3ODA5MTE3LCJjaWQiOiJ0ZXN0Y2xpZW50Q0x5ZktsIiwiY2xpZW50X2lkIjoidGVzdGNsaWVudENMeWZLbCIsImlzcyI6Imh0dHA6Ly90dHd1ZWkubG9jYWxob3N0OjgwODAvdWFhL29hdXRoL3Rva2VuIiwiemlkIjoidHR3dWVpIiwiZ3JhbnRfdHlwZSI6InVybjppZXRmOnBhcmFtczpvYXV0aDpncmFudC10eXBlOnNhbWwyLWJlYXJlciIsInVzZXJfbmFtZSI6IlNhbWwyQmVhcmVySW50ZWdyYXRpb25Vc2VyIiwib3JpZ2luIjoidHR3dWVpLmNsb3VkZm91bmRyeS1zYW1sLWxvZ2luIiwidXNlcl9pZCI6IjU3Mzk2NDU3LTdjOTYtNDg3Ni05ZGRlLTEyNzg0YTAwZjM2YiIsInJldl9zaWciOiI5NGVkMWZiOSIsImF1ZCI6W119.s1L8-5QTsOa5PH_VGwoYtdV0VVjUCEcY7sim5qGj5Fo",
      "expires_in" : 599,
      "scope" : "openid",
      "jti" : "6b0d399661914d98ab400f80f4a4992e"
    }
    

    Request Parameters

    Parameter Type Constraints Description
    client_id String Optional The client ID of the receiving client, this client must have urn:ietf:params:oauth:grant-type:saml2-bearer grant type
    client_secret String Optional The secret passphrase configured for the OAuth client. Optional if it is passed as part of the Basic Authorization header.
    grant_type String Required The type of token grant requested, in this case urn:ietf:params:oauth:grant-type:saml2-bearer
    assertion String Required An XML based SAML 2.0 bearer assertion, which is Base64URl encoded.
    scope String Optional The list of scopes requested for the token. Use when you wish to reduce the number of scopes the token will have.

    Response Fields

    Path Type Description
    access_token String Always null
    token_type String The type of the access token issued, always bearer
    expires_in Number Number of seconds of lifetime for an access_token, when retrieved
    scope String Space-delimited list of scopes authorized by the user for this client
    refresh_token String An OAuth refresh token for refresh grants
    jti String A globally unique identifier for this refresh token

    JWT Bearer Token Grant

    The JSON Web Token (JWT) Profile for OAuth 2.0 Client Authentication and Authorization Grants allows to request an OAuth 2.0 access token with a JWT id_token bearer assertion. The flow is defined in RFC 7523. The requesting client, must have grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer. In addition the requesting client must either allow the IDP in allowedproviders or omit the property so that any trusted IDP is allowed. The trust to the assertion, the issuer claim is used to select an OIDC provider (IDP) configured in the UAA database. If multiple providers exists that have the same issuer, the grant will fail.

    Refresh Token

    $ curl 'http://localhost/oauth/token' -i -X POST \
        -H 'Content-Type: application/x-www-form-urlencoded' \
        -H 'Accept: application/json' \
        -d 'client_id=app&client_secret=appclientsecret&grant_type=refresh_token&token_format=opaque&refresh_token=d96b39c000c3469aa356a7b408ba5265-r'
    
    POST /oauth/token HTTP/1.1
    Content-Type: application/x-www-form-urlencoded
    Accept: application/json
    Host: localhost
    
    client_id=app&client_secret=appclientsecret&grant_type=refresh_token&token_format=opaque&refresh_token=d96b39c000c3469aa356a7b408ba5265-r
    
    HTTP/1.1 200 OK
    X-B3-TraceId: d2a49320-032a-41f1-a241-2447a263b2ea
    Cache-Control: no-cache, no-store, max-age=0, must-revalidate
    Cache-Control: no-store
    Pragma: no-cache
    Pragma: no-cache
    Expires: 0
    X-XSS-Protection: 1; mode=block
    X-Frame-Options: DENY
    X-Content-Type-Options: nosniff
    Content-Type: application/json;charset=UTF-8
    Content-Length: 307
    
    {
      "access_token" : "f189912a487046139da3e03272829ac8",
      "token_type" : "bearer",
      "refresh_token" : "d96b39c000c3469aa356a7b408ba5265-r",
      "expires_in" : 43199,
      "scope" : "scim.userids cloud_controller.read password.write cloud_controller.write openid",
      "jti" : "f189912a487046139da3e03272829ac8"
    }
    

    Request Parameters

    Parameter Type Constraints Description
    grant_type String Required the type of authentication being used to obtain the token, in this case refresh_token
    client_id String Optional A unique string representing the registration information provided by the client, the recipient of the token. Optional if it is passed as part of the Basic Authorization header.
    client_secret String Optional The secret passphrase configured for the OAuth client. Optional if it is passed as part of the Basic Authorization header.
    refresh_token String Required the refresh_token that was returned along with the access token.
    token_format String Optional UAA 3.3.0 Can be set to 'opaque' to retrieve an opaque and revocable token.

    Response Fields

    Path Type Description
    access_token String the access token
    refresh_token String the refresh token
    token_type String the type of the access token issued, i.e. bearer
    expires_in Number number of seconds until token expiry
    scope String space-delimited list of scopes authorized by the user for this client
    jti String a globally unique identifier for this token

    OpenID Connect

    The token endpoint can provide an ID token as defined by OpenID Connect.

    $ curl 'http://localhost/oauth/token' -i -X POST \
        -H 'Content-Type: application/x-www-form-urlencoded' \
        -H 'Accept: application/json' \
        -d 'client_id=login&client_secret=loginsecret&grant_type=authorization_code&response_type=id_token&code=tVZLU8afyr&token_format=opaque&redirect_uri=http%3A%2F%2Flocalhost%2Fredirect%2Fcf'
    
    POST /oauth/token HTTP/1.1
    Content-Type: application/x-www-form-urlencoded
    Accept: application/json
    Host: localhost
    
    client_id=login&client_secret=loginsecret&grant_type=authorization_code&response_type=id_token&code=tVZLU8afyr&token_format=opaque&redirect_uri=http%3A%2F%2Flocalhost%2Fredirect%2Fcf
    
    HTTP/1.1 200 OK
    X-B3-TraceId: a1ba2406-d619-4851-827b-fc4107562e07
    Cache-Control: no-cache, no-store, max-age=0, must-revalidate
    Cache-Control: no-store
    Pragma: no-cache
    Pragma: no-cache
    Expires: 0
    X-XSS-Protection: 1; mode=block
    X-Frame-Options: DENY
    X-Content-Type-Options: nosniff
    Content-Type: application/json;charset=UTF-8
    Content-Length: 1056
    
    {
      "access_token" : "a4d3ab91a4b4423a94b3b1944ae806f7",
      "token_type" : "bearer",
      "id_token" : "eyJhbGciOiJIUzI1NiIsImtpZCI6ImxlZ2FjeS10b2tlbi1rZXkiLCJ0eXAiOiJKV1QifQ.eyJzdWIiOiIzYjM1MDg1Yy00Nzg4LTQyY2EtOGRhNy1mMWMzNjc4Y2RmNDciLCJwcmV2aW91c19sb2dvbl90aW1lIjpudWxsLCJ1c2VyX25hbWUiOiI4MlZGQVlAdGVzdC5vcmciLCJvcmlnaW4iOiJ1YWEiLCJpc3MiOiJodHRwOi8vbG9jYWxob3N0OjgwODAvdWFhL29hdXRoL3Rva2VuIiwicmV2b2NhYmxlIjp0cnVlLCJjbGllbnRfaWQiOiJsb2dpbiIsImF1ZCI6WyJsb2dpbiJdLCJ6aWQiOiJ1YWEiLCJncmFudF90eXBlIjoiYXV0aG9yaXphdGlvbl9jb2RlIiwidXNlcl9pZCI6IjNiMzUwODVjLTQ3ODgtNDJjYS04ZGE3LWYxYzM2NzhjZGY0NyIsImF6cCI6ImxvZ2luIiwic2NvcGUiOlsib3BlbmlkIl0sImF1dGhfdGltZSI6MTUyNTIxNzExNCwiZXhwIjoxNTI1MjYwMzE0LCJpYXQiOjE1MjUyMTcxMTQsImp0aSI6ImE0ZDNhYjkxYTRiNDQyM2E5NGIzYjE5NDRhZTgwNmY3IiwiZW1haWwiOiI4MlZGQVlAdGVzdC5vcmciLCJyZXZfc2lnIjoiNjc2OGE2ZDAiLCJjaWQiOiJsb2dpbiJ9.iu2BwJQMl0iFAsN5crPnkUISXcUbY3s8UbNP9ObvM94",
      "refresh_token" : "dfd6cd7929f243468202578f7b280634-r",
      "expires_in" : 43199,
      "scope" : "openid oauth.approvals",
      "jti" : "a4d3ab91a4b4423a94b3b1944ae806f7"
    }
    

    Request Parameters

    Parameter Type Constraints Description
    response_type String Required the type of token that should be issued. possible values are id_token token and id_token.
    client_id String Optional A unique string representing the registration information provided by the client, the recipient of the token. Optional if it is passed as part of the Basic Authorization header.
    redirect_uri String Required if provided on authorization request redirection URI to which the authorization server will send the user-agent back once access is granted (or denied)
    code String Required the authorization code, obtained from /oauth/authorize, issued for the user
    grant_type String Required the type of authentication being used to obtain the token, in this case authorization_code
    client_secret String Optional The secret passphrase configured for the OAuth client. Optional if it is passed as part of the Basic Authorization header.
    token_format String Optional UAA 3.3.0 Can be set to 'opaque' to retrieve an opaque and revocable token.

    Response Fields

    Path Type Description
    access_token String the access token for the user to whom the authorization code was issued
    id_token String the OpenID Connect ID token for the user to whom the authorization code was issued
    token_type String the type of the access token issued, i.e. bearer
    expires_in Number number of seconds until token expiry
    scope String space-delimited list of scopes authorized by the user for this client
    refresh_token String an OAuth refresh token for refresh grants
    jti String a globally unique identifier for this token

    Revoke tokens

    Revoke all tokens for a user

    $ curl 'http://localhost/oauth/token/revoke/user/de8d5972-863a-4fbd-bbbf-d7631bc6d63b' -i \
        -H 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsImtpZCI6ImxlZ2FjeS10b2tlbi1rZXkiLCJ0eXAiOiJKV1QifQ.eyJqdGkiOiJlYzY3MjM5NzQ0MmI0MGY1YjYyNDUxY2YwMTNjYzNhMSIsInN1YiI6ImFkbWluIiwiYXV0aG9yaXRpZXMiOlsiY2xpZW50cy5yZWFkIiwiY2xpZW50cy5zZWNyZXQiLCJ6b25lcy5rZXlwcm92aWRlcnpvbmUuYWRtaW4iLCJ6b25lcy5maW5kYWxsa2V5cHJvdmlkZXJzem9uZS5hZG1pbiIsInpvbmVzLmRlbGV0ZWtleXByb3ZpZGVyem9uZS5hZG1pbiIsImNsaWVudHMud3JpdGUiLCJ1YWEuYWRtaW4iLCJjbGllbnRzLmFkbWluIiwiem9uZXMucmV0cmlldmVrZXlwcm92aWRlcnpvbmUuYWRtaW4iLCJzY2ltLndyaXRlIiwic2NpbS5yZWFkIl0sInNjb3BlIjpbImNsaWVudHMucmVhZCIsImNsaWVudHMuc2VjcmV0Iiwiem9uZXMua2V5cHJvdmlkZXJ6b25lLmFkbWluIiwiem9uZXMuZmluZGFsbGtleXByb3ZpZGVyc3pvbmUuYWRtaW4iLCJ6b25lcy5kZWxldGVrZXlwcm92aWRlcnpvbmUuYWRtaW4iLCJjbGllbnRzLndyaXRlIiwidWFhLmFkbWluIiwiY2xpZW50cy5hZG1pbiIsInpvbmVzLnJldHJpZXZla2V5cHJvdmlkZXJ6b25lLmFkbWluIiwic2NpbS53cml0ZSIsInNjaW0ucmVhZCJdLCJjbGllbnRfaWQiOiJhZG1pbiIsImNpZCI6ImFkbWluIiwiYXpwIjoiYWRtaW4iLCJncmFudF90eXBlIjoiY2xpZW50X2NyZWRlbnRpYWxzIiwicmV2X3NpZyI6IjIxZGYzNmFhIiwiaWF0IjoxNTI1MjE3MTIwLCJleHAiOjE1MjUyNjAzMjAsImlzcyI6Imh0dHA6Ly9sb2NhbGhvc3Q6ODA4MC91YWEvb2F1dGgvdG9rZW4iLCJ6aWQiOiJ1YWEiLCJhdWQiOlsiem9uZXMua2V5cHJvdmlkZXJ6b25lIiwic2NpbSIsImNsaWVudHMiLCJ1YWEiLCJ6b25lcy5maW5kYWxsa2V5cHJvdmlkZXJzem9uZSIsInpvbmVzLnJldHJpZXZla2V5cHJvdmlkZXJ6b25lIiwiYWRtaW4iLCJ6b25lcy5kZWxldGVrZXlwcm92aWRlcnpvbmUiXX0.uZU_lcQBHFi1IoDAVmS0kuKd0tw7NbpCqqi6k0t5IYY'
    
    GET /oauth/token/revoke/user/de8d5972-863a-4fbd-bbbf-d7631bc6d63b HTTP/1.1
    Authorization: Bearer eyJhbGciOiJIUzI1NiIsImtpZCI6ImxlZ2FjeS10b2tlbi1rZXkiLCJ0eXAiOiJKV1QifQ.eyJqdGkiOiJlYzY3MjM5NzQ0MmI0MGY1YjYyNDUxY2YwMTNjYzNhMSIsInN1YiI6ImFkbWluIiwiYXV0aG9yaXRpZXMiOlsiY2xpZW50cy5yZWFkIiwiY2xpZW50cy5zZWNyZXQiLCJ6b25lcy5rZXlwcm92aWRlcnpvbmUuYWRtaW4iLCJ6b25lcy5maW5kYWxsa2V5cHJvdmlkZXJzem9uZS5hZG1pbiIsInpvbmVzLmRlbGV0ZWtleXByb3ZpZGVyem9uZS5hZG1pbiIsImNsaWVudHMud3JpdGUiLCJ1YWEuYWRtaW4iLCJjbGllbnRzLmFkbWluIiwiem9uZXMucmV0cmlldmVrZXlwcm92aWRlcnpvbmUuYWRtaW4iLCJzY2ltLndyaXRlIiwic2NpbS5yZWFkIl0sInNjb3BlIjpbImNsaWVudHMucmVhZCIsImNsaWVudHMuc2VjcmV0Iiwiem9uZXMua2V5cHJvdmlkZXJ6b25lLmFkbWluIiwiem9uZXMuZmluZGFsbGtleXByb3ZpZGVyc3pvbmUuYWRtaW4iLCJ6b25lcy5kZWxldGVrZXlwcm92aWRlcnpvbmUuYWRtaW4iLCJjbGllbnRzLndyaXRlIiwidWFhLmFkbWluIiwiY2xpZW50cy5hZG1pbiIsInpvbmVzLnJldHJpZXZla2V5cHJvdmlkZXJ6b25lLmFkbWluIiwic2NpbS53cml0ZSIsInNjaW0ucmVhZCJdLCJjbGllbnRfaWQiOiJhZG1pbiIsImNpZCI6ImFkbWluIiwiYXpwIjoiYWRtaW4iLCJncmFudF90eXBlIjoiY2xpZW50X2NyZWRlbnRpYWxzIiwicmV2X3NpZyI6IjIxZGYzNmFhIiwiaWF0IjoxNTI1MjE3MTIwLCJleHAiOjE1MjUyNjAzMjAsImlzcyI6Imh0dHA6Ly9sb2NhbGhvc3Q6ODA4MC91YWEvb2F1dGgvdG9rZW4iLCJ6aWQiOiJ1YWEiLCJhdWQiOlsiem9uZXMua2V5cHJvdmlkZXJ6b25lIiwic2NpbSIsImNsaWVudHMiLCJ1YWEiLCJ6b25lcy5maW5kYWxsa2V5cHJvdmlkZXJzem9uZSIsInpvbmVzLnJldHJpZXZla2V5cHJvdmlkZXJ6b25lIiwiYWRtaW4iLCJ6b25lcy5kZWxldGVrZXlwcm92aWRlcnpvbmUiXX0.uZU_lcQBHFi1IoDAVmS0kuKd0tw7NbpCqqi6k0t5IYY
    Host: localhost
    
    
    HTTP/1.1 200 OK
    X-B3-TraceId: 143f61de-1ea7-4310-91bf-0e5597118a7c
    Cache-Control: no-cache, no-store, max-age=0, must-revalidate
    Pragma: no-cache
    Expires: 0
    X-XSS-Protection: 1; mode=block
    X-Frame-Options: DENY
    X-Content-Type-Options: nosniff
    
    

    Path Parameters

    /oauth/token/revoke/user/{userId}

    Parameter Description
    userId The id of the user

    Request Header

    Name Description
    Authorization Bearer token with uaa.admin or tokens.revoke scope. Any token with the matching user_id may also be used for self revocation.
    X-Identity-Zone-Id May include this header to administer another zone if using zones.<zoneId>.admin or uaa.admin scope against the default UAA zone.
    X-Identity-Zone-Subdomain If using a zones.<zoneId>.admin scope/token, indicates what zone this request goes to by supplying a subdomain.

    Revoke all tokens for a client

    $ curl 'http://localhost/oauth/token/revoke/client/E3XjIe' -i \
        -H 'Authorization: Bearer a96c347474294845bb7b87a0f8abc650'
    
    GET /oauth/token/revoke/client/E3XjIe HTTP/1.1
    Authorization: Bearer a96c347474294845bb7b87a0f8abc650
    Host: localhost
    
    
    HTTP/1.1 200 OK
    X-B3-TraceId: d035bff4-9a9a-4a39-a5a0-9ba68a76557b
    Cache-Control: no-cache, no-store, max-age=0, must-revalidate
    Pragma: no-cache
    Expires: 0
    X-XSS-Protection: 1; mode=block
    X-Frame-Options: DENY
    X-Content-Type-Options: nosniff
    
    

    Path Parameters

    /oauth/token/revoke/client/{clientId}

    Parameter Description
    clientId The id of the client

    Request Header

    Name Description
    Authorization Bearer token with uaa.admin or tokens.revoke scope.
    X-Identity-Zone-Id May include this header to administer another zone if using zones.<zoneId>.admin or uaa.admin scope against the default UAA zone.
    X-Identity-Zone-Subdomain If using a zones.<zoneId>.admin scope/token, indicates what zone this request goes to by supplying a subdomain.

    Revoke all tokens for a user and client combination

    $ curl 'http://localhost/oauth/token/revoke/user/ce776a84-dd30-4ee8-9df2-537ad2972c06/client/C8SkdP' -i \
        -H 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsImtpZCI6ImxlZ2FjeS10b2tlbi1rZXkiLCJ0eXAiOiJKV1QifQ.eyJqdGkiOiI1OTQ5NzRiZDVmMjc0Zjc1YTU5MGQ1NTczZDczMWVhNiIsInN1YiI6ImFkbWluIiwiYXV0aG9yaXRpZXMiOlsiY2xpZW50cy5yZWFkIiwiY2xpZW50cy5zZWNyZXQiLCJ6b25lcy5rZXlwcm92aWRlcnpvbmUuYWRtaW4iLCJ6b25lcy5maW5kYWxsa2V5cHJvdmlkZXJzem9uZS5hZG1pbiIsInpvbmVzLmRlbGV0ZWtleXByb3ZpZGVyem9uZS5hZG1pbiIsImNsaWVudHMud3JpdGUiLCJ1YWEuYWRtaW4iLCJjbGllbnRzLmFkbWluIiwiem9uZXMucmV0cmlldmVrZXlwcm92aWRlcnpvbmUuYWRtaW4iLCJzY2ltLndyaXRlIiwic2NpbS5yZWFkIl0sInNjb3BlIjpbImNsaWVudHMucmVhZCIsImNsaWVudHMuc2VjcmV0Iiwiem9uZXMua2V5cHJvdmlkZXJ6b25lLmFkbWluIiwiem9uZXMuZmluZGFsbGtleXByb3ZpZGVyc3pvbmUuYWRtaW4iLCJ6b25lcy5kZWxldGVrZXlwcm92aWRlcnpvbmUuYWRtaW4iLCJjbGllbnRzLndyaXRlIiwidWFhLmFkbWluIiwiY2xpZW50cy5hZG1pbiIsInpvbmVzLnJldHJpZXZla2V5cHJvdmlkZXJ6b25lLmFkbWluIiwic2NpbS53cml0ZSIsInNjaW0ucmVhZCJdLCJjbGllbnRfaWQiOiJhZG1pbiIsImNpZCI6ImFkbWluIiwiYXpwIjoiYWRtaW4iLCJncmFudF90eXBlIjoiY2xpZW50X2NyZWRlbnRpYWxzIiwicmV2X3NpZyI6IjIxZGYzNmFhIiwiaWF0IjoxNTI1MjE3MTEzLCJleHAiOjE1MjUyNjAzMTMsImlzcyI6Imh0dHA6Ly9sb2NhbGhvc3Q6ODA4MC91YWEvb2F1dGgvdG9rZW4iLCJ6aWQiOiJ1YWEiLCJhdWQiOlsiem9uZXMua2V5cHJvdmlkZXJ6b25lIiwic2NpbSIsImNsaWVudHMiLCJ1YWEiLCJ6b25lcy5maW5kYWxsa2V5cHJvdmlkZXJzem9uZSIsInpvbmVzLnJldHJpZXZla2V5cHJvdmlkZXJ6b25lIiwiYWRtaW4iLCJ6b25lcy5kZWxldGVrZXlwcm92aWRlcnpvbmUiXX0.NgMZCIwGXLTrlWFmeLMT6Y9z41WngDj01JqAOCmo56g'
    
    GET /oauth/token/revoke/user/ce776a84-dd30-4ee8-9df2-537ad2972c06/client/C8SkdP HTTP/1.1
    Authorization: Bearer eyJhbGciOiJIUzI1NiIsImtpZCI6ImxlZ2FjeS10b2tlbi1rZXkiLCJ0eXAiOiJKV1QifQ.eyJqdGkiOiI1OTQ5NzRiZDVmMjc0Zjc1YTU5MGQ1NTczZDczMWVhNiIsInN1YiI6ImFkbWluIiwiYXV0aG9yaXRpZXMiOlsiY2xpZW50cy5yZWFkIiwiY2xpZW50cy5zZWNyZXQiLCJ6b25lcy5rZXlwcm92aWRlcnpvbmUuYWRtaW4iLCJ6b25lcy5maW5kYWxsa2V5cHJvdmlkZXJzem9uZS5hZG1pbiIsInpvbmVzLmRlbGV0ZWtleXByb3ZpZGVyem9uZS5hZG1pbiIsImNsaWVudHMud3JpdGUiLCJ1YWEuYWRtaW4iLCJjbGllbnRzLmFkbWluIiwiem9uZXMucmV0cmlldmVrZXlwcm92aWRlcnpvbmUuYWRtaW4iLCJzY2ltLndyaXRlIiwic2NpbS5yZWFkIl0sInNjb3BlIjpbImNsaWVudHMucmVhZCIsImNsaWVudHMuc2VjcmV0Iiwiem9uZXMua2V5cHJvdmlkZXJ6b25lLmFkbWluIiwiem9uZXMuZmluZGFsbGtleXByb3ZpZGVyc3pvbmUuYWRtaW4iLCJ6b25lcy5kZWxldGVrZXlwcm92aWRlcnpvbmUuYWRtaW4iLCJjbGllbnRzLndyaXRlIiwidWFhLmFkbWluIiwiY2xpZW50cy5hZG1pbiIsInpvbmVzLnJldHJpZXZla2V5cHJvdmlkZXJ6b25lLmFkbWluIiwic2NpbS53cml0ZSIsInNjaW0ucmVhZCJdLCJjbGllbnRfaWQiOiJhZG1pbiIsImNpZCI6ImFkbWluIiwiYXpwIjoiYWRtaW4iLCJncmFudF90eXBlIjoiY2xpZW50X2NyZWRlbnRpYWxzIiwicmV2X3NpZyI6IjIxZGYzNmFhIiwiaWF0IjoxNTI1MjE3MTEzLCJleHAiOjE1MjUyNjAzMTMsImlzcyI6Imh0dHA6Ly9sb2NhbGhvc3Q6ODA4MC91YWEvb2F1dGgvdG9rZW4iLCJ6aWQiOiJ1YWEiLCJhdWQiOlsiem9uZXMua2V5cHJvdmlkZXJ6b25lIiwic2NpbSIsImNsaWVudHMiLCJ1YWEiLCJ6b25lcy5maW5kYWxsa2V5cHJvdmlkZXJzem9uZSIsInpvbmVzLnJldHJpZXZla2V5cHJvdmlkZXJ6b25lIiwiYWRtaW4iLCJ6b25lcy5kZWxldGVrZXlwcm92aWRlcnpvbmUiXX0.NgMZCIwGXLTrlWFmeLMT6Y9z41WngDj01JqAOCmo56g
    Host: localhost
    
    
    HTTP/1.1 200 OK
    X-B3-TraceId: 8a3a87d7-af54-4b48-a0fc-94e31c0e2c6f
    Cache-Control: no-cache, no-store, max-age=0, must-revalidate
    Pragma: no-cache
    Expires: 0
    X-XSS-Protection: 1; mode=block
    X-Frame-Options: DENY
    X-Content-Type-Options: nosniff
    
    

    Path Parameters

    /oauth/token/revoke/user/{userId}/client/{clientId}

    Parameter Description
    userId The id of the user
    clientId The id of the client

    Request Header

    Name Description
    Authorization Bearer token with uaa.admin or tokens.revoke scope. Any token with the matching user_id and client_id may also be used for self revocation.
    X-Identity-Zone-Id May include this header to administer another zone if using zones.<zoneId>.admin or uaa.admin scope against the default UAA zone.
    X-Identity-Zone-Subdomain If using a zones.<zoneId>.admin scope/token, indicates what zone this request goes to by supplying a subdomain.

    Revoke a single token

    $ curl 'http://localhost/oauth/token/revoke/f45ecf11438442b8a6e8474682fe81da' -i -X DELETE \
        -H 'Authorization: Bearer f45ecf11438442b8a6e8474682fe81da'
    
    DELETE /oauth/token/revoke/f45ecf11438442b8a6e8474682fe81da HTTP/1.1
    Authorization: Bearer f45ecf11438442b8a6e8474682fe81da
    Host: localhost
    
    
    HTTP/1.1 200 OK
    X-B3-TraceId: 49c38245-a78f-4a1a-9f80-f5820e119b93
    Cache-Control: no-cache, no-store, max-age=0, must-revalidate
    Pragma: no-cache
    Expires: 0
    X-XSS-Protection: 1; mode=block
    X-Frame-Options: DENY
    X-Content-Type-Options: nosniff
    
    

    Path Parameters

    /oauth/token/revoke/{tokenId}

    Parameter Description
    tokenId The identifier for the token to be revoked. For JWT tokens use the jti claim in the token.

    Request Header

    Name Description
    Authorization Bearer token with uaa.admin or tokens.revoke scope. You can use any token with matching token ID to revoke itself.
    X-Identity-Zone-Id May include this header to administer another zone if using zones.<zoneId>.admin or uaa.admin scope against the default UAA zone.
    X-Identity-Zone-Subdomain If using a zones.<zoneId>.admin scope/token, indicates what zone this request goes to by supplying a subdomain.

    List tokens

    List all tokens for a user

    The /oauth/token/list/user/{userId} will return all the tokens that match the user_id in the path parameter. This token requires the tokens.list scope.

    $ curl 'http://localhost/oauth/token/list/user/8f754cdb-a05c-4ad6-9905-1a4653cc77fd' -i \
        -H 'Authorization: Bearer 3cf634a7611e4a2287b3530f096ce50e' \
        -H 'Accept: application/json'
    
    GET /oauth/token/list/user/8f754cdb-a05c-4ad6-9905-1a4653cc77fd HTTP/1.1
    Authorization: Bearer 3cf634a7611e4a2287b3530f096ce50e
    Accept: application/json
    Host: localhost
    
    
    HTTP/1.1 200 OK
    X-B3-TraceId: fea13fb2-bbb9-4c6f-8531-383ef320afa8
    Cache-Control: no-cache, no-store, max-age=0, must-revalidate
    Pragma: no-cache
    Expires: 0
    X-XSS-Protection: 1; mode=block
    X-Frame-Options: DENY
    X-Content-Type-Options: nosniff
    Content-Type: application/json;charset=UTF-8
    Content-Length: 631
    
    [ {
      "tokenId" : "2d16452ce15949e0b3d712db3543bff2",
      "clientId" : "CiC7AX",
      "userId" : "8f754cdb-a05c-4ad6-9905-1a4653cc77fd",
      "format" : "OPAQUE",
      "responseType" : "ACCESS_TOKEN",
      "issuedAt" : 1525217122028,
      "expiresAt" : 1525260322024,
      "scope" : "[openid]",
      "value" : null,
      "zoneId" : "uaa"
    }, {
      "tokenId" : "6fb97a5cf5f84f72aa89fcb4c88eb669-r",
      "clientId" : "CiC7AX",
      "userId" : "8f754cdb-a05c-4ad6-9905-1a4653cc77fd",
      "format" : "OPAQUE",
      "responseType" : "REFRESH_TOKEN",
      "issuedAt" : 1525217122028,
      "expiresAt" : 1527809122021,
      "scope" : "[openid]",
      "value" : null,
      "zoneId" : "uaa"
    } ]
    

    Request Header

    Name Description
    Authorization Bearer token containing the tokens.list scope.
    Accept Set to application/json
    X-Identity-Zone-Id May include this header to administer another zone if using zones.<zoneId>.admin or uaa.admin scope against the default UAA zone.
    X-Identity-Zone-Subdomain If using a zones.<zoneId>.admin scope/token, indicates what zone this request goes to by supplying a subdomain.

    Path Parameters

    /oauth/token/list/user/{userId}

    Parameter Description
    userId The user ID to retrieve tokens for

    Response Fields

    Path Type Description
    [].zoneId String The zone ID for the token
    [].tokenId String The unique ID for the token
    [].clientId String Client ID for this token, will always match the client_id claim in the access token used for this call
    [].userId String User ID for this token, will always match the user_id claim in the access token used for this call
    [].format String What format was requested, OPAQUE or JWT
    [].expiresAt Number Token expiration date, as a epoch timestamp, in milliseconds between the expires time and midnight, January 1, 1970 UTC.
    [].issuedAt Number Token issue date as, a epoch timestamp, in milliseconds between the issued time and midnight, January 1, 1970 UTC.
    [].scope String Comma separated list of scopes this token holds, up to 1000 characters
    [].responseType String response type requested during the token request, possible values ID_TOKEN, ACCESS_TOKEN, REFRESH_TOKEN
    [].value String Access token value will always be null

    List all tokens for a client

    The /oauth/token/list/client/{clientId} will return all the tokens that match the client_id in the path parameter. This token requires the tokens.list scope.

    $ curl 'http://localhost/oauth/token/list/client/vvcm6X' -i \
        -H 'Authorization: Bearer d460eae55f2b40bd90f5ab48511f1d80' \
        -H 'Accept: application/json'
    
    GET /oauth/token/list/client/vvcm6X HTTP/1.1
    Authorization: Bearer d460eae55f2b40bd90f5ab48511f1d80
    Accept: application/json
    Host: localhost
    
    
    HTTP/1.1 200 OK
    X-B3-TraceId: a7ff726e-0a32-4242-afe3-18abe7ffbadb
    Cache-Control: no-cache, no-store, max-age=0, must-revalidate
    Pragma: no-cache
    Expires: 0
    X-XSS-Protection: 1; mode=block
    X-Frame-Options: DENY
    X-Content-Type-Options: nosniff
    Content-Type: application/json;charset=UTF-8
    Content-Length: 286
    
    [ {
      "tokenId" : "d460eae55f2b40bd90f5ab48511f1d80",
      "clientId" : "vvcm6X",
      "userId" : null,
      "format" : "OPAQUE",
      "responseType" : "ACCESS_TOKEN",
      "issuedAt" : 1525217120942,
      "expiresAt" : 1525260320939,
      "scope" : "[tokens.list]",
      "value" : null,
      "zoneId" : "uaa"
    } ]
    

    Request Header

    Name Description
    Authorization Bearer token containing the tokens.list scope.
    Accept Set to application/json
    X-Identity-Zone-Id May include this header to administer another zone if using zones.<zoneId>.admin or uaa.admin scope against the default UAA zone.
    X-Identity-Zone-Subdomain If using a zones.<zoneId>.admin scope/token, indicates what zone this request goes to by supplying a subdomain.

    Path Parameters

    /oauth/token/list/client/{clientId}

    Parameter Description
    clientId The client ID to retrieve tokens for

    Response Fields

    Path Type Description
    [].zoneId String The zone ID for the token
    [].tokenId String The unique ID for the token
    [].clientId String Client ID for this token, will always match the client_id claim in the access token used for this call
    [].userId String User ID for this token, will always match the user_id claim in the access token used for this call
    [].format String What format was requested, OPAQUE or JWT
    [].expiresAt Number Token expiration date, as a epoch timestamp, in milliseconds between the expires time and midnight, January 1, 1970 UTC.
    [].issuedAt Number Token issue date as, a epoch timestamp, in milliseconds between the issued time and midnight, January 1, 1970 UTC.
    [].scope String Comma separated list of scopes this token holds, up to 1000 characters
    [].responseType String response type requested during the token request, possible values ID_TOKEN, ACCESS_TOKEN, REFRESH_TOKEN
    [].value String Access token value will always be null

    Check Token

    $ curl 'http://localhost/check_token' -i -u 'app:appclientsecret' -X POST \
        -d 'token=9716003c10694e4c8ebc0514da37489e&scopes=password.write%2Cscim.userids'
    
    POST /check_token HTTP/1.1
    Authorization: Basic YXBwOmFwcGNsaWVudHNlY3JldA==
    Host: localhost
    Content-Type: application/x-www-form-urlencoded
    
    token=9716003c10694e4c8ebc0514da37489e&scopes=password.write%2Cscim.userids
    
    HTTP/1.1 200 OK
    X-B3-TraceId: 2fa0cc70-10b2-462f-a3e8-2c0788b0a3a0
    Cache-Control: no-cache, no-store, max-age=0, must-revalidate
    Pragma: no-cache
    Expires: 0
    X-XSS-Protection: 1; mode=block
    X-Frame-Options: DENY
    X-Content-Type-Options: nosniff
    Content-Type: application/json;charset=UTF-8
    Content-Length: 687
    
    {
      "user_id" : "918cd4c5-c407-4c12-afbd-6ec324041487",
      "user_name" : "marissa",
      "email" : "marissa@test.org",
      "client_id" : "app",
      "exp" : 1525260280,
      "scope" : [ "scim.userids", "openid", "cloud_controller.read", "password.write", "cloud_controller.write" ],
      "jti" : "9716003c10694e4c8ebc0514da37489e",
      "aud" : [ "app", "scim", "cloud_controller", "password", "openid" ],
      "sub" : "918cd4c5-c407-4c12-afbd-6ec324041487",
      "iss" : "http://localhost:8080/uaa/oauth/token",
      "iat" : 1525217080,
      "cid" : "app",
      "grant_type" : "password",
      "azp" : "app",
      "auth_time" : 1525217080,
      "zid" : "uaa",
      "rev_sig" : "7dde72f2",
      "origin" : "uaa",
      "revocable" : true
    }
    

    Request Headers

    Name Description
    Authorization Uses basic authorization with base64(resource_server:shared_secret) assuming the caller (a resource server) is actually also a registered client and has uaa.resource authority

    Request Parameters

    Parameter Type Constraints Description
    token String Required The token
    scopes Array Optional String of comma-separated scopes, for checking presence of scopes on the token

    Response Fields

    Path Type Description
    user_id String Only applicable for user tokens
    user_name String Only applicable for user tokens
    email String Only applicable for user tokens
    client_id String A unique string representing the registration information provided by the client
    exp Number Expiration Time Claim
    authorities Array Only applicable for client tokens
    scope Array List of scopes authorized by the user for this client
    jti String JWT ID Claim
    aud Array Audience Claim
    sub String Subject Claim
    iss String Issuer Claim
    iat Number Issued At Claim
    cid String See client_id
    grant_type String The type of authentication being used to obtain the token, in this case password
    azp String Authorized party
    auth_time Number Only applicable for user tokens
    zid String Zone ID
    rev_sig String Revocation Signature - token revocation hash salted with at least client ID and client secret, and optionally various user values.
    origin String Only applicable for user tokens
    revocable Boolean Set to true if this token is revocable

    Introspect Token

    Introspect token endpoint is RFC-7662 Complaint. Active flag is responsible for showing the validity of the token and not the HTTP status code. Status code will be 200 OK for both valid and invalid tokens.

    $ curl 'http://localhost/introspect' -i -u 'app:appclientsecret' -X POST \
        -d 'token=19bd1365ac0b4e2d8aefb6352229c931'
    
    POST /introspect HTTP/1.1
    Authorization: Basic YXBwOmFwcGNsaWVudHNlY3JldA==
    Host: localhost
    Content-Type: application/x-www-form-urlencoded
    
    token=19bd1365ac0b4e2d8aefb6352229c931
    
    HTTP/1.1 200 OK
    X-B3-TraceId: 759ba67f-4b58-4c6d-a1f7-220bfbcfb78c
    Cache-Control: no-cache, no-store, max-age=0, must-revalidate
    Pragma: no-cache
    Expires: 0
    X-XSS-Protection: 1; mode=block
    X-Frame-Options: DENY
    X-Content-Type-Options: nosniff
    Content-Type: application/json;charset=UTF-8
    Content-Length: 706
    
    {
      "user_id" : "918cd4c5-c407-4c12-afbd-6ec324041487",
      "user_name" : "marissa",
      "email" : "marissa@test.org",
      "client_id" : "app",
      "exp" : 1525260302,
      "scope" : [ "scim.userids", "openid", "cloud_controller.read", "password.write", "cloud_controller.write" ],
      "jti" : "19bd1365ac0b4e2d8aefb6352229c931",
      "aud" : [ "app", "scim", "cloud_controller", "password", "openid" ],
      "sub" : "918cd4c5-c407-4c12-afbd-6ec324041487",
      "iss" : "http://localhost:8080/uaa/oauth/token",
      "iat" : 1525217102,
      "cid" : "app",
      "grant_type" : "password",
      "azp" : "app",
      "auth_time" : 1525217102,
      "zid" : "uaa",
      "rev_sig" : "7dde72f2",
      "origin" : "uaa",
      "revocable" : true,
      "active" : true
    }
    

    Request Headers

    Name Description
    Authorization Uses basic authorization with base64(resource_server:shared_secret) assuming the caller (a resource server) is actually also a registered client and has uaa.resource authority

    Request Parameters

    Parameter Type Constraints Description
    token String Required The token

    Response Fields

    Path Type Description
    active Boolean Indicates whether or not the presented token is currently valid (given token has been issued by this authorization server, has not been revoked by the resource owner, and is within its given time window of validity)
    user_id String Only applicable for user tokens
    user_name String Only applicable for user tokens
    email String Only applicable for user tokens
    client_id String A unique string representing the registration information provided by the client
    exp Number Expiration Time Claim
    authorities Array Only applicable for client tokens
    scope Array List of scopes authorized by the user for this client
    jti String JWT ID Claim
    aud Array Audience Claim
    sub String Subject Claim
    iss String Issuer Claim
    iat Number Issued At Claim
    cid String See client_id
    grant_type String The type of authentication being used to obtain the token, in this case password
    azp String Authorized party
    auth_time Number Only applicable for user tokens
    zid String Zone ID
    rev_sig String Revocation Signature - token revocation hash salted with at least client ID and client secret, and optionally various user values.
    origin String Only applicable for user tokens
    revocable Boolean Set to true if this token is revocable

    Token Key(s)

    Token Key

    An endpoint which returns the JSON Web Token (JWT) key, used by the UAA to sign JWT access tokens, and to be used by authorized clients to verify that a token came from the UAA. The key is in JSON Web Key format. For complete information about JSON Web Keys, see RFC 7517. In the case when the token key is symmetric, signer key and verifier key are the same, then this call is authenticated with client credentials using the HTTP Basic method.

    JWT signing keys are specified via the identity zone configuration (see /identity-zones). An identity zone token policy can be configured with multiple keys for purposes of key rotation. When adding a new key, set its ID as the activeKeyId to use it to sign all new tokens. /check_token will continue to verify tokens signed with the previous signing key for as long as it is present in the keys of the identity zone's token policy. Remove it to invalidate all those tokens.

    Asymmetric

    $ curl 'http://localhost/token_key' -i \
        -H 'Accept: application/json' \
        -H 'If-None-Match: 1501570800000'
    
    GET /token_key HTTP/1.1
    Accept: application/json
    If-None-Match: 1501570800000
    Host: localhost
    
    
    HTTP/1.1 200 OK
    X-B3-TraceId: 2067ca2e-1c6d-4af0-a5ab-c3fa3b27d028
    Cache-Control: no-cache, no-store, max-age=0, must-revalidate
    Pragma: no-cache
    Expires: 0
    X-XSS-Protection: 1; mode=block
    X-Frame-Options: DENY
    X-Content-Type-Options: nosniff
    ETag: "1525217122203"
    Content-Type: application/json;charset=UTF-8
    Content-Length: 921
    
    {
      "kty" : "RSA",
      "e" : "AQAB",
      "use" : "sig",
      "kid" : "testKey",
      "alg" : "RS256",
      "value" : "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0m59l2u9iDnMbrXHfqkO\nrn2dVQ3vfBJqcDuFUK03d+1PZGbVlNCqnkpIJ8syFppW8ljnWweP7+LiWpRoz0I7\nfYb3d8TjhV86Y997Fl4DBrxgM6KTJOuE/uxnoDhZQ14LgOU2ckXjOzOdTsnGMKQB\nLCl0vpcXBtFLMaSbpv1ozi8h7DJyVZ6EnFQZUWGdgTMhDrmqevfx95U/16c5WBDO\nkqwIn7Glry9n9Suxygbf8g5AzpWcusZgDLIIZ7JTUldBb8qU2a0Dl4mvLZOn4wPo\njfj9Cw2QICsc5+Pwf21fP+hzf+1WSRHbnYv8uanRO0gZ8ekGaghM/2H6gqJbo2nI\nJwIDAQAB\n-----END PUBLIC KEY-----",
      "n" : "ANJufZdrvYg5zG61x36pDq59nVUN73wSanA7hVCtN3ftT2Rm1ZTQqp5KSCfLMhaaVvJY51sHj-_i4lqUaM9CO32G93fE44VfOmPfexZeAwa8YDOikyTrhP7sZ6A4WUNeC4DlNnJF4zsznU7JxjCkASwpdL6XFwbRSzGkm6b9aM4vIewyclWehJxUGVFhnYEzIQ65qnr38feVP9enOVgQzpKsCJ-xpa8vZ_UrscoG3_IOQM6VnLrGYAyyCGeyU1JXQW_KlNmtA5eJry2Tp-MD6I34_QsNkCArHOfj8H9tXz_oc3_tVkkR252L_Lmp0TtIGfHpBmoITP9h-oKiW6NpyCc"
    }
    

    Request Headers

    Name Description
    If-None-Match Optional. See Ref: RFC 2616

    Response Headers

    Name Description
    ETag The ETag version of the resource - used to decide if the client's version of the resource is already up to date. The UAA will set the ETag value to the epoch time in milliseconds of the last zone configuration change.

    Response Fields

    Path Type Description
    kid String Key ID of key to be used for verification of the token.
    alg String Encryption algorithm
    value String Verifier key
    kty String Key type (RSA)
    use String Public key use parameter - identifies intended use of the public key. (defaults to "sig")
    n String RSA key modulus
    e String RSA key public exponent

    Error Codes

    Error Code Description
    401 Unauthorized - Unregistered client or incorrect client secret

    Symmetric

    $ curl 'http://localhost/token_key' -i -u 'app:appclientsecret' \
        -H 'Accept: application/json' \
        -H 'If-None-Match: 1501570800000'
    
    GET /token_key HTTP/1.1
    Accept: application/json
    Authorization: Basic YXBwOmFwcGNsaWVudHNlY3JldA==
    If-None-Match: 1501570800000
    Host: localhost
    
    
    HTTP/1.1 200 OK
    X-B3-TraceId: d7377364-b59f-4cd4-8e94-d203b0573f2b
    Cache-Control: no-cache, no-store, max-age=0, must-revalidate
    Pragma: no-cache
    Expires: 0
    X-XSS-Protection: 1; mode=block
    X-Frame-Options: DENY
    X-Content-Type-Options: nosniff
    ETag: "1525217122166"
    Content-Type: application/json;charset=UTF-8
    Content-Length: 95
    
    {
      "kty" : "MAC",
      "alg" : "HS256",
      "value" : "key",
      "use" : "sig",
      "kid" : "testKey"
    }
    

    Request Headers

    Name Description
    Authorization Uses basic authorization with base64(resource_server:shared_secret) assuming the caller (a resource server) is actually also a registered client and has uaa.resource authority
    If-None-Match Optional. See Ref: RFC 2616

    Response Fields

    Path Type Description
    kid String Key ID of key to be used for verification of the token.
    alg String Encryption algorithm
    value String Verifier key
    kty String Key type (MAC)
    use String Public key use parameter - identifies intended use of the public key. (defaults to "sig")

    Error Codes

    Error Code Description
    401 Unauthorized - Unregistered client or incorrect client secret
    403 Forbidden - Not a resource server (missing uaa.resource scope)

    Token Keys

    An endpoint which returns the list of JWT keys. To support key rotation, this list specifies the IDs of all currently valid keys. JWT tokens issued by the UAA contain a kid field, indicating which key should be used for verification of the token.

    $ curl 'http://localhost/token_keys' -i -u 'app:appclientsecret' \
        -H 'Accept: application/json' \
        -H 'If-None-Match: 1501570800000'
    
    GET /token_keys HTTP/1.1
    Accept: application/json
    Authorization: Basic YXBwOmFwcGNsaWVudHNlY3JldA==
    If-None-Match: 1501570800000
    Host: localhost
    
    
    HTTP/1.1 200 OK
    X-B3-TraceId: de1b96a4-a4c7-4286-b71f-b5e9a9faf271
    Cache-Control: no-cache, no-store, max-age=0, must-revalidate
    Pragma: no-cache
    Expires: 0
    X-XSS-Protection: 1; mode=block
    X-Frame-Options: DENY
    X-Content-Type-Options: nosniff
    ETag: "1525217122084"
    Content-Type: application/json;charset=UTF-8
    Content-Length: 956
    
    {
      "keys" : [ {
        "kty" : "RSA",
        "e" : "AQAB",
        "use" : "sig",
        "kid" : "testKey",
        "alg" : "RS256",
        "value" : "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0m59l2u9iDnMbrXHfqkO\nrn2dVQ3vfBJqcDuFUK03d+1PZGbVlNCqnkpIJ8syFppW8ljnWweP7+LiWpRoz0I7\nfYb3d8TjhV86Y997Fl4DBrxgM6KTJOuE/uxnoDhZQ14LgOU2ckXjOzOdTsnGMKQB\nLCl0vpcXBtFLMaSbpv1ozi8h7DJyVZ6EnFQZUWGdgTMhDrmqevfx95U/16c5WBDO\nkqwIn7Glry9n9Suxygbf8g5AzpWcusZgDLIIZ7JTUldBb8qU2a0Dl4mvLZOn4wPo\njfj9Cw2QICsc5+Pwf21fP+hzf+1WSRHbnYv8uanRO0gZ8ekGaghM/2H6gqJbo2nI\nJwIDAQAB\n-----END PUBLIC KEY-----",
        "n" : "ANJufZdrvYg5zG61x36pDq59nVUN73wSanA7hVCtN3ftT2Rm1ZTQqp5KSCfLMhaaVvJY51sHj-_i4lqUaM9CO32G93fE44VfOmPfexZeAwa8YDOikyTrhP7sZ6A4WUNeC4DlNnJF4zsznU7JxjCkASwpdL6XFwbRSzGkm6b9aM4vIewyclWehJxUGVFhnYEzIQ65qnr38feVP9enOVgQzpKsCJ-xpa8vZ_UrscoG3_IOQM6VnLrGYAyyCGeyU1JXQW_KlNmtA5eJry2Tp-MD6I34_QsNkCArHOfj8H9tXz_oc3_tVkkR252L_Lmp0TtIGfHpBmoITP9h-oKiW6NpyCc"
      } ]
    }
    

    Request Headers

    Name Description
    Authorization No authorization is required for requesting public keys.
    If-None-Match Optional. See Ref: RFC 2616

    Response Headers

    Name Description
    ETag The ETag version of the resource - used to decide if the client's version of the resource is already up to date. The UAA will set the ETag value to the epoch time in milliseconds of the last zone configuration change.

    Response Fields

    Path Type Description
    keys.[].kid String Key ID of key to be used for verification of the token.
    keys.[].alg String Encryption algorithm
    keys.[].value String Verifier key
    keys.[].kty String Key type (RSA or MAC)
    keys.[].use String Public key use parameter - identifies intended use of the public key. (defaults to "sig")
    keys.[].n String RSA key modulus
    keys.[].e String RSA key public exponent

    Error Codes

    Error Code Description
    401 Unauthorized - Unregistered client or incorrect client secret

    Identity Zones

    The UAA supports multi tenancy. This is referred to as identity zones. An identity zones is accessed through a unique subdomain. If the standard UAA responds to https://uaa.10.244.0.34.xip.io a zone on this UAA would be accessed through https://testzone1.uaa.10.244.0.34.xip.io

    A zone contains a unique identifier as well as a unique subdomain:

    {
        "id":"testzone1",
        "subdomain":"testzone1",
        "name":"The Twiglet Zone[testzone1]",
        "version":0,
        "description":"Like the Twilight Zone but tastier[testzone1].",
        "created":1426258488910,
        "last_modified":1426258488910
    }
    

    The UAA by default creates a default zone. This zone will always be present, the ID will always be uaa, and the subdomain is blank:

    {
        "id": "uaa",
        "subdomain": "",
        "name": "uaa",
        "version": 0,
        "description": "The system zone for backwards compatibility",
        "created": 946710000000,
        "last_modified": 946710000000
    }
    

    Creating an identity zone

    An identity zone is created using a POST with an IdentityZone object. If the object contains an id, this id will be used as the identifier, otherwise an identifier will be generated. Once a zone has been created, the UAA will start accepting requests on the subdomain defined in the subdomain field of the identity zone. When an Identity Zone is created, an internal Identity Provider is automatically created with the default password policy.

    $ curl 'http://localhost/identity-zones' -i -X POST \
        -H 'Content-Type: application/json' \
        -H 'Authorization: Bearer 84da3821100946efa02d8f7cf7677a79' \
        -d '{
      "id" : "twiglet-create",
      "subdomain" : "twiglet-create",
      "config" : {
        "clientSecretPolicy" : {
          "minLength" : -1,
          "maxLength" : -1,
          "requireUpperCaseCharacter" : -1,
          "requireLowerCaseCharacter" : -1,
          "requireDigit" : -1,
          "requireSpecialCharacter" : -1
        },
        "tokenPolicy" : {
          "accessTokenValidity" : -1,
          "refreshTokenValidity" : -1,
          "jwtRevocable" : false,
          "refreshTokenUnique" : false,
          "refreshTokenFormat" : "jwt",
          "activeKeyId" : null,
          "keys" : {
            "exampleKeyId" : {
              "signingKey" : "s1gNiNg.K3y/t3XT"
            }
          }
        },
        "samlConfig" : {
          "assertionSigned" : true,
          "requestSigned" : true,
          "wantAssertionSigned" : true,
          "wantAuthnRequestSigned" : false,
          "assertionTimeToLiveSeconds" : 600,
          "activeKeyId" : "legacy-saml-key",
          "keys" : {
            "legacy-saml-key" : {
              "key" : "-----BEGIN RSA PRIVATE KEY-----\nMIIBOwIBAAJBAJv8ZpB5hEK7qxP9K3v43hUS5fGT4waKe7ix4Z4mu5UBv+cw7WSF\nAt0Vaag0sAbsPzU8Hhsrj/qPABvfB8asUwcCAwEAAQJAG0r3ezH35WFG1tGGaUOr\nQA61cyaII53ZdgCR1IU8bx7AUevmkFtBf+aqMWusWVOWJvGu2r5VpHVAIl8nF6DS\nkQIhAMjEJ3zVYa2/Mo4ey+iU9J9Vd+WoyXDQD4EEtwmyG1PpAiEAxuZlvhDIbbce\n7o5BvOhnCZ2N7kYb1ZC57g3F+cbJyW8CIQCbsDGHBto2qJyFxbAO7uQ8Y0UVHa0J\nBO/g900SAcJbcQIgRtEljIShOB8pDjrsQPxmI1BLhnjD1EhRSubwhDw5AFUCIQCN\nA24pDtdOHydwtSB5+zFqFLfmVZplQM/g5kb4so70Yw==\n-----END RSA PRIVATE KEY-----\n",
              "passphrase" : "password",
              "certificate" : "-----BEGIN CERTIFICATE-----\nMIICEjCCAXsCAg36MA0GCSqGSIb3DQEBBQUAMIGbMQswCQYDVQQGEwJKUDEOMAwG\nA1UECBMFVG9reW8xEDAOBgNVBAcTB0NodW8ta3UxETAPBgNVBAoTCEZyYW5rNERE\nMRgwFgYDVQQLEw9XZWJDZXJ0IFN1cHBvcnQxGDAWBgNVBAMTD0ZyYW5rNEREIFdl\nYiBDQTEjMCEGCSqGSIb3DQEJARYUc3VwcG9ydEBmcmFuazRkZC5jb20wHhcNMTIw\nODIyMDUyNjU0WhcNMTcwODIxMDUyNjU0WjBKMQswCQYDVQQGEwJKUDEOMAwGA1UE\nCAwFVG9reW8xETAPBgNVBAoMCEZyYW5rNEREMRgwFgYDVQQDDA93d3cuZXhhbXBs\nZS5jb20wXDANBgkqhkiG9w0BAQEFAANLADBIAkEAm/xmkHmEQrurE/0re/jeFRLl\n8ZPjBop7uLHhnia7lQG/5zDtZIUC3RVpqDSwBuw/NTweGyuP+o8AG98HxqxTBwID\nAQABMA0GCSqGSIb3DQEBBQUAA4GBABS2TLuBeTPmcaTaUW/LCB2NYOy8GMdzR1mx\n8iBIu2H6/E2tiY3RIevV2OW61qY2/XRQg7YPxx3ffeUugX9F4J/iPnnu1zAxxyBy\n2VguKv4SWjRFoRkIfIlHX0qVviMhSlNy2ioFLy7JcPZb+v3ftDGywUqcBiVDoea0\nHn+GmxZA\n-----END CERTIFICATE-----\n"
            }
          },
          "entityID" : "cloudfoundry-saml-login",
          "disableInResponseToCheck" : false,
          "signatureAlgorithm" : "SHA256",
          "privateKey" : "-----BEGIN RSA PRIVATE KEY-----\nMIIBOwIBAAJBAJv8ZpB5hEK7qxP9K3v43hUS5fGT4waKe7ix4Z4mu5UBv+cw7WSF\nAt0Vaag0sAbsPzU8Hhsrj/qPABvfB8asUwcCAwEAAQJAG0r3ezH35WFG1tGGaUOr\nQA61cyaII53ZdgCR1IU8bx7AUevmkFtBf+aqMWusWVOWJvGu2r5VpHVAIl8nF6DS\nkQIhAMjEJ3zVYa2/Mo4ey+iU9J9Vd+WoyXDQD4EEtwmyG1PpAiEAxuZlvhDIbbce\n7o5BvOhnCZ2N7kYb1ZC57g3F+cbJyW8CIQCbsDGHBto2qJyFxbAO7uQ8Y0UVHa0J\nBO/g900SAcJbcQIgRtEljIShOB8pDjrsQPxmI1BLhnjD1EhRSubwhDw5AFUCIQCN\nA24pDtdOHydwtSB5+zFqFLfmVZplQM/g5kb4so70Yw==\n-----END RSA PRIVATE KEY-----\n",
          "privateKeyPassword" : "password",
          "certificate" : "-----BEGIN CERTIFICATE-----\nMIICEjCCAXsCAg36MA0GCSqGSIb3DQEBBQUAMIGbMQswCQYDVQQGEwJKUDEOMAwG\nA1UECBMFVG9reW8xEDAOBgNVBAcTB0NodW8ta3UxETAPBgNVBAoTCEZyYW5rNERE\nMRgwFgYDVQQLEw9XZWJDZXJ0IFN1cHBvcnQxGDAWBgNVBAMTD0ZyYW5rNEREIFdl\nYiBDQTEjMCEGCSqGSIb3DQEJARYUc3VwcG9ydEBmcmFuazRkZC5jb20wHhcNMTIw\nODIyMDUyNjU0WhcNMTcwODIxMDUyNjU0WjBKMQswCQYDVQQGEwJKUDEOMAwGA1UE\nCAwFVG9reW8xETAPBgNVBAoMCEZyYW5rNEREMRgwFgYDVQQDDA93d3cuZXhhbXBs\nZS5jb20wXDANBgkqhkiG9w0BAQEFAANLADBIAkEAm/xmkHmEQrurE/0re/jeFRLl\n8ZPjBop7uLHhnia7lQG/5zDtZIUC3RVpqDSwBuw/NTweGyuP+o8AG98HxqxTBwID\nAQABMA0GCSqGSIb3DQEBBQUAA4GBABS2TLuBeTPmcaTaUW/LCB2NYOy8GMdzR1mx\n8iBIu2H6/E2tiY3RIevV2OW61qY2/XRQg7YPxx3ffeUugX9F4J/iPnnu1zAxxyBy\n2VguKv4SWjRFoRkIfIlHX0qVviMhSlNy2ioFLy7JcPZb+v3ftDGywUqcBiVDoea0\nHn+GmxZA\n-----END CERTIFICATE-----\n"
        },
        "corsPolicy" : {
          "xhrConfiguration" : {
            "allowedOrigins" : [ ".*" ],
            "allowedOriginPatterns" : [ ],
            "allowedUris" : [ ".*" ],
            "allowedUriPatterns" : [ ],
            "allowedHeaders" : [ "Accept", "Authorization", "Content-Type" ],
            "allowedMethods" : [ "GET" ],
            "allowedCredentials" : false,
            "maxAge" : 1728000
          },
          "defaultConfiguration" : {
            "allowedOrigins" : [ ".*" ],
            "allowedOriginPatterns" : [ ],
            "allowedUris" : [ ".*" ],
            "allowedUriPatterns" : [ ],
            "allowedHeaders" : [ "Accept", "Authorization", "Content-Type" ],
            "allowedMethods" : [ "GET" ],
            "allowedCredentials" : false,
            "maxAge" : 1728000
          }
        },
        "links" : {
          "logout" : {
            "redirectUrl" : "/login",
            "redirectParameterName" : "redirect",
            "disableRedirectParameter" : false,
            "whitelist" : null
          },
          "homeRedirect" : "http://my.hosted.homepage.com/",
          "selfService" : {
            "selfServiceLinksEnabled" : true,
            "signup" : null,
            "passwd" : null
          }
        },
        "prompts" : [ {
          "name" : "username",
          "type" : "text",
          "text" : "Username"
        }, {
          "name" : "password",
          "type" : "password",
          "text" : "Password"
        }, {
          "name" : "passcode",
          "type" : "password",
          "text" : "One Time Code (Get on at /passcode)"
        } ],
        "idpDiscoveryEnabled" : false,
        "branding" : {
          "companyName" : "Test Company",
          "productLogo" : "VGVzdFByb2R1Y3RMb2dv",
          "squareLogo" : "VGVzdFNxdWFyZUxvZ28=",
          "footerLegalText" : "Test footer legal text",
          "footerLinks" : {
            "Support" : "http://support.example.com"
          },
          "banner" : {
            "logo" : "VGVzdFByb2R1Y3RMb2dv",
            "text" : "Announcement",
            "textColor" : "#000000",
            "backgroundColor" : "#89cff0",
            "link" : "http://announce.example.com"
          }
        },
        "accountChooserEnabled" : false,
        "userConfig" : {
          "defaultGroups" : [ "openid", "password.write", "uaa.user", "approvals.me", "profile", "roles", "user_attributes", "uaa.offline_token" ]
        },
        "mfaConfig" : {
          "enabled" : false
        }
      },
      "name" : "The Twiglet Zone",
      "version" : 0,
      "description" : "Like the Twilight Zone but tastier.",
      "created" : 1525217102185,
      "enable_redirect_uri_check" : true,
      "last_modified" : 1525217102185
    }'
    
    POST /identity-zones HTTP/1.1
    Content-Type: application/json
    Authorization: Bearer 84da3821100946efa02d8f7cf7677a79
    Host: localhost
    Content-Length: 6316
    
    {
      "id" : "twiglet-create",
      "subdomain" : "twiglet-create",
      "config" : {
        "clientSecretPolicy" : {
          "minLength" : -1,
          "maxLength" : -1,
          "requireUpperCaseCharacter" : -1,
          "requireLowerCaseCharacter" : -1,
          "requireDigit" : -1,
          "requireSpecialCharacter" : -1
        },
        "tokenPolicy" : {
          "accessTokenValidity" : -1,
          "refreshTokenValidity" : -1,
          "jwtRevocable" : false,
          "refreshTokenUnique" : false,
          "refreshTokenFormat" : "jwt",
          "activeKeyId" : null,
          "keys" : {
            "exampleKeyId" : {
              "signingKey" : "s1gNiNg.K3y/t3XT"
            }
          }
        },
        "samlConfig" : {
          "assertionSigned" : true,
          "requestSigned" : true,
          "wantAssertionSigned" : true,
          "wantAuthnRequestSigned" : false,
          "assertionTimeToLiveSeconds" : 600,
          "activeKeyId" : "legacy-saml-key",
          "keys" : {
            "legacy-saml-key" : {
              "key" : "-----BEGIN RSA PRIVATE KEY-----\nMIIBOwIBAAJBAJv8ZpB5hEK7qxP9K3v43hUS5fGT4waKe7ix4Z4mu5UBv+cw7WSF\nAt0Vaag0sAbsPzU8Hhsrj/qPABvfB8asUwcCAwEAAQJAG0r3ezH35WFG1tGGaUOr\nQA61cyaII53ZdgCR1IU8bx7AUevmkFtBf+aqMWusWVOWJvGu2r5VpHVAIl8nF6DS\nkQIhAMjEJ3zVYa2/Mo4ey+iU9J9Vd+WoyXDQD4EEtwmyG1PpAiEAxuZlvhDIbbce\n7o5BvOhnCZ2N7kYb1ZC57g3F+cbJyW8CIQCbsDGHBto2qJyFxbAO7uQ8Y0UVHa0J\nBO/g900SAcJbcQIgRtEljIShOB8pDjrsQPxmI1BLhnjD1EhRSubwhDw5AFUCIQCN\nA24pDtdOHydwtSB5+zFqFLfmVZplQM/g5kb4so70Yw==\n-----END RSA PRIVATE KEY-----\n",
              "passphrase" : "password",
              "certificate" : "-----BEGIN CERTIFICATE-----\nMIICEjCCAXsCAg36MA0GCSqGSIb3DQEBBQUAMIGbMQswCQYDVQQGEwJKUDEOMAwG\nA1UECBMFVG9reW8xEDAOBgNVBAcTB0NodW8ta3UxETAPBgNVBAoTCEZyYW5rNERE\nMRgwFgYDVQQLEw9XZWJDZXJ0IFN1cHBvcnQxGDAWBgNVBAMTD0ZyYW5rNEREIFdl\nYiBDQTEjMCEGCSqGSIb3DQEJARYUc3VwcG9ydEBmcmFuazRkZC5jb20wHhcNMTIw\nODIyMDUyNjU0WhcNMTcwODIxMDUyNjU0WjBKMQswCQYDVQQGEwJKUDEOMAwGA1UE\nCAwFVG9reW8xETAPBgNVBAoMCEZyYW5rNEREMRgwFgYDVQQDDA93d3cuZXhhbXBs\nZS5jb20wXDANBgkqhkiG9w0BAQEFAANLADBIAkEAm/xmkHmEQrurE/0re/jeFRLl\n8ZPjBop7uLHhnia7lQG/5zDtZIUC3RVpqDSwBuw/NTweGyuP+o8AG98HxqxTBwID\nAQABMA0GCSqGSIb3DQEBBQUAA4GBABS2TLuBeTPmcaTaUW/LCB2NYOy8GMdzR1mx\n8iBIu2H6/E2tiY3RIevV2OW61qY2/XRQg7YPxx3ffeUugX9F4J/iPnnu1zAxxyBy\n2VguKv4SWjRFoRkIfIlHX0qVviMhSlNy2ioFLy7JcPZb+v3ftDGywUqcBiVDoea0\nHn+GmxZA\n-----END CERTIFICATE-----\n"
            }
          },
          "entityID" : "cloudfoundry-saml-login",
          "disableInResponseToCheck" : false,
          "signatureAlgorithm" : "SHA256",
          "privateKey" : "-----BEGIN RSA PRIVATE KEY-----\nMIIBOwIBAAJBAJv8ZpB5hEK7qxP9K3v43hUS5fGT4waKe7ix4Z4mu5UBv+cw7WSF\nAt0Vaag0sAbsPzU8Hhsrj/qPABvfB8asUwcCAwEAAQJAG0r3ezH35WFG1tGGaUOr\nQA61cyaII53ZdgCR1IU8bx7AUevmkFtBf+aqMWusWVOWJvGu2r5VpHVAIl8nF6DS\nkQIhAMjEJ3zVYa2/Mo4ey+iU9J9Vd+WoyXDQD4EEtwmyG1PpAiEAxuZlvhDIbbce\n7o5BvOhnCZ2N7kYb1ZC57g3F+cbJyW8CIQCbsDGHBto2qJyFxbAO7uQ8Y0UVHa0J\nBO/g900SAcJbcQIgRtEljIShOB8pDjrsQPxmI1BLhnjD1EhRSubwhDw5AFUCIQCN\nA24pDtdOHydwtSB5+zFqFLfmVZplQM/g5kb4so70Yw==\n-----END RSA PRIVATE KEY-----\n",
          "privateKeyPassword" : "password",
          "certificate" : "-----BEGIN CERTIFICATE-----\nMIICEjCCAXsCAg36MA0GCSqGSIb3DQEBBQUAMIGbMQswCQYDVQQGEwJKUDEOMAwG\nA1UECBMFVG9reW8xEDAOBgNVBAcTB0NodW8ta3UxETAPBgNVBAoTCEZyYW5rNERE\nMRgwFgYDVQQLEw9XZWJDZXJ0IFN1cHBvcnQxGDAWBgNVBAMTD0ZyYW5rNEREIFdl\nYiBDQTEjMCEGCSqGSIb3DQEJARYUc3VwcG9ydEBmcmFuazRkZC5jb20wHhcNMTIw\nODIyMDUyNjU0WhcNMTcwODIxMDUyNjU0WjBKMQswCQYDVQQGEwJKUDEOMAwGA1UE\nCAwFVG9reW8xETAPBgNVBAoMCEZyYW5rNEREMRgwFgYDVQQDDA93d3cuZXhhbXBs\nZS5jb20wXDANBgkqhkiG9w0BAQEFAANLADBIAkEAm/xmkHmEQrurE/0re/jeFRLl\n8ZPjBop7uLHhnia7lQG/5zDtZIUC3RVpqDSwBuw/NTweGyuP+o8AG98HxqxTBwID\nAQABMA0GCSqGSIb3DQEBBQUAA4GBABS2TLuBeTPmcaTaUW/LCB2NYOy8GMdzR1mx\n8iBIu2H6/E2tiY3RIevV2OW61qY2/XRQg7YPxx3ffeUugX9F4J/iPnnu1zAxxyBy\n2VguKv4SWjRFoRkIfIlHX0qVviMhSlNy2ioFLy7JcPZb+v3ftDGywUqcBiVDoea0\nHn+GmxZA\n-----END CERTIFICATE-----\n"
        },
        "corsPolicy" : {
          "xhrConfiguration" : {
            "allowedOrigins" : [ ".*" ],
            "allowedOriginPatterns" : [ ],
            "allowedUris" : [ ".*" ],
            "allowedUriPatterns" : [ ],
            "allowedHeaders" : [ "Accept", "Authorization", "Content-Type" ],
            "allowedMethods" : [ "GET" ],
            "allowedCredentials" : false,
            "maxAge" : 1728000
          },
          "defaultConfiguration" : {
            "allowedOrigins" : [ ".*" ],
            "allowedOriginPatterns" : [ ],
            "allowedUris" : [ ".*" ],
            "allowedUriPatterns" : [ ],
            "allowedHeaders" : [ "Accept", "Authorization", "Content-Type" ],
            "allowedMethods" : [ "GET" ],
            "allowedCredentials" : false,
            "maxAge" : 1728000
          }
        },
        "links" : {
          "logout" : {
            "redirectUrl" : "/login",
            "redirectParameterName" : "redirect",
            "disableRedirectParameter" : false,
            "whitelist" : null
          },
          "homeRedirect" : "http://my.hosted.homepage.com/",
          "selfService" : {
            "selfServiceLinksEnabled" : true,
            "signup" : null,
            "passwd" : null
          }
        },
        "prompts" : [ {
          "name" : "username",
          "type" : "text",
          "text" : "Username"
        }, {
          "name" : "password",
          "type" : "password",
          "text" : "Password"
        }, {
          "name" : "passcode",
          "type" : "password",
          "text" : "One Time Code (Get on at /passcode)"
        } ],
        "idpDiscoveryEnabled" : false,
        "branding" : {
          "companyName" : "Test Company",
          "productLogo" : "VGVzdFByb2R1Y3RMb2dv",
          "squareLogo" : "VGVzdFNxdWFyZUxvZ28=",
          "footerLegalText" : "Test footer legal text",
          "footerLinks" : {
            "Support" : "http://support.example.com"
          },
          "banner" : {
            "logo" : "VGVzdFByb2R1Y3RMb2dv",
            "text" : "Announcement",
            "textColor" : "#000000",
            "backgroundColor" : "#89cff0",
            "link" : "http://announce.example.com"
          }
        },
        "accountChooserEnabled" : false,
        "userConfig" : {
          "defaultGroups" : [ "openid", "password.write", "uaa.user", "approvals.me", "profile", "roles", "user_attributes", "uaa.offline_token" ]
        },
        "mfaConfig" : {
          "enabled" : false
        }
      },
      "name" : "The Twiglet Zone",
      "version" : 0,
      "description" : "Like the Twilight Zone but tastier.",
      "created" : 1525217102185,
      "enable_redirect_uri_check" : true,
      "last_modified" : 1525217102185
    }
    
    HTTP/1.1 201 Created
    X-B3-TraceId: 9ac939fd-2018-45d0-b168-730fb8af2203
    Cache-Control: no-cache, no-store, max-age=0, must-revalidate
    Pragma: no-cache
    Expires: 0
    X-XSS-Protection: 1; mode=block
    X-Frame-Options: DENY
    X-Content-Type-Options: nosniff
    Content-Type: application/json;charset=UTF-8
    Content-Length: 5072
    
    {
      "id" : "twiglet-create",
      "subdomain" : "twiglet-create",
      "config" : {
        "clientSecretPolicy" : {
          "minLength" : -1,
          "maxLength" : -1,
          "requireUpperCaseCharacter" : -1,
          "requireLowerCaseCharacter" : -1,
          "requireDigit" : -1,
          "requireSpecialCharacter" : -1
        },
        "tokenPolicy" : {
          "accessTokenValidity" : -1,
          "refreshTokenValidity" : -1,
          "jwtRevocable" : false,
          "refreshTokenUnique" : false,
          "refreshTokenFormat" : "jwt",
          "activeKeyId" : null
        },
        "samlConfig" : {
          "assertionSigned" : true,
          "requestSigned" : true,
          "wantAssertionSigned" : true,
          "wantAuthnRequestSigned" : false,
          "assertionTimeToLiveSeconds" : 600,
          "activeKeyId" : "legacy-saml-key",
          "keys" : {
            "legacy-saml-key" : {
              "certificate" : "-----BEGIN CERTIFICATE-----\nMIICEjCCAXsCAg36MA0GCSqGSIb3DQEBBQUAMIGbMQswCQYDVQQGEwJKUDEOMAwG\nA1UECBMFVG9reW8xEDAOBgNVBAcTB0NodW8ta3UxETAPBgNVBAoTCEZyYW5rNERE\nMRgwFgYDVQQLEw9XZWJDZXJ0IFN1cHBvcnQxGDAWBgNVBAMTD0ZyYW5rNEREIFdl\nYiBDQTEjMCEGCSqGSIb3DQEJARYUc3VwcG9ydEBmcmFuazRkZC5jb20wHhcNMTIw\nODIyMDUyNjU0WhcNMTcwODIxMDUyNjU0WjBKMQswCQYDVQQGEwJKUDEOMAwGA1UE\nCAwFVG9reW8xETAPBgNVBAoMCEZyYW5rNEREMRgwFgYDVQQDDA93d3cuZXhhbXBs\nZS5jb20wXDANBgkqhkiG9w0BAQEFAANLADBIAkEAm/xmkHmEQrurE/0re/jeFRLl\n8ZPjBop7uLHhnia7lQG/5zDtZIUC3RVpqDSwBuw/NTweGyuP+o8AG98HxqxTBwID\nAQABMA0GCSqGSIb3DQEBBQUAA4GBABS2TLuBeTPmcaTaUW/LCB2NYOy8GMdzR1mx\n8iBIu2H6/E2tiY3RIevV2OW61qY2/XRQg7YPxx3ffeUugX9F4J/iPnnu1zAxxyBy\n2VguKv4SWjRFoRkIfIlHX0qVviMhSlNy2ioFLy7JcPZb+v3ftDGywUqcBiVDoea0\nHn+GmxZA\n-----END CERTIFICATE-----\n"
            }
          },
          "entityID" : "cloudfoundry-saml-login",
          "disableInResponseToCheck" : false,
          "signatureAlgorithm" : "SHA256",
          "certificate" : "-----BEGIN CERTIFICATE-----\nMIICEjCCAXsCAg36MA0GCSqGSIb3DQEBBQUAMIGbMQswCQYDVQQGEwJKUDEOMAwG\nA1UECBMFVG9reW8xEDAOBgNVBAcTB0NodW8ta3UxETAPBgNVBAoTCEZyYW5rNERE\nMRgwFgYDVQQLEw9XZWJDZXJ0IFN1cHBvcnQxGDAWBgNVBAMTD0ZyYW5rNEREIFdl\nYiBDQTEjMCEGCSqGSIb3DQEJARYUc3VwcG9ydEBmcmFuazRkZC5jb20wHhcNMTIw\nODIyMDUyNjU0WhcNMTcwODIxMDUyNjU0WjBKMQswCQYDVQQGEwJKUDEOMAwGA1UE\nCAwFVG9reW8xETAPBgNVBAoMCEZyYW5rNEREMRgwFgYDVQQDDA93d3cuZXhhbXBs\nZS5jb20wXDANBgkqhkiG9w0BAQEFAANLADBIAkEAm/xmkHmEQrurE/0re/jeFRLl\n8ZPjBop7uLHhnia7lQG/5zDtZIUC3RVpqDSwBuw/NTweGyuP+o8AG98HxqxTBwID\nAQABMA0GCSqGSIb3DQEBBQUAA4GBABS2TLuBeTPmcaTaUW/LCB2NYOy8GMdzR1mx\n8iBIu2H6/E2tiY3RIevV2OW61qY2/XRQg7YPxx3ffeUugX9F4J/iPnnu1zAxxyBy\n2VguKv4SWjRFoRkIfIlHX0qVviMhSlNy2ioFLy7JcPZb+v3ftDGywUqcBiVDoea0\nHn+GmxZA\n-----END CERTIFICATE-----\n"
        },
        "corsPolicy" : {
          "xhrConfiguration" : {
            "allowedOrigins" : [ ".*" ],
            "allowedOriginPatterns" : [ ],
            "allowedUris" : [ ".*" ],
            "allowedUriPatterns" : [ ],
            "allowedHeaders" : [ "Accept", "Authorization", "Content-Type" ],
            "allowedMethods" : [ "GET" ],
            "allowedCredentials" : false,
            "maxAge" : 1728000
          },
          "defaultConfiguration" : {
            "allowedOrigins" : [ ".*" ],
            "allowedOriginPatterns" : [ ],
            "allowedUris" : [ ".*" ],
            "allowedUriPatterns" : [ ],
            "allowedHeaders" : [ "Accept", "Authorization", "Content-Type" ],
            "allowedMethods" : [ "GET" ],
            "allowedCredentials" : false,
            "maxAge" : 1728000
          }
        },
        "links" : {
          "logout" : {
            "redirectUrl" : "/login",
            "redirectParameterName" : "redirect",
            "disableRedirectParameter" : false,
            "whitelist" : null
          },
          "homeRedirect" : "http://my.hosted.homepage.com/",
          "selfService" : {
            "selfServiceLinksEnabled" : true,
            "signup" : null,
            "passwd" : null
          }
        },
        "prompts" : [ {
          "name" : "username",
          "type" : "text",
          "text" : "Username"
        }, {
          "name" : "password",
          "type" : "password",
          "text" : "Password"
        }, {
          "name" : "passcode",
          "type" : "password",
          "text" : "One Time Code (Get on at /passcode)"
        } ],
        "idpDiscoveryEnabled" : false,
        "branding" : {
          "companyName" : "Test Company",
          "productLogo" : "VGVzdFByb2R1Y3RMb2dv",
          "squareLogo" : "VGVzdFNxdWFyZUxvZ28=",
          "footerLegalText" : "Test footer legal text",
          "footerLinks" : {
            "Support" : "http://support.example.com"
          },
          "banner" : {
            "logo" : "VGVzdFByb2R1Y3RMb2dv",
            "text" : "Announcement",
            "textColor" : "#000000",
            "backgroundColor" : "#89cff0",
            "link" : "http://announce.example.com"
          }
        },
        "accountChooserEnabled" : false,
        "userConfig" : {
          "defaultGroups" : [ "openid", "password.write", "uaa.user", "approvals.me", "profile", "roles", "user_attributes", "uaa.offline_token" ]
        },
        "mfaConfig" : {
          "enabled" : false
        }
      },
      "name" : "The Twiglet Zone",
      "version" : 0,
      "description" : "Like the Twilight Zone but tastier.",
      "created" : 1525217102198,
      "enable_redirect_uri_check" : true,
      "last_modified" : 1525217102198
    }
    

    Request Headers

    Name Description
    Authorization Bearer token containing zones.write or uaa.admin

    Request Fields

    Path Type Constraints Description
    id String Optional Unique ID of the identity zone
    subdomain String Required Unique subdomain for the running instance. May only contain legal characters for a subdomain name.
    name String Required Human-readable zone name
    description String Optional Description of the zone
    version Number Optional Reserved for future use of E-Tag versioning
    config.clientSecretPolicy.minLength Number Required when clientSecretPolicy in the config is not null Minimum number of characters required for secret to be considered valid (defaults to 0).
    config.clientSecretPolicy.maxLength Number Required when clientSecretPolicy in the config is not null Maximum number of characters required for secret to be considered valid (defaults to 255).
    config.clientSecretPolicy.requireUpperCaseCharacter Number Required when clientSecretPolicy in the config is not null Minimum number of uppercase characters required for secret to be considered valid (defaults to 0).
    config.clientSecretPolicy.requireLowerCaseCharacter Number Required when clientSecretPolicy in the config is not null Minimum number of lowercase characters required for secret to be considered valid (defaults to 0).
    config.clientSecretPolicy.requireDigit Number Required when clientSecretPolicy in the config is not null Minimum number of digits required for secret to be considered valid (defaults to 0).
    config.clientSecretPolicy.requireSpecialCharacter Number Required when clientSecretPolicy in the config is not null Minimum number of special characters required for secret to be considered valid (defaults to 0).
    config.tokenPolicy Object Optional Various fields pertaining to the JWT access and refresh tokens.
    config.tokenPolicy.activeKeyId String Required if config.tokenPolicy.keys are set The ID for the key that is being used to sign tokens
    config.tokenPolicy.keys.. String Optional Keys which will be used to sign the token
    config.tokenPolicy.accessTokenValidity Number Optional Time in seconds between when a access token is issued and when it expires. Defaults to global accessTokenValidity
    config.tokenPolicy.refreshTokenValidity Number Optional Time in seconds between when a refresh token is issued and when it expires. Defaults to global refreshTokenValidity
    config.tokenPolicy.jwtRevocable Boolean Optional Set to true if JWT tokens should be stored in the token store, and thus made individually revocable. Opaque tokens are always stored and revocable.
    config.tokenPolicy.refreshTokenUnique Boolean Optional If true, uaa will only issue one refresh token per client_id/user_id combination. Defaults to false.
    config.tokenPolicy.refreshTokenFormat String Optional The format for the refresh token. Allowed values are jwt, opaque. Defaults to jwt.
    config.samlConfig.disableInResponseToCheck Boolean Optional If true, this zone will not validate the InResponseToField part of an incoming IDP assertion. Please see https://docs.spring.io/spring-security-saml/docs/current/reference/html/chapter-troubleshooting.html
    config.samlConfig.assertionSigned Boolean Optional If true, the SAML provider will sign all assertions
    config.samlConfig.wantAssertionSigned Boolean Optional Exposed SAML metadata property. If true, all assertions received by the SAML provider must be signed. Defaults to true.
    config.samlConfig.requestSigned Boolean Optional Exposed SAML metadata property. If true, the service provider will sign all outgoing authentication requests. Defaults to true.
    config.samlConfig.wantAuthnRequestSigned Boolean Optional If true, the authentication request from the partner service provider must be signed.
    config.samlConfig.signatureAlgorithm String Optional Exposed SAML metadata property. The signature algorithm that will be used to sign the authentication request and SAML assertion. Defaults to SHA256.
    config.samlConfig.assertionTimeToLiveSeconds Number Optional The lifetime of a SAML assertion in seconds. Defaults to 600.
    config.samlConfig.entityID String Optional Unique ID of the SAML2 entity
    config.samlConfig.certificate String Deprecated Exposed SAML metadata property. The certificate used to verify the authenticity all communications.
    config.samlConfig.privateKey String Deprecated Exposed SAML metadata property. The SAML provider's private key.
    config.samlConfig.privateKeyPassword String Deprecated Exposed SAML metadata property. The SAML provider's private key password. Reserved for future use.
    config.samlConfig.activeKeyId String Required if a list of keys defined in keys map The ID of the key that should be used for signing metadata and assertions.
    config.samlConfig.keys.*.key String Optional. Can only be used in conjunction with keys.<key-id>.passphrase and keys.<key-id>.certificate Exposed SAML metadata property. The SAML provider's private key.
    config.samlConfig.keys.*.passphrase String Optional. Can only be used in conjunction with keys.<key-id>.key and keys.<key-id>.certificate Exposed SAML metadata property. The SAML provider's private key password. Reserved for future use.
    config.samlConfig.keys.*.certificate String Optional. Can only be used in conjunction with keys.<key-id>.key and keys.<key-id>.passphrase Exposed SAML metadata property. The certificate used to verify the authenticity all communications.
    config.links.logout.redirectUrl String Optional Logout redirect url
    config.links.homeRedirect String Optional Overrides the UAA home page and issues a redirect to this URL when the browser requests / and /home.
    config.links.logout.redirectParameterName String Optional Changes the name of the redirect parameter
    config.links.logout.disableRedirectParameter Boolean Optional Deprecated, no longer affects zone behavior. Whether or not to allow the redirect parameter on logout
    config.links.logout.whitelist Array Optional List of allowed whitelist redirects
    config.links.selfService.selfServiceLinksEnabled Boolean Optional Whether or not users are allowed to sign up or reset their passwords via the UI
    config.links.selfService.signup Null Optional Where users are directed upon clicking the account creation link
    config.links.selfService.passwd Null Optional Where users are directed upon clicking the password reset link
    config.prompts[] Array Optional List of fields that users are prompted for to login. Defaults to username, password, and passcode.
    config.prompts[].name String Optional Name of field
    config.prompts[].type String Optional What kind of field this is (e.g. text or password)
    config.prompts[].text String Optional Actual text displayed on prompt for field
    config.idpDiscoveryEnabled Boolean Optional IDP Discovery should be set to true if you have configured more than one identity provider for UAA. The discovery relies on email domain being set for each additional provider
    config.accountChooserEnabled Boolean Optional This flag is required to enable account choosing functionality for IDP discovery page.
    config.branding.companyName String Optional This name is used on the UAA Pages and in account management related communication in UAA
    config.branding.productLogo String Optional This is a base64Url encoded PNG image which will be used as the logo on all UAA pages like Login, Sign Up etc.
    config.branding.squareLogo String Optional This is a base64 encoded PNG image which will be used as the favicon for the UAA pages
    config.branding.footerLegalText String Optional This text appears on the footer of all UAA pages
    config.branding.footerLinks.* Array Optional These links (Map) appear on the footer of all UAA pages. You may choose to add multiple urls for things like Support, Terms of Service etc.
    config.branding.banner.text String Optional This is text displayed in a banner at the top of the UAA login page
    config.branding.banner.logo String Optional This is base64 encoded PNG data displayed in a banner at the top of the UAA login page, overrides banner text
    config.branding.banner.link String Optional The UAA login banner will be a link pointing to this url
    config.branding.banner.textColor String Optional Hexadecimal color code for banner text color, does not allow color names
    config.branding.banner.backgroundColor String Optional Hexadecimal color code for banner background color, does not allow color names
    config.corsPolicy.xhrConfiguration.allowedOrigins Array Optional Access-Control-Allow-Origin header. Indicates whether a resource can be shared based by returning the value of the Origin request header, "*", or "null" in the response.
    config.corsPolicy.xhrConfiguration.allowedOriginPatterns Array Optional Indicates whether a resource can be shared based by returning the value of the Origin patterns.
    config.corsPolicy.xhrConfiguration.allowedUris Array Optional The list of allowed URIs.
    config.corsPolicy.xhrConfiguration.allowedUriPatterns Array Optional The list of allowed URI patterns.
    config.corsPolicy.xhrConfiguration.allowedHeaders Array Optional Access-Control-Allow-Headers header. Indicates which header field names can be used during the actual response
    config.corsPolicy.xhrConfiguration.allowedMethods Array Optional Access-Control-Allow-Methods header. Indicates which method will be used in the actual request as part of the preflight request.
    config.corsPolicy.xhrConfiguration.allowedCredentials Boolean Optional Access-Control-Allow-Credentials header. Indicates whether the response to request can be exposed when the omit credentials flag is unset. When part of the response to a preflight request it indicates that the actual request can include user credentials..
    config.corsPolicy.xhrConfiguration.maxAge Number Optional Access-Control-Max-Age header. Indicates how long the results of a preflight request can be cached in a preflight result cache
    config.corsPolicy.defaultConfiguration.allowedOrigins Array Optional Access-Control-Allow-Origin header. Indicates whether a resource can be shared based by returning the value of the Origin request header, "*", or "null" in the response.
    config.corsPolicy.defaultConfiguration.allowedOriginPatterns Array Optional Indicates whether a resource can be shared based by returning the value of the Origin patterns.
    config.corsPolicy.defaultConfiguration.allowedUris Array Optional The list of allowed URIs.
    config.corsPolicy.defaultConfiguration.allowedUriPatterns Array Optional The list of allowed URI patterns.
    config.corsPolicy.defaultConfiguration.allowedHeaders Array Optional Access-Control-Allow-Headers header. Indicates which header field names can be used during the actual response
    config.corsPolicy.defaultConfiguration.allowedMethods Array Optional Access-Control-Allow-Methods header. Indicates which method will be used in the actual request as part of the preflight request.
    config.corsPolicy.defaultConfiguration.allowedCredentials Boolean Optional Access-Control-Allow-Credentials header. Indicates whether the response to request can be exposed when the omit credentials flag is unset. When part of the response to a preflight request it indicates that the actual request can include user credentials..
    config.corsPolicy.defaultConfiguration.maxAge Number Optional Access-Control-Max-Age header. Indicates how long the results of a preflight request can be cached in a preflight result cache
    config.userConfig.defaultGroups Array Optional Default groups each user in the zone inherits.
    config.mfaConfig.enabled Boolean Optional Set true to enable Multi-factor Authentication (MFA) for the current zone. Defaults to false
    config.mfaConfig.providerName String Required when config.mfaConfig.enabled is true The unique name of the MFA provider to use for this zone.
    enable_redirect_uri_check Boolean Optional Zone-level flag that will enforce client redirect uri rules as deployed in 4.4.0. If true, check will perform at authorization. Defaults to true

    Response Fields

    Path Type Description
    id String Unique ID of the identity zone
    subdomain String Unique subdomain for the running instance. May only contain legal characters for a subdomain name.
    name String Human-readable zone name
    description String Description of the zone
    version Number Reserved for future use of E-Tag versioning
    config.tokenPolicy.activeKeyId String The ID for the key that is being used to sign tokens
    config.tokenPolicy.accessTokenValidity Number Time in seconds between when a access token is issued and when it expires. Defaults to global accessTokenValidity
    config.tokenPolicy.refreshTokenValidity Number Time in seconds between when a refresh token is issued and when it expires. Defaults to global refreshTokenValidity
    config.tokenPolicy.jwtRevocable Boolean Set to true if JWT tokens should be stored in the token store, and thus made individually revocable. Opaque tokens are always stored and revocable.
    config.tokenPolicy.refreshTokenUnique Boolean If true, uaa will only issue one refresh token per client_id/user_id combination. Defaults to false.
    config.tokenPolicy.refreshTokenFormat String The format for the refresh token. Allowed values are jwt, opaque. Defaults to jwt.
    config.clientSecretPolicy.minLength Number Minimum number of characters required for secret to be considered valid (defaults to 0).
    config.clientSecretPolicy.maxLength Number Maximum number of characters required for secret to be considered valid (defaults to 255).
    config.clientSecretPolicy.requireUpperCaseCharacter Number Minimum number of uppercase characters required for secret to be considered valid (defaults to 0).
    config.clientSecretPolicy.requireLowerCaseCharacter Number Minimum number of lowercase characters required for secret to be considered valid (defaults to 0).
    config.clientSecretPolicy.requireDigit Number Minimum number of digits required for secret to be considered valid (defaults to 0).
    config.clientSecretPolicy.requireSpecialCharacter Number Minimum number of special characters required for secret to be considered valid (defaults to 0).
    config.samlConfig.disableInResponseToCheck Boolean If true, this zone will not validate the InResponseToField part of an incoming IDP assertion. Please see https://docs.spring.io/spring-security-saml/docs/current/reference/html/chapter-troubleshooting.html
    config.samlConfig.assertionSigned Boolean If true, the SAML provider will sign all assertions
    config.samlConfig.wantAssertionSigned Boolean Exposed SAML metadata property. If true, all assertions received by the SAML provider must be signed. Defaults to true.
    config.samlConfig.requestSigned Boolean Exposed SAML metadata property. If true, the service provider will sign all outgoing authentication requests. Defaults to true.
    config.samlConfig.wantAuthnRequestSigned Boolean If true, the authentication request from the partner service provider must be signed.
    config.samlConfig.signatureAlgorithm String Exposed SAML metadata property. The signature algorithm that will be used to sign the authentication request and SAML assertion. Defaults to SHA256.
    config.samlConfig.assertionTimeToLiveSeconds Number The lifetime of a SAML assertion in seconds. Defaults to 600.
    config.samlConfig.entityID String Unique ID of the SAML2 entity
    config.samlConfig.certificate String Exposed SAML metadata property. The certificate used to verify the authenticity all communications.
    config.samlConfig.activeKeyId String The ID of the key that should be used for signing metadata and assertions.
    config.samlConfig.keys.*.certificate String Exposed SAML metadata property. The certificate used to verify the authenticity all communications.
    config.links.logout.redirectUrl String Logout redirect url
    config.links.homeRedirect String Overrides the UAA home page and issues a redirect to this URL when the browser requests / and /home.
    config.links.logout.redirectParameterName String Changes the name of the redirect parameter
    config.links.logout.disableRedirectParameter Boolean Deprecated, no longer affects zone behavior. Whether or not to allow the redirect parameter on logout
    config.links.logout.whitelist Array List of allowed whitelist redirects
    config.links.selfService.selfServiceLinksEnabled Boolean Whether or not users are allowed to sign up or reset their passwords via the UI
    config.links.selfService.signup Null Where users are directed upon clicking the account creation link
    config.links.selfService.passwd Null Where users are directed upon clicking the password reset link
    config.prompts[] Array List of fields that users are prompted for to login. Defaults to username, password, and passcode.
    config.prompts[].name String Name of field
    config.prompts[].type String What kind of field this is (e.g. text or password)
    config.prompts[].text String Actual text displayed on prompt for field
    config.idpDiscoveryEnabled Boolean IDP Discovery should be set to true if you have configured more than one identity provider for UAA. The discovery relies on email domain being set for each additional provider
    config.accountChooserEnabled Boolean This flag is required to enable account choosing functionality for IDP discovery page.
    config.branding.companyName String This name is used on the UAA Pages and in account management related communication in UAA
    config.branding.productLogo String This is a base64Url encoded PNG image which will be used as the logo on all UAA pages like Login, Sign Up etc.
    config.branding.squareLogo String This is a base64 encoded PNG image which will be used as the favicon for the UAA pages
    config.branding.footerLegalText String This text appears on the footer of all UAA pages
    config.branding.footerLinks.* Array These links (Map) appear on the footer of all UAA pages. You may choose to add multiple urls for things like Support, Terms of Service etc.
    config.branding.banner.text String This is text displayed in a banner at the top of the UAA login page
    config.branding.banner.logo String This is base64 encoded PNG data displayed in a banner at the top of the UAA login page, overrides banner text
    config.branding.banner.link String The UAA login banner will be a link pointing to this url
    config.branding.banner.textColor String Hexadecimal color code for banner text color, does not allow color names
    config.branding.banner.backgroundColor String Hexadecimal color code for banner background color, does not allow color names
    config.corsPolicy.defaultConfiguration.allowedOrigins Array Access-Control-Allow-Origin header. Indicates whether a resource can be shared based by returning the value of the Origin request header, "*", or "null" in the response.
    config.corsPolicy.defaultConfiguration.allowedOriginPatterns Array Indicates whether a resource can be shared based by returning the value of the Origin patterns.
    config.corsPolicy.defaultConfiguration.allowedUris Array The list of allowed URIs.
    config.corsPolicy.defaultConfiguration.allowedUriPatterns Array The list of allowed URI patterns.
    config.corsPolicy.defaultConfiguration.allowedHeaders Array Access-Control-Allow-Headers header. Indicates which header field names can be used during the actual response
    config.corsPolicy.defaultConfiguration.allowedMethods Array Access-Control-Allow-Methods header. Indicates which method will be used in the actual request as part of the preflight request.
    config.corsPolicy.defaultConfiguration.allowedCredentials Boolean Access-Control-Allow-Credentials header. Indicates whether the response to request can be exposed when the omit credentials flag is unset. When part of the response to a preflight request it indicates that the actual request can include user credentials..
    config.corsPolicy.defaultConfiguration.maxAge Number Access-Control-Max-Age header. Indicates how long the results of a preflight request can be cached in a preflight result cache
    config.corsPolicy.xhrConfiguration.allowedOrigins Array Access-Control-Allow-Origin header. Indicates whether a resource can be shared based by returning the value of the Origin request header, "*", or "null" in the response.
    config.corsPolicy.xhrConfiguration.allowedOriginPatterns Array Indicates whether a resource can be shared based by returning the value of the Origin patterns.
    config.corsPolicy.xhrConfiguration.allowedUris Array The list of allowed URIs.
    config.corsPolicy.xhrConfiguration.allowedUriPatterns Array The list of allowed URI patterns.
    config.corsPolicy.xhrConfiguration.allowedHeaders Array Access-Control-Allow-Headers header. Indicates which header field names can be used during the actual response
    config.corsPolicy.xhrConfiguration.allowedMethods Array Access-Control-Allow-Methods header. Indicates which method will be used in the actual request as part of the preflight request.
    config.corsPolicy.xhrConfiguration.allowedCredentials Boolean Access-Control-Allow-Credentials header. Indicates whether the response to request can be exposed when the omit credentials flag is unset. When part of the response to a preflight request it indicates that the actual request can include user credentials..
    config.corsPolicy.xhrConfiguration.maxAge Number Access-Control-Max-Age header. Indicates how long the results of a preflight request can be cached in a preflight result cache
    config.userConfig.defaultGroups Array Default groups each user in the zone inherits.
    config.mfaConfig.enabled Boolean Set true to enable Multi-factor Authentication (MFA) for the current zone. Defaults to false
    config.mfaConfig.providerName String The unique name of the MFA provider to use for this zone.
    enable_redirect_uri_check Boolean Zone-level flag that will enforce client redirect uri rules as deployed in 4.4.0. If true, check will perform at authorization. Defaults to true

    Error Codes

    Error Code Description
    400 Bad Request
    401 Unauthorized - Invalid token
    403 Forbidden - Insufficient scope (Zones can only be created by being authenticated in the default zone.)
    422 Unprocessable Entity - Invalid zone details

    Sequential example of creating a zone and creating an admin client in that zone:

    uaac target http://localhost:8080/uaa
    
    uaac token client get admin -s adminsecret
    
    uaac client update admin --authorities "uaa.admin,clients.read,clients.write,clients.secret,scim.read,scim.write,clients.admin,zones.testzone1.admin,zones.write"
    
    uaac token client get admin -s adminsecret
    
    uaac -t curl -XPOST -H"Content-Type:application/json" -H"Accept:application/json" --data '{ "id":"testzone1", "subdomain":"testzone1", "name":"The Twiglet Zone[testzone1]", "version":0, "description":"Like the Twilight Zone but tastier[testzone1]."}' /identity-zones
    
    uaac -t curl -H"X-Identity-Zone-Id:testzone1" -XPOST -H"Content-Type:application/json" -H"Accept:application/json" --data '{ "client_id" : "admin", "client_secret" : "adminsecret", "scope" : ["uaa.none"], "resource_ids" : ["none"], "authorities" : ["uaa.admin","clients.read","clients.write","clients.secret","scim.read","scim.write","clients.admin"], "authorized_grant_types" : ["client_credentials"]}' /oauth/clients
    
    uaac target http://testzone1.localhost:8080/uaa
    
    uaac token client get admin -s adminsecret
    
    uaac token decode
    

    Retrieving an identity zone

    $ curl 'http://localhost/identity-zones/twiglet-get' -i \
        -H 'Authorization: Bearer cc9e816725b6472ab5360034be7e4025'
    
    GET /identity-zones/twiglet-get HTTP/1.1
    Authorization: Bearer cc9e816725b6472ab5360034be7e4025
    Host: localhost
    
    
    HTTP/1.1 200 OK
    X-B3-TraceId: 053d8433-f5a5-4028-97c0-98082007462e
    Cache-Control: no-cache, no-store, max-age=0, must-revalidate
    Pragma: no-cache
    Expires: 0
    X-XSS-Protection: 1; mode=block
    X-Frame-Options: DENY
    X-Content-Type-Options: nosniff
    Content-Type: application/json;charset=UTF-8
    Content-Length: 5009
    
    {
      "id" : "twiglet-get",
      "subdomain" : "twiglet-get",
      "config" : {
        "clientSecretPolicy" : {
          "minLength" : -1,
          "maxLength" : -1,
          "requireUpperCaseCharacter" : -1,
          "requireLowerCaseCharacter" : -1,
          "requireDigit" : -1,
          "requireSpecialCharacter" : -1
        },
        "tokenPolicy" : {
          "accessTokenValidity" : -1,
          "refreshTokenValidity" : -1,
          "jwtRevocable" : false,
          "refreshTokenUnique" : false,
          "refreshTokenFormat" : "jwt",
          "activeKeyId" : null
        },
        "samlConfig" : {
          "assertionSigned" : true,
          "requestSigned" : true,
          "wantAssertionSigned" : true,
          "wantAuthnRequestSigned" : false,
          "assertionTimeToLiveSeconds" : 600,
          "activeKeyId" : "legacy-saml-key",
          "keys" : {
            "legacy-saml-key" : {
              "certificate" : "-----BEGIN CERTIFICATE-----\nMIICEjCCAXsCAg36MA0GCSqGSIb3DQEBBQUAMIGbMQswCQYDVQQGEwJKUDEOMAwG\nA1UECBMFVG9reW8xEDAOBgNVBAcTB0NodW8ta3UxETAPBgNVBAoTCEZyYW5rNERE\nMRgwFgYDVQQLEw9XZWJDZXJ0IFN1cHBvcnQxGDAWBgNVBAMTD0ZyYW5rNEREIFdl\nYiBDQTEjMCEGCSqGSIb3DQEJARYUc3VwcG9ydEBmcmFuazRkZC5jb20wHhcNMTIw\nODIyMDUyNjU0WhcNMTcwODIxMDUyNjU0WjBKMQswCQYDVQQGEwJKUDEOMAwGA1UE\nCAwFVG9reW8xETAPBgNVBAoMCEZyYW5rNEREMRgwFgYDVQQDDA93d3cuZXhhbXBs\nZS5jb20wXDANBgkqhkiG9w0BAQEFAANLADBIAkEAm/xmkHmEQrurE/0re/jeFRLl\n8ZPjBop7uLHhnia7lQG/5zDtZIUC3RVpqDSwBuw/NTweGyuP+o8AG98HxqxTBwID\nAQABMA0GCSqGSIb3DQEBBQUAA4GBABS2TLuBeTPmcaTaUW/LCB2NYOy8GMdzR1mx\n8iBIu2H6/E2tiY3RIevV2OW61qY2/XRQg7YPxx3ffeUugX9F4J/iPnnu1zAxxyBy\n2VguKv4SWjRFoRkIfIlHX0qVviMhSlNy2ioFLy7JcPZb+v3ftDGywUqcBiVDoea0\nHn+GmxZA\n-----END CERTIFICATE-----\n"
            }
          },
          "entityID" : "cloudfoundry-saml-login",
          "disableInResponseToCheck" : false,
          "signatureAlgorithm" : "SHA256",
          "certificate" : "-----BEGIN CERTIFICATE-----\nMIICEjCCAXsCAg36MA0GCSqGSIb3DQEBBQUAMIGbMQswCQYDVQQGEwJKUDEOMAwG\nA1UECBMFVG9reW8xEDAOBgNVBAcTB0NodW8ta3UxETAPBgNVBAoTCEZyYW5rNERE\nMRgwFgYDVQQLEw9XZWJDZXJ0IFN1cHBvcnQxGDAWBgNVBAMTD0ZyYW5rNEREIFdl\nYiBDQTEjMCEGCSqGSIb3DQEJARYUc3VwcG9ydEBmcmFuazRkZC5jb20wHhcNMTIw\nODIyMDUyNjU0WhcNMTcwODIxMDUyNjU0WjBKMQswCQYDVQQGEwJKUDEOMAwGA1UE\nCAwFVG9reW8xETAPBgNVBAoMCEZyYW5rNEREMRgwFgYDVQQDDA93d3cuZXhhbXBs\nZS5jb20wXDANBgkqhkiG9w0BAQEFAANLADBIAkEAm/xmkHmEQrurE/0re/jeFRLl\n8ZPjBop7uLHhnia7lQG/5zDtZIUC3RVpqDSwBuw/NTweGyuP+o8AG98HxqxTBwID\nAQABMA0GCSqGSIb3DQEBBQUAA4GBABS2TLuBeTPmcaTaUW/LCB2NYOy8GMdzR1mx\n8iBIu2H6/E2tiY3RIevV2OW61qY2/XRQg7YPxx3ffeUugX9F4J/iPnnu1zAxxyBy\n2VguKv4SWjRFoRkIfIlHX0qVviMhSlNy2ioFLy7JcPZb+v3ftDGywUqcBiVDoea0\nHn+GmxZA\n-----END CERTIFICATE-----\n"
        },
        "corsPolicy" : {
          "xhrConfiguration" : {
            "allowedOrigins" : [ ".*" ],
            "allowedOriginPatterns" : [ ],
            "allowedUris" : [ ".*" ],
            "allowedUriPatterns" : [ ],
            "allowedHeaders" : [ "Accept", "Authorization", "Content-Type" ],
            "allowedMethods" : [ "GET" ],
            "allowedCredentials" : false,
            "maxAge" : 1728000
          },
          "defaultConfiguration" : {
            "allowedOrigins" : [ ".*" ],
            "allowedOriginPatterns" : [ ],
            "allowedUris" : [ ".*" ],
            "allowedUriPatterns" : [ ],
            "allowedHeaders" : [ "Accept", "Authorization", "Content-Type" ],
            "allowedMethods" : [ "GET" ],
            "allowedCredentials" : false,
            "maxAge" : 1728000
          }
        },
        "links" : {
          "logout" : {
            "redirectUrl" : "/login",
            "redirectParameterName" : "redirect",
            "disableRedirectParameter" : false,
            "whitelist" : null
          },
          "homeRedirect" : "http://my.hosted.homepage.com/",
          "selfService" : {
            "selfServiceLinksEnabled" : true,
            "signup" : null,
            "passwd" : null
          }
        },
        "prompts" : [ {
          "name" : "username",
          "type" : "text",
          "text" : "Username"
        }, {
          "name" : "password",
          "type" : "password",
          "text" : "Password"
        }, {
          "name" : "passcode",
          "type" : "password",
          "text" : "One Time Code (Get on at /passcode)"
        } ],
        "idpDiscoveryEnabled" : false,
        "branding" : {
          "companyName" : "Test Company",
          "productLogo" : "VGVzdFByb2R1Y3RMb2dv",
          "squareLogo" : "VGVzdFNxdWFyZUxvZ28=",
          "footerLegalText" : "Test footer legal text",
          "footerLinks" : {
            "Support" : "http://support.example.com"
          },
          "banner" : {
            "logo" : "VGVzdFByb2R1Y3RMb2dv",
            "text" : "Announcement",
            "textColor" : "#000000",
            "backgroundColor" : "#89cff0",
            "link" : "http://announce.example.com"
          }
        },
        "accountChooserEnabled" : false,
        "userConfig" : {
          "defaultGroups" : [ "openid", "password.write", "uaa.user", "approvals.me", "profile", "roles", "user_attributes", "uaa.offline_token" ]
        },
        "mfaConfig" : {
          "enabled" : false
        }
      },
      "name" : "The Twiglet Zone",
      "version" : 0,
      "created" : 1525217101980,
      "enable_redirect_uri_check" : true,
      "last_modified" : 1525217101980
    }
    

    Path Parameters

    /identity-zones/{id}

    Parameter Description
    id Unique ID of the identity zone to retrieve

    Request Headers

    Name Description
    Authorization Bearer token containing zones.read or zones.write or uaa.admin. If you use the zone-switching header, bear token containing zones.<zone id>.admin or zones.<zone id>.read can be used.
    X-Identity-Zone-Id May include this header to administer another zone if using zones.<zoneId>.admin or uaa.admin scope against the default UAA zone.
    X-Identity-Zone-Subdomain If using a zones.<zoneId>.admin scope/token, indicates what Identity Zone this request goes to by supplying a subdomain.

    Response Fields

    Path Type Description
    id String Unique ID of the identity zone
    subdomain String Unique subdomain for the running instance. May only contain legal characters for a subdomain name.
    name String Human-readable zone name
    description String Description of the zone
    version Number Reserved for future use of E-Tag versioning
    config.tokenPolicy.activeKeyId String The ID for the key that is being used to sign tokens
    config.tokenPolicy.accessTokenValidity Number Time in seconds between when a access token is issued and when it expires. Defaults to global accessTokenValidity
    config.tokenPolicy.refreshTokenValidity Number Time in seconds between when a refresh token is issued and when it expires. Defaults to global refreshTokenValidity
    config.tokenPolicy.jwtRevocable Boolean Set to true if JWT tokens should be stored in the token store, and thus made individually revocable. Opaque tokens are always stored and revocable.
    config.tokenPolicy.refreshTokenUnique Boolean If true, uaa will only issue one refresh token per client_id/user_id combination. Defaults to false.
    config.tokenPolicy.refreshTokenFormat String The format for the refresh token. Allowed values are jwt, opaque. Defaults to jwt.
    config.clientSecretPolicy.minLength Number Minimum number of characters required for secret to be considered valid (defaults to 0).
    config.clientSecretPolicy.maxLength Number Maximum number of characters required for secret to be considered valid (defaults to 255).
    config.clientSecretPolicy.requireUpperCaseCharacter Number Minimum number of uppercase characters required for secret to be considered valid (defaults to 0).
    config.clientSecretPolicy.requireLowerCaseCharacter Number Minimum number of lowercase characters required for secret to be considered valid (defaults to 0).
    config.clientSecretPolicy.requireDigit Number Minimum number of digits required for secret to be considered valid (defaults to 0).
    config.clientSecretPolicy.requireSpecialCharacter Number Minimum number of special characters required for secret to be considered valid (defaults to 0).
    config.samlConfig.disableInResponseToCheck Boolean If true, this zone will not validate the InResponseToField part of an incoming IDP assertion. Please see https://docs.spring.io/spring-security-saml/docs/current/reference/html/chapter-troubleshooting.html
    config.samlConfig.assertionSigned Boolean If true, the SAML provider will sign all assertions
    config.samlConfig.wantAssertionSigned Boolean Exposed SAML metadata property. If true, all assertions received by the SAML provider must be signed. Defaults to true.
    config.samlConfig.requestSigned Boolean Exposed SAML metadata property. If true, the service provider will sign all outgoing authentication requests. Defaults to true.
    config.samlConfig.wantAuthnRequestSigned Boolean If true, the authentication request from the partner service provider must be signed.
    config.samlConfig.signatureAlgorithm String Exposed SAML metadata property. The signature algorithm that will be used to sign the authentication request and SAML assertion. Defaults to SHA256.
    config.samlConfig.assertionTimeToLiveSeconds Number The lifetime of a SAML assertion in seconds. Defaults to 600.
    config.samlConfig.entityID String Unique ID of the SAML2 entity
    config.samlConfig.certificate String Exposed SAML metadata property. The certificate used to verify the authenticity all communications.
    config.samlConfig.activeKeyId String The ID of the key that should be used for signing metadata and assertions.
    config.samlConfig.keys.*.certificate String Exposed SAML metadata property. The certificate used to verify the authenticity all communications.
    config.links.logout.redirectUrl String Logout redirect url
    config.links.homeRedirect String Overrides the UAA home page and issues a redirect to this URL when the browser requests / and /home.
    config.links.logout.redirectParameterName String Changes the name of the redirect parameter
    config.links.logout.disableRedirectParameter Boolean Deprecated, no longer affects zone behavior. Whether or not to allow the redirect parameter on logout
    config.links.logout.whitelist Array List of allowed whitelist redirects
    config.links.selfService.selfServiceLinksEnabled Boolean Whether or not users are allowed to sign up or reset their passwords via the UI
    config.links.selfService.signup Null Where users are directed upon clicking the account creation link
    config.links.selfService.passwd Null Where users are directed upon clicking the password reset link
    config.prompts[] Array List of fields that users are prompted for to login. Defaults to username, password, and passcode.
    config.prompts[].name String Name of field
    config.prompts[].type String What kind of field this is (e.g. text or password)
    config.prompts[].text String Actual text displayed on prompt for field
    config.idpDiscoveryEnabled Boolean IDP Discovery should be set to true if you have configured more than one identity provider for UAA. The discovery relies on email domain being set for each additional provider
    config.accountChooserEnabled Boolean This flag is required to enable account choosing functionality for IDP discovery page.
    config.branding.companyName String This name is used on the UAA Pages and in account management related communication in UAA
    config.branding.productLogo String This is a base64Url encoded PNG image which will be used as the logo on all UAA pages like Login, Sign Up etc.
    config.branding.squareLogo String This is a base64 encoded PNG image which will be used as the favicon for the UAA pages
    config.branding.footerLegalText String This text appears on the footer of all UAA pages
    config.branding.footerLinks.* Array These links (Map) appear on the footer of all UAA pages. You may choose to add multiple urls for things like Support, Terms of Service etc.
    config.branding.banner.text String This is text displayed in a banner at the top of the UAA login page
    config.branding.banner.logo String This is base64 encoded PNG data displayed in a banner at the top of the UAA login page, overrides banner text
    config.branding.banner.link String The UAA login banner will be a link pointing to this url
    config.branding.banner.textColor String Hexadecimal color code for banner text color, does not allow color names
    config.branding.banner.backgroundColor String Hexadecimal color code for banner background color, does not allow color names
    config.corsPolicy.defaultConfiguration.allowedOrigins Array Access-Control-Allow-Origin header. Indicates whether a resource can be shared based by returning the value of the Origin request header, "*", or "null" in the response.
    config.corsPolicy.defaultConfiguration.allowedOriginPatterns Array Indicates whether a resource can be shared based by returning the value of the Origin patterns.
    config.corsPolicy.defaultConfiguration.allowedUris Array The list of allowed URIs.
    config.corsPolicy.defaultConfiguration.allowedUriPatterns Array The list of allowed URI patterns.
    config.corsPolicy.defaultConfiguration.allowedHeaders Array Access-Control-Allow-Headers header. Indicates which header field names can be used during the actual response
    config.corsPolicy.defaultConfiguration.allowedMethods Array Access-Control-Allow-Methods header. Indicates which method will be used in the actual request as part of the preflight request.
    config.corsPolicy.defaultConfiguration.allowedCredentials Boolean Access-Control-Allow-Credentials header. Indicates whether the response to request can be exposed when the omit credentials flag is unset. When part of the response to a preflight request it indicates that the actual request can include user credentials..
    config.corsPolicy.defaultConfiguration.maxAge Number Access-Control-Max-Age header. Indicates how long the results of a preflight request can be cached in a preflight result cache
    config.corsPolicy.xhrConfiguration.allowedOrigins Array Access-Control-Allow-Origin header. Indicates whether a resource can be shared based by returning the value of the Origin request header, "*", or "null" in the response.
    config.corsPolicy.xhrConfiguration.allowedOriginPatterns Array Indicates whether a resource can be shared based by returning the value of the Origin patterns.
    config.corsPolicy.xhrConfiguration.allowedUris Array The list of allowed URIs.
    config.corsPolicy.xhrConfiguration.allowedUriPatterns Array The list of allowed URI patterns.
    config.corsPolicy.xhrConfiguration.allowedHeaders Array Access-Control-Allow-Headers header. Indicates which header field names can be used during the actual response
    config.corsPolicy.xhrConfiguration.allowedMethods Array Access-Control-Allow-Methods header. Indicates which method will be used in the actual request as part of the preflight request.
    config.corsPolicy.xhrConfiguration.allowedCredentials Boolean Access-Control-Allow-Credentials header. Indicates whether the response to request can be exposed when the omit credentials flag is unset. When part of the response to a preflight request it indicates that the actual request can include user credentials..
    config.corsPolicy.xhrConfiguration.maxAge Number Access-Control-Max-Age header. Indicates how long the results of a preflight request can be cached in a preflight result cache
    config.userConfig.defaultGroups Array Default groups each user in the zone inherits.
    config.mfaConfig.enabled Boolean Set true to enable Multi-factor Authentication (MFA) for the current zone. Defaults to false
    config.mfaConfig.providerName String The unique name of the MFA provider to use for this zone.
    enable_redirect_uri_check Boolean Zone-level flag that will enforce client redirect uri rules as deployed in 4.4.0. If true, check will perform at authorization. Defaults to true

    Error Codes

    Error Code Description
    400 Bad Request
    401 Unauthorized - Invalid token
    403 Forbidden - Insufficient scope
    404 Not Found - Zone does not exist

    Retrieving all identity zones

    $ curl 'http://localhost/identity-zones' -i \
        -H 'Authorization: Bearer 2640a0d0f3914ee0886c3a9c18ab067c'
    
    GET /identity-zones HTTP/1.1
    Authorization: Bearer 2640a0d0f3914ee0886c3a9c18ab067c
    Host: localhost
    
    
    HTTP/1.1 200 OK
    X-B3-TraceId: ef082e11-2b3c-48a7-a688-c6c9dc59e371
    Cache-Control: no-cache, no-store, max-age=0, must-revalidate
    Pragma: no-cache
    Expires: 0
    X-XSS-Protection: 1; mode=block
    X-Frame-Options: DENY
    X-Content-Type-Options: nosniff
    Content-Type: application/json;charset=UTF-8
    Content-Length: 15748
    
    [ {
      "id" : "twiglet-get-1",
      "subdomain" : "twiglet-get-1",
      "config" : {
        "clientSecretPolicy" : {
          "minLength" : -1,
          "maxLength" : -1,
          "requireUpperCaseCharacter" : -1,
          "requireLowerCaseCharacter" : -1,
          "requireDigit" : -1,
          "requireSpecialCharacter" : -1
        },
        "tokenPolicy" : {
          "accessTokenValidity" : -1,
          "refreshTokenValidity" : -1,
          "jwtRevocable" : false,
          "refreshTokenUnique" : false,
          "refreshTokenFormat" : "jwt",
          "activeKeyId" : null
        },
        "samlConfig" : {
          "assertionSigned" : true,
          "requestSigned" : true,
          "wantAssertionSigned" : true,
          "wantAuthnRequestSigned" : false,
          "assertionTimeToLiveSeconds" : 600,
          "activeKeyId" : "legacy-saml-key",
          "keys" : {
            "legacy-saml-key" : {
              "certificate" : "-----BEGIN CERTIFICATE-----\nMIICEjCCAXsCAg36MA0GCSqGSIb3DQEBBQUAMIGbMQswCQYDVQQGEwJKUDEOMAwG\nA1UECBMFVG9reW8xEDAOBgNVBAcTB0NodW8ta3UxETAPBgNVBAoTCEZyYW5rNERE\nMRgwFgYDVQQLEw9XZWJDZXJ0IFN1cHBvcnQxGDAWBgNVBAMTD0ZyYW5rNEREIFdl\nYiBDQTEjMCEGCSqGSIb3DQEJARYUc3VwcG9ydEBmcmFuazRkZC5jb20wHhcNMTIw\nODIyMDUyNjU0WhcNMTcwODIxMDUyNjU0WjBKMQswCQYDVQQGEwJKUDEOMAwGA1UE\nCAwFVG9reW8xETAPBgNVBAoMCEZyYW5rNEREMRgwFgYDVQQDDA93d3cuZXhhbXBs\nZS5jb20wXDANBgkqhkiG9w0BAQEFAANLADBIAkEAm/xmkHmEQrurE/0re/jeFRLl\n8ZPjBop7uLHhnia7lQG/5zDtZIUC3RVpqDSwBuw/NTweGyuP+o8AG98HxqxTBwID\nAQABMA0GCSqGSIb3DQEBBQUAA4GBABS2TLuBeTPmcaTaUW/LCB2NYOy8GMdzR1mx\n8iBIu2H6/E2tiY3RIevV2OW61qY2/XRQg7YPxx3ffeUugX9F4J/iPnnu1zAxxyBy\n2VguKv4SWjRFoRkIfIlHX0qVviMhSlNy2ioFLy7JcPZb+v3ftDGywUqcBiVDoea0\nHn+GmxZA\n-----END CERTIFICATE-----\n"
            }
          },
          "entityID" : "cloudfoundry-saml-login",
          "disableInResponseToCheck" : false,
          "signatureAlgorithm" : "SHA256",
          "certificate" : "-----BEGIN CERTIFICATE-----\nMIICEjCCAXsCAg36MA0GCSqGSIb3DQEBBQUAMIGbMQswCQYDVQQGEwJKUDEOMAwG\nA1UECBMFVG9reW8xEDAOBgNVBAcTB0NodW8ta3UxETAPBgNVBAoTCEZyYW5rNERE\nMRgwFgYDVQQLEw9XZWJDZXJ0IFN1cHBvcnQxGDAWBgNVBAMTD0ZyYW5rNEREIFdl\nYiBDQTEjMCEGCSqGSIb3DQEJARYUc3VwcG9ydEBmcmFuazRkZC5jb20wHhcNMTIw\nODIyMDUyNjU0WhcNMTcwODIxMDUyNjU0WjBKMQswCQYDVQQGEwJKUDEOMAwGA1UE\nCAwFVG9reW8xETAPBgNVBAoMCEZyYW5rNEREMRgwFgYDVQQDDA93d3cuZXhhbXBs\nZS5jb20wXDANBgkqhkiG9w0BAQEFAANLADBIAkEAm/xmkHmEQrurE/0re/jeFRLl\n8ZPjBop7uLHhnia7lQG/5zDtZIUC3RVpqDSwBuw/NTweGyuP+o8AG98HxqxTBwID\nAQABMA0GCSqGSIb3DQEBBQUAA4GBABS2TLuBeTPmcaTaUW/LCB2NYOy8GMdzR1mx\n8iBIu2H6/E2tiY3RIevV2OW61qY2/XRQg7YPxx3ffeUugX9F4J/iPnnu1zAxxyBy\n2VguKv4SWjRFoRkIfIlHX0qVviMhSlNy2ioFLy7JcPZb+v3ftDGywUqcBiVDoea0\nHn+GmxZA\n-----END CERTIFICATE-----\n"
        },
        "corsPolicy" : {
          "xhrConfiguration" : {
            "allowedOrigins" : [ ".*" ],
            "allowedOriginPatterns" : [ ],
            "allowedUris" : [ ".*" ],
            "allowedUriPatterns" : [ ],
            "allowedHeaders" : [ "Accept", "Authorization", "Content-Type" ],
            "allowedMethods" : [ "GET" ],
            "allowedCredentials" : false,
            "maxAge" : 1728000
          },
          "defaultConfiguration" : {
            "allowedOrigins" : [ ".*" ],
            "allowedOriginPatterns" : [ ],
            "allowedUris" : [ ".*" ],
            "allowedUriPatterns" : [ ],
            "allowedHeaders" : [ "Accept", "Authorization", "Content-Type" ],
            "allowedMethods" : [ "GET" ],
            "allowedCredentials" : false,
            "maxAge" : 1728000
          }
        },
        "links" : {
          "logout" : {
            "redirectUrl" : "/login",
            "redirectParameterName" : "redirect",
            "disableRedirectParameter" : false,
            "whitelist" : null
          },
          "homeRedirect" : "http://my.hosted.homepage.com/",
          "selfService" : {
            "selfServiceLinksEnabled" : true,
            "signup" : null,
            "passwd" : null
          }
        },
        "prompts" : [ {
          "name" : "username",
          "type" : "text",
          "text" : "Username"
        }, {
          "name" : "password",
          "type" : "password",
          "text" : "Password"
        }, {
          "name" : "passcode",
          "type" : "password",
          "text" : "One Time Code (Get on at /passcode)"
        } ],
        "idpDiscoveryEnabled" : false,
        "branding" : {
          "companyName" : "Test Company",
          "productLogo" : "VGVzdFByb2R1Y3RMb2dv",
          "squareLogo" : "VGVzdFNxdWFyZUxvZ28=",
          "footerLegalText" : "Test footer legal text",
          "footerLinks" : {
            "Support" : "http://support.example.com"
          },
          "banner" : {
            "logo" : "VGVzdFByb2R1Y3RMb2dv",
            "text" : "Announcement",
            "textColor" : "#000000",
            "backgroundColor" : "#89cff0",
            "link" : "http://announce.example.com"
          }
        },
        "accountChooserEnabled" : false,
        "userConfig" : {
          "defaultGroups" : [ "openid", "password.write", "uaa.user", "approvals.me", "profile", "roles", "user_attributes", "uaa.offline_token" ]
        },
        "mfaConfig" : {
          "enabled" : false
        }
      },
      "name" : "The Twiglet Zone",
      "version" : 0,
      "created" : 1525217099988,
      "enable_redirect_uri_check" : true,
      "last_modified" : 1525217099988
    }, {
      "id" : "twiglet-get-2",
      "subdomain" : "twiglet-get-2",
      "config" : {
        "clientSecretPolicy" : {
          "minLength" : -1,
          "maxLength" : -1,
          "requireUpperCaseCharacter" : -1,
          "requireLowerCaseCharacter" : -1,
          "requireDigit" : -1,
          "requireSpecialCharacter" : -1
        },
        "tokenPolicy" : {
          "accessTokenValidity" : -1,
          "refreshTokenValidity" : -1,
          "jwtRevocable" : false,
          "refreshTokenUnique" : false,
          "refreshTokenFormat" : "jwt",
          "activeKeyId" : null
        },
        "samlConfig" : {
          "assertionSigned" : true,
          "requestSigned" : true,
          "wantAssertionSigned" : true,
          "wantAuthnRequestSigned" : false,
          "assertionTimeToLiveSeconds" : 600,
          "activeKeyId" : "legacy-saml-key",
          "keys" : {
            "legacy-saml-key" : {
              "certificate" : "-----BEGIN CERTIFICATE-----\nMIICEjCCAXsCAg36MA0GCSqGSIb3DQEBBQUAMIGbMQswCQYDVQQGEwJKUDEOMAwG\nA1UECBMFVG9reW8xEDAOBgNVBAcTB0NodW8ta3UxETAPBgNVBAoTCEZyYW5rNERE\nMRgwFgYDVQQLEw9XZWJDZXJ0IFN1cHBvcnQxGDAWBgNVBAMTD0ZyYW5rNEREIFdl\nYiBDQTEjMCEGCSqGSIb3DQEJARYUc3VwcG9ydEBmcmFuazRkZC5jb20wHhcNMTIw\nODIyMDUyNjU0WhcNMTcwODIxMDUyNjU0WjBKMQswCQYDVQQGEwJKUDEOMAwGA1UE\nCAwFVG9reW8xETAPBgNVBAoMCEZyYW5rNEREMRgwFgYDVQQDDA93d3cuZXhhbXBs\nZS5jb20wXDANBgkqhkiG9w0BAQEFAANLADBIAkEAm/xmkHmEQrurE/0re/jeFRLl\n8ZPjBop7uLHhnia7lQG/5zDtZIUC3RVpqDSwBuw/NTweGyuP+o8AG98HxqxTBwID\nAQABMA0GCSqGSIb3DQEBBQUAA4GBABS2TLuBeTPmcaTaUW/LCB2NYOy8GMdzR1mx\n8iBIu2H6/E2tiY3RIevV2OW61qY2/XRQg7YPxx3ffeUugX9F4J/iPnnu1zAxxyBy\n2VguKv4SWjRFoRkIfIlHX0qVviMhSlNy2ioFLy7JcPZb+v3ftDGywUqcBiVDoea0\nHn+GmxZA\n-----END CERTIFICATE-----\n"
            }
          },
          "entityID" : "cloudfoundry-saml-login",
          "disableInResponseToCheck" : false,
          "signatureAlgorithm" : "SHA256",
          "certificate" : "-----BEGIN CERTIFICATE-----\nMIICEjCCAXsCAg36MA0GCSqGSIb3DQEBBQUAMIGbMQswCQYDVQQGEwJKUDEOMAwG\nA1UECBMFVG9reW8xEDAOBgNVBAcTB0NodW8ta3UxETAPBgNVBAoTCEZyYW5rNERE\nMRgwFgYDVQQLEw9XZWJDZXJ0IFN1cHBvcnQxGDAWBgNVBAMTD0ZyYW5rNEREIFdl\nYiBDQTEjMCEGCSqGSIb3DQEJARYUc3VwcG9ydEBmcmFuazRkZC5jb20wHhcNMTIw\nODIyMDUyNjU0WhcNMTcwODIxMDUyNjU0WjBKMQswCQYDVQQGEwJKUDEOMAwGA1UE\nCAwFVG9reW8xETAPBgNVBAoMCEZyYW5rNEREMRgwFgYDVQQDDA93d3cuZXhhbXBs\nZS5jb20wXDANBgkqhkiG9w0BAQEFAANLADBIAkEAm/xmkHmEQrurE/0re/jeFRLl\n8ZPjBop7uLHhnia7lQG/5zDtZIUC3RVpqDSwBuw/NTweGyuP+o8AG98HxqxTBwID\nAQABMA0GCSqGSIb3DQEBBQUAA4GBABS2TLuBeTPmcaTaUW/LCB2NYOy8GMdzR1mx\n8iBIu2H6/E2tiY3RIevV2OW61qY2/XRQg7YPxx3ffeUugX9F4J/iPnnu1zAxxyBy\n2VguKv4SWjRFoRkIfIlHX0qVviMhSlNy2ioFLy7JcPZb+v3ftDGywUqcBiVDoea0\nHn+GmxZA\n-----END CERTIFICATE-----\n"
        },
        "corsPolicy" : {
          "xhrConfiguration" : {
            "allowedOrigins" : [ ".*" ],
            "allowedOriginPatterns" : [ ],
            "allowedUris" : [ ".*" ],
            "allowedUriPatterns" : [ ],
            "allowedHeaders" : [ "Accept", "Authorization", "Content-Type" ],
            "allowedMethods" : [ "GET" ],
            "allowedCredentials" : false,
            "maxAge" : 1728000
          },
          "defaultConfiguration" : {
            "allowedOrigins" : [ ".*" ],
            "allowedOriginPatterns" : [ ],
            "allowedUris" : [ ".*" ],
            "allowedUriPatterns" : [ ],
            "allowedHeaders" : [ "Accept", "Authorization", "Content-Type" ],
            "allowedMethods" : [ "GET" ],
            "allowedCredentials" : false,
            "maxAge" : 1728000
          }
        },
        "links" : {
          "logout" : {
            "redirectUrl" : "/login",
            "redirectParameterName" : "redirect",
            "disableRedirectParameter" : false,
            "whitelist" : null
          },
          "homeRedirect" : "http://my.hosted.homepage.com/",
          "selfService" : {
            "selfServiceLinksEnabled" : true,
            "signup" : null,
            "passwd" : null
          }
        },
        "prompts" : [ {
          "name" : "username",
          "type" : "text",
          "text" : "Username"
        }, {
          "name" : "password",
          "type" : "password",
          "text" : "Password"
        }, {
          "name" : "passcode",
          "type" : "password",
          "text" : "One Time Code (Get on at /passcode)"
        } ],
        "idpDiscoveryEnabled" : false,
        "branding" : {
          "companyName" : "Test Company",
          "productLogo" : "VGVzdFByb2R1Y3RMb2dv",
          "squareLogo" : "VGVzdFNxdWFyZUxvZ28=",
          "footerLegalText" : "Test footer legal text",
          "footerLinks" : {
            "Support" : "http://support.example.com"
          },
          "banner" : {
            "logo" : "VGVzdFByb2R1Y3RMb2dv",
            "text" : "Announcement",
            "textColor" : "#000000",
            "backgroundColor" : "#89cff0",
            "link" : "http://announce.example.com"
          }
        },
        "accountChooserEnabled" : false,
        "userConfig" : {
          "defaultGroups" : [ "openid", "password.write", "uaa.user", "approvals.me", "profile", "roles", "user_attributes", "uaa.offline_token" ]
        },
        "mfaConfig" : {
          "enabled" : false
        }
      },
      "name" : "The Twiglet Zone",
      "version" : 0,
      "created" : 1525217100086,
      "enable_redirect_uri_check" : true,
      "last_modified" : 1525217100086
    }, {
      "id" : "uaa",
      "subdomain" : "",
      "config" : {
        "clientSecretPolicy" : {
          "minLength" : 0,
          "maxLength" : 255,
          "requireUpperCaseCharacter" : 0,
          "requireLowerCaseCharacter" : 0,
          "requireDigit" : 0,
          "requireSpecialCharacter" : 0
        },
        "tokenPolicy" : {
          "accessTokenValidity" : 43200,
          "refreshTokenValidity" : 2592000,
          "jwtRevocable" : false,
          "refreshTokenUnique" : false,
          "refreshTokenFormat" : "jwt",
          "activeKeyId" : null
        },
        "samlConfig" : {
          "assertionSigned" : true,
          "requestSigned" : true,
          "wantAssertionSigned" : true,
          "wantAuthnRequestSigned" : false,
          "assertionTimeToLiveSeconds" : 600,
          "activeKeyId" : "legacy-saml-key",
          "keys" : {
            "legacy-saml-key" : {
              "certificate" : "-----BEGIN CERTIFICATE-----\nMIIDSTCCArKgAwIBAgIBADANBgkqhkiG9w0BAQQFADB8MQswCQYDVQQGEwJhdzEO\nMAwGA1UECBMFYXJ1YmExDjAMBgNVBAoTBWFydWJhMQ4wDAYDVQQHEwVhcnViYTEO\nMAwGA1UECxMFYXJ1YmExDjAMBgNVBAMTBWFydWJhMR0wGwYJKoZIhvcNAQkBFg5h\ncnViYUBhcnViYS5hcjAeFw0xNTExMjAyMjI2MjdaFw0xNjExMTkyMjI2MjdaMHwx\nCzAJBgNVBAYTAmF3MQ4wDAYDVQQIEwVhcnViYTEOMAwGA1UEChMFYXJ1YmExDjAM\nBgNVBAcTBWFydWJhMQ4wDAYDVQQLEwVhcnViYTEOMAwGA1UEAxMFYXJ1YmExHTAb\nBgkqhkiG9w0BCQEWDmFydWJhQGFydWJhLmFyMIGfMA0GCSqGSIb3DQEBAQUAA4GN\nADCBiQKBgQDHtC5gUXxBKpEqZTLkNvFwNGnNIkggNOwOQVNbpO0WVHIivig5L39W\nqS9u0hnA+O7MCA/KlrAR4bXaeVVhwfUPYBKIpaaTWFQR5cTR1UFZJL/OF9vAfpOw\nznoD66DDCnQVpbCjtDYWX+x6imxn8HCYxhMol6ZnTbSsFW6VZjFMjQIDAQABo4Ha\nMIHXMB0GA1UdDgQWBBTx0lDzjH/iOBnOSQaSEWQLx1syGDCBpwYDVR0jBIGfMIGc\ngBTx0lDzjH/iOBnOSQaSEWQLx1syGKGBgKR+MHwxCzAJBgNVBAYTAmF3MQ4wDAYD\nVQQIEwVhcnViYTEOMAwGA1UEChMFYXJ1YmExDjAMBgNVBAcTBWFydWJhMQ4wDAYD\nVQQLEwVhcnViYTEOMAwGA1UEAxMFYXJ1YmExHTAbBgkqhkiG9w0BCQEWDmFydWJh\nQGFydWJhLmFyggEAMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEEBQADgYEAYvBJ\n0HOZbbHClXmGUjGs+GS+xC1FO/am2suCSYqNB9dyMXfOWiJ1+TLJk+o/YZt8vuxC\nKdcZYgl4l/L6PxJ982SRhc83ZW2dkAZI4M0/Ud3oePe84k8jm3A7EvH5wi5hvCkK\nRpuRBwn3Ei+jCRouxTbzKPsuCVB+1sNyxMTXzf0=\n-----END CERTIFICATE-----\n"
            }
          },
          "disableInResponseToCheck" : false,
          "signatureAlgorithm" : "SHA256",
          "certificate" : "-----BEGIN CERTIFICATE-----\nMIIDSTCCArKgAwIBAgIBADANBgkqhkiG9w0BAQQFADB8MQswCQYDVQQGEwJhdzEO\nMAwGA1UECBMFYXJ1YmExDjAMBgNVBAoTBWFydWJhMQ4wDAYDVQQHEwVhcnViYTEO\nMAwGA1UECxMFYXJ1YmExDjAMBgNVBAMTBWFydWJhMR0wGwYJKoZIhvcNAQkBFg5h\ncnViYUBhcnViYS5hcjAeFw0xNTExMjAyMjI2MjdaFw0xNjExMTkyMjI2MjdaMHwx\nCzAJBgNVBAYTAmF3MQ4wDAYDVQQIEwVhcnViYTEOMAwGA1UEChMFYXJ1YmExDjAM\nBgNVBAcTBWFydWJhMQ4wDAYDVQQLEwVhcnViYTEOMAwGA1UEAxMFYXJ1YmExHTAb\nBgkqhkiG9w0BCQEWDmFydWJhQGFydWJhLmFyMIGfMA0GCSqGSIb3DQEBAQUAA4GN\nADCBiQKBgQDHtC5gUXxBKpEqZTLkNvFwNGnNIkggNOwOQVNbpO0WVHIivig5L39W\nqS9u0hnA+O7MCA/KlrAR4bXaeVVhwfUPYBKIpaaTWFQR5cTR1UFZJL/OF9vAfpOw\nznoD66DDCnQVpbCjtDYWX+x6imxn8HCYxhMol6ZnTbSsFW6VZjFMjQIDAQABo4Ha\nMIHXMB0GA1UdDgQWBBTx0lDzjH/iOBnOSQaSEWQLx1syGDCBpwYDVR0jBIGfMIGc\ngBTx0lDzjH/iOBnOSQaSEWQLx1syGKGBgKR+MHwxCzAJBgNVBAYTAmF3MQ4wDAYD\nVQQIEwVhcnViYTEOMAwGA1UEChMFYXJ1YmExDjAMBgNVBAcTBWFydWJhMQ4wDAYD\nVQQLEwVhcnViYTEOMAwGA1UEAxMFYXJ1YmExHTAbBgkqhkiG9w0BCQEWDmFydWJh\nQGFydWJhLmFyggEAMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEEBQADgYEAYvBJ\n0HOZbbHClXmGUjGs+GS+xC1FO/am2suCSYqNB9dyMXfOWiJ1+TLJk+o/YZt8vuxC\nKdcZYgl4l/L6PxJ982SRhc83ZW2dkAZI4M0/Ud3oePe84k8jm3A7EvH5wi5hvCkK\nRpuRBwn3Ei+jCRouxTbzKPsuCVB+1sNyxMTXzf0=\n-----END CERTIFICATE-----\n"
        },
        "corsPolicy" : {
          "xhrConfiguration" : {
            "allowedOrigins" : [ ".*" ],
            "allowedOriginPatterns" : [ ],
            "allowedUris" : [ ".*" ],
            "allowedUriPatterns" : [ ],
            "allowedHeaders" : [ "Accept", "Authorization", "Content-Type" ],
            "allowedMethods" : [ "GET" ],
            "allowedCredentials" : false,
            "maxAge" : 1728000
          },
          "defaultConfiguration" : {
            "allowedOrigins" : [ ".*" ],
            "allowedOriginPatterns" : [ ],
            "allowedUris" : [ ".*" ],
            "allowedUriPatterns" : [ ],
            "allowedHeaders" : [ "Accept", "Authorization", "Content-Type" ],
            "allowedMethods" : [ "GET" ],
            "allowedCredentials" : false,
            "maxAge" : 1728000
          }
        },
        "links" : {
          "logout" : {
            "redirectUrl" : "/login",
            "redirectParameterName" : "redirect",
            "disableRedirectParameter" : false,
            "whitelist" : null
          },
          "selfService" : {
            "selfServiceLinksEnabled" : true,
            "signup" : "/create_account",
            "passwd" : "/forgot_password"
          }
        },
        "prompts" : [ {
          "name" : "username",
          "type" : "text",
          "text" : "Email"
        }, {
          "name" : "password",
          "type" : "password",
          "text" : "Password"
        }, {
          "name" : "passcode",
          "type" : "password",
          "text" : "One Time Code ( Get one at http://localhost:8080/uaa/passcode )"
        } ],
        "idpDiscoveryEnabled" : false,
        "branding" : {
          "companyName" : "Predix",
          "footerLegalText" : "Copyright © 2018 General Electric Company. All rights reserved.",
          "footerLinks" : {
            "Contact Us" : "mailto:info@predix.io"
          }
        },
        "accountChooserEnabled" : false,
        "userConfig" : {
          "defaultGroups" : [ "openid", "scim.me", "cloud_controller.read", "cloud_controller.write", "cloud_controller_service_permissions.read", "password.write", "scim.userids", "uaa.user", "approvals.me", "oauth.approvals", "profile", "roles", "user_attributes", "uaa.offline_token" ]
        },
        "mfaConfig" : {
          "enabled" : false
        }
      },
      "name" : "uaa",
      "version" : 1,
      "description" : "The system zone for backwards compatibility",
      "created" : 946684800000,
      "enable_redirect_uri_check" : true,
      "last_modified" : 1525217069331
    } ]
    

    Request Headers

    Name Description
    Authorization Bearer token containing zones.read or zones.write or uaa.admin. If you use the zone-switching header, bear token containing zones.<zone id>.admin can be used.
    X-Identity-Zone-Id May include this header to administer another zone if using zones.<zoneId>.admin or uaa.admin scope against the default UAA zone.
    X-Identity-Zone-Subdomain If using a zones.<zoneId>.admin scope/token, indicates what Identity Zone this request goes to by supplying a subdomain.

    Response Fields

    Path Type Description
    [].id String Unique ID of the identity zone
    [].subdomain String Unique subdomain for the running instance. May only contain legal characters for a subdomain name.
    [].name String Human-readable zone name
    [].description String Description of the zone
    [].version Number Reserved for future use of E-Tag versioning
    [].config.tokenPolicy.activeKeyId Varies The ID for the key that is being used to sign tokens
    [].config.tokenPolicy.accessTokenValidity Number Time in seconds between when a access token is issued and when it expires. Defaults to global accessTokenValidity
    [].config.tokenPolicy.refreshTokenValidity Number Time in seconds between when a refresh token is issued and when it expires. Defaults to global refreshTokenValidity
    [].config.tokenPolicy.jwtRevocable Boolean Set to true if JWT tokens should be stored in the token store, and thus made individually revocable. Opaque tokens are always stored and revocable.
    [].config.tokenPolicy.refreshTokenUnique Boolean If true, uaa will only issue one refresh token per client_id/user_id combination. Defaults to false.
    [].config.tokenPolicy.refreshTokenFormat String The format for the refresh token. Allowed values are jwt, opaque. Defaults to jwt.
    [].config.clientSecretPolicy.minLength Number Minimum number of characters required for secret to be considered valid (defaults to 0).
    [].config.clientSecretPolicy.maxLength Number Maximum number of characters required for secret to be considered valid (defaults to 255).
    [].config.clientSecretPolicy.requireUpperCaseCharacter Number Minimum number of uppercase characters required for secret to be considered valid (defaults to 0).
    [].config.clientSecretPolicy.requireLowerCaseCharacter Number Minimum number of lowercase characters required for secret to be considered valid (defaults to 0).
    [].config.clientSecretPolicy.requireDigit Number Minimum number of digits required for secret to be considered valid (defaults to 0).
    [].config.clientSecretPolicy.requireSpecialCharacter Number Minimum number of special characters required for secret to be considered valid (defaults to 0).
    []config.samlConfig.disableInResponseToCheck Boolean If true, this zone will not validate the InResponseToField part of an incoming IDP assertion. Please see https://docs.spring.io/spring-security-saml/docs/current/reference/html/chapter-troubleshooting.html
    [].config.samlConfig.assertionSigned Boolean If true, the SAML provider will sign all assertions
    [].config.samlConfig.wantAssertionSigned Boolean Exposed SAML metadata property. If true, all assertions received by the SAML provider must be signed. Defaults to true.
    [].config.samlConfig.requestSigned Boolean Exposed SAML metadata property. If true, the service provider will sign all outgoing authentication requests. Defaults to true.
    [].config.samlConfig.wantAuthnRequestSigned Boolean If true, the authentication request from the partner service provider must be signed.
    [].config.samlConfig.signatureAlgorithm String Exposed SAML metadata property. The signature algorithm that will be used to sign the authentication request and SAML assertion. Defaults to SHA256.
    [].config.samlConfig.assertionTimeToLiveSeconds Number The lifetime of a SAML assertion in seconds. Defaults to 600.
    [].config.samlConfig.entityID String Unique ID of the SAML2 entity
    [].config.samlConfig.certificate String Exposed SAML metadata property. The certificate used to verify the authenticity all communications.
    [].config.samlConfig.activeKeyId String The ID of the key that should be used for signing metadata and assertions.
    [].config.samlConfig.keys.* Object Exposed SAML metadata property. The certificate used to verify the authenticity all communications.
    [].config.samlConfig.keys.*.certificate String Exposed SAML metadata property. The certificate used to verify the authenticity all communications.
    [].config.links.logout.redirectUrl String Logout redirect url
    [].config.links.homeRedirect String Overrides the UAA home page and issues a redirect to this URL when the browser requests / and /home.
    [].config.links.logout.redirectParameterName String Changes the name of the redirect parameter
    [].config.links.logout.disableRedirectParameter Boolean Deprecated, no longer affects zone behavior. Whether or not to allow the redirect parameter on logout
    [].config.links.logout.whitelist Array List of allowed whitelist redirects
    [].config.links.selfService.selfServiceLinksEnabled Boolean Whether or not users are allowed to sign up or reset their passwords via the UI
    [].config.links.selfService.signup Varies Where users are directed upon clicking the account creation link
    [].config.links.selfService.passwd Varies Where users are directed upon clicking the password reset link
    [].config.branding.companyName String This name is used on the UAA Pages and in account management related communication in UAA
    [].config.branding.productLogo String This is a base64Url encoded PNG image which will be used as the logo on all UAA pages like Login, Sign Up etc.
    [].config.branding.squareLogo String This is a base64 encoded PNG image which will be used as the favicon for the UAA pages
    [].config.branding.footerLegalText String This text appears on the footer of all UAA pages
    [].config.branding.footerLinks Object These links (Map) appear on the footer of all UAA pages. You may choose to add multiple urls for things like Support, Terms of Service etc.
    [].config.prompts[] Object List of fields that users are prompted for to login. Defaults to username, password, and passcode.
    [].config.prompts[].name String List of fields that users are prompted for to login. Defaults to username, password, and passcode.
    [].config.prompts[].type String What kind of field this is (e.g. text or password)
    [].config.prompts[].text String Actual text displayed on prompt for field
    [].config.idpDiscoveryEnabled Boolean IDP Discovery should be set to true if you have configured more than one identity provider for UAA. The discovery relies on email domain being set for each additional provider
    [].config.accountChooserEnabled Boolean This flag is required to enable account choosing functionality for IDP discovery page.
    [].config.branding.companyName String This name is used on the UAA Pages and in account management related communication in UAA
    [].config.branding.productLogo String This is a base64Url encoded PNG image which will be used as the logo on all UAA pages like Login, Sign Up etc.
    [].config.branding.squareLogo String This is a base64 encoded PNG image which will be used as the favicon for the UAA pages
    [].config.branding.footerLegalText String This text appears on the footer of all UAA pages
    [].config.branding.footerLinks.* String These links (Map) appear on the footer of all UAA pages. You may choose to add multiple urls for things like Support, Terms of Service etc.
    [].config.branding.banner.text String This is text displayed in a banner at the top of the UAA login page
    [].config.branding.banner.logo String This is base64 encoded PNG data displayed in a banner at the top of the UAA login page, overrides banner text
    [].config.branding.banner.link String The UAA login banner will be a link pointing to this url
    [].config.branding.banner.textColor String Hexadecimal color code for banner text color, does not allow color names
    [].config.branding.banner.backgroundColor String Hexadecimal color code for banner background color, does not allow color names
    [].config.corsPolicy.xhrConfiguration.allowedOrigins Array Access-Control-Allow-Origin header. Indicates whether a resource can be shared based by returning the value of the Origin request header, "*", or "null" in the response.
    [].config.corsPolicy.xhrConfiguration.allowedOriginPatterns Array Indicates whether a resource can be shared based by returning the value of the Origin patterns.
    [].config.corsPolicy.xhrConfiguration.allowedUris Array The list of allowed URIs.
    [].config.corsPolicy.xhrConfiguration.allowedUriPatterns Array The list of allowed URI patterns.
    [].config.corsPolicy.xhrConfiguration.allowedHeaders Array Access-Control-Allow-Headers header. Indicates which header field names can be used during the actual response
    [].config.corsPolicy.xhrConfiguration.allowedMethods Array Access-Control-Allow-Methods header. Indicates which method will be used in the actual request as part of the preflight request.
    [].config.corsPolicy.xhrConfiguration.allowedCredentials Boolean Access-Control-Allow-Credentials header. Indicates whether the response to request can be exposed when the omit credentials flag is unset. When part of the response to a preflight request it indicates that the actual request can include user credentials..
    [].config.corsPolicy.xhrConfiguration.maxAge Number Access-Control-Max-Age header. Indicates how long the results of a preflight request can be cached in a preflight result cache
    [].config.corsPolicy.defaultConfiguration.allowedOrigins Array Access-Control-Allow-Origin header. Indicates whether a resource can be shared based by returning the value of the Origin request header, "*", or "null" in the response.
    [].config.corsPolicy.defaultConfiguration.allowedOriginPatterns Array Indicates whether a resource can be shared based by returning the value of the Origin patterns.
    [].config.corsPolicy.defaultConfiguration.allowedUris Array The list of allowed URIs.
    [].config.corsPolicy.defaultConfiguration.allowedUriPatterns Array The list of allowed URI patterns.
    [].config.corsPolicy.defaultConfiguration.allowedHeaders Array Access-Control-Allow-Headers header. Indicates which header field names can be used during the actual response
    [].config.corsPolicy.defaultConfiguration.allowedMethods Array Access-Control-Allow-Methods header. Indicates which method will be used in the actual request as part of the preflight request.
    [].config.corsPolicy.defaultConfiguration.allowedCredentials Boolean Access-Control-Allow-Credentials header. Indicates whether the response to request can be exposed when the omit credentials flag is unset. When part of the response to a preflight request it indicates that the actual request can include user credentials..
    [].config.corsPolicy.defaultConfiguration.maxAge Number Access-Control-Max-Age header. Indicates how long the results of a preflight request can be cached in a preflight result cache
    [].config.userConfig.defaultGroups Array Default groups each user in the zone inherits.
    [].config.mfaConfig.enabled Boolean Set true to enable Multi-factor Authentication (MFA) for the current zone. Defaults to false
    [].config.mfaConfig.providerName String The unique name of the MFA provider to use for this zone.
    [].enable_redirect_uri_check Boolean Zone-level flag that will enforce client redirect uri rules as deployed in 4.4.0. If true, check will perform at authorization. Defaults to true

    Error Codes

    Error Code Description
    400 Bad Request
    401 Unauthorized - Invalid token
    403 Forbidden - Insufficient scope

    Updating an Identity Zone

    $ curl 'http://localhost/identity-zones/twiglet-update' -i -X PUT \
        -H 'Content-Type: application/json' \
        -H 'Authorization: Bearer bbd10279a3f544f4980255069a83f771' \
        -d '{
      "subdomain" : "twiglet-update",
      "config" : {
        "clientSecretPolicy" : {
          "minLength" : -1,
          "maxLength" : -1,
          "requireUpperCaseCharacter" : -1,
          "requireLowerCaseCharacter" : -1,
          "requireDigit" : -1,
          "requireSpecialCharacter" : -1
        },
        "tokenPolicy" : {
          "accessTokenValidity" : -1,
          "refreshTokenValidity" : -1,
          "jwtRevocable" : false,
          "refreshTokenUnique" : false,
          "refreshTokenFormat" : "jwt",
          "activeKeyId" : null,
          "keys" : {
            "updatedKeyId" : {
              "signingKey" : "upD4t3d.s1gNiNg.K3y/t3XT"
            }
          }
        },
        "samlConfig" : {
          "assertionSigned" : true,
          "requestSigned" : true,
          "wantAssertionSigned" : true,
          "wantAuthnRequestSigned" : false,
          "assertionTimeToLiveSeconds" : 600,
          "activeKeyId" : "legacy-saml-key",
          "keys" : {
            "legacy-saml-key" : {
              "key" : "-----BEGIN RSA PRIVATE KEY-----\nMIIBOwIBAAJBAJv8ZpB5hEK7qxP9K3v43hUS5fGT4waKe7ix4Z4mu5UBv+cw7WSF\nAt0Vaag0sAbsPzU8Hhsrj/qPABvfB8asUwcCAwEAAQJAG0r3ezH35WFG1tGGaUOr\nQA61cyaII53ZdgCR1IU8bx7AUevmkFtBf+aqMWusWVOWJvGu2r5VpHVAIl8nF6DS\nkQIhAMjEJ3zVYa2/Mo4ey+iU9J9Vd+WoyXDQD4EEtwmyG1PpAiEAxuZlvhDIbbce\n7o5BvOhnCZ2N7kYb1ZC57g3F+cbJyW8CIQCbsDGHBto2qJyFxbAO7uQ8Y0UVHa0J\nBO/g900SAcJbcQIgRtEljIShOB8pDjrsQPxmI1BLhnjD1EhRSubwhDw5AFUCIQCN\nA24pDtdOHydwtSB5+zFqFLfmVZplQM/g5kb4so70Yw==\n-----END RSA PRIVATE KEY-----\n",
              "passphrase" : "password",
              "certificate" : "-----BEGIN CERTIFICATE-----\nMIICEjCCAXsCAg36MA0GCSqGSIb3DQEBBQUAMIGbMQswCQYDVQQGEwJKUDEOMAwG\nA1UECBMFVG9reW8xEDAOBgNVBAcTB0NodW8ta3UxETAPBgNVBAoTCEZyYW5rNERE\nMRgwFgYDVQQLEw9XZWJDZXJ0IFN1cHBvcnQxGDAWBgNVBAMTD0ZyYW5rNEREIFdl\nYiBDQTEjMCEGCSqGSIb3DQEJARYUc3VwcG9ydEBmcmFuazRkZC5jb20wHhcNMTIw\nODIyMDUyNjU0WhcNMTcwODIxMDUyNjU0WjBKMQswCQYDVQQGEwJKUDEOMAwGA1UE\nCAwFVG9reW8xETAPBgNVBAoMCEZyYW5rNEREMRgwFgYDVQQDDA93d3cuZXhhbXBs\nZS5jb20wXDANBgkqhkiG9w0BAQEFAANLADBIAkEAm/xmkHmEQrurE/0re/jeFRLl\n8ZPjBop7uLHhnia7lQG/5zDtZIUC3RVpqDSwBuw/NTweGyuP+o8AG98HxqxTBwID\nAQABMA0GCSqGSIb3DQEBBQUAA4GBABS2TLuBeTPmcaTaUW/LCB2NYOy8GMdzR1mx\n8iBIu2H6/E2tiY3RIevV2OW61qY2/XRQg7YPxx3ffeUugX9F4J/iPnnu1zAxxyBy\n2VguKv4SWjRFoRkIfIlHX0qVviMhSlNy2ioFLy7JcPZb+v3ftDGywUqcBiVDoea0\nHn+GmxZA\n-----END CERTIFICATE-----\n"
            }
          },
          "entityID" : "cloudfoundry-saml-login",
          "disableInResponseToCheck" : false,
          "signatureAlgorithm" : "SHA256",
          "privateKey" : "-----BEGIN RSA PRIVATE KEY-----\nMIIBOwIBAAJBAJv8ZpB5hEK7qxP9K3v43hUS5fGT4waKe7ix4Z4mu5UBv+cw7WSF\nAt0Vaag0sAbsPzU8Hhsrj/qPABvfB8asUwcCAwEAAQJAG0r3ezH35WFG1tGGaUOr\nQA61cyaII53ZdgCR1IU8bx7AUevmkFtBf+aqMWusWVOWJvGu2r5VpHVAIl8nF6DS\nkQIhAMjEJ3zVYa2/Mo4ey+iU9J9Vd+WoyXDQD4EEtwmyG1PpAiEAxuZlvhDIbbce\n7o5BvOhnCZ2N7kYb1ZC57g3F+cbJyW8CIQCbsDGHBto2qJyFxbAO7uQ8Y0UVHa0J\nBO/g900SAcJbcQIgRtEljIShOB8pDjrsQPxmI1BLhnjD1EhRSubwhDw5AFUCIQCN\nA24pDtdOHydwtSB5+zFqFLfmVZplQM/g5kb4so70Yw==\n-----END RSA PRIVATE KEY-----\n",
          "privateKeyPassword" : "password",
          "certificate" : "-----BEGIN CERTIFICATE-----\nMIICEjCCAXsCAg36MA0GCSqGSIb3DQEBBQUAMIGbMQswCQYDVQQGEwJKUDEOMAwG\nA1UECBMFVG9reW8xEDAOBgNVBAcTB0NodW8ta3UxETAPBgNVBAoTCEZyYW5rNERE\nMRgwFgYDVQQLEw9XZWJDZXJ0IFN1cHBvcnQxGDAWBgNVBAMTD0ZyYW5rNEREIFdl\nYiBDQTEjMCEGCSqGSIb3DQEJARYUc3VwcG9ydEBmcmFuazRkZC5jb20wHhcNMTIw\nODIyMDUyNjU0WhcNMTcwODIxMDUyNjU0WjBKMQswCQYDVQQGEwJKUDEOMAwGA1UE\nCAwFVG9reW8xETAPBgNVBAoMCEZyYW5rNEREMRgwFgYDVQQDDA93d3cuZXhhbXBs\nZS5jb20wXDANBgkqhkiG9w0BAQEFAANLADBIAkEAm/xmkHmEQrurE/0re/jeFRLl\n8ZPjBop7uLHhnia7lQG/5zDtZIUC3RVpqDSwBuw/NTweGyuP+o8AG98HxqxTBwID\nAQABMA0GCSqGSIb3DQEBBQUAA4GBABS2TLuBeTPmcaTaUW/LCB2NYOy8GMdzR1mx\n8iBIu2H6/E2tiY3RIevV2OW61qY2/XRQg7YPxx3ffeUugX9F4J/iPnnu1zAxxyBy\n2VguKv4SWjRFoRkIfIlHX0qVviMhSlNy2ioFLy7JcPZb+v3ftDGywUqcBiVDoea0\nHn+GmxZA\n-----END CERTIFICATE-----\n"
        },
        "corsPolicy" : {
          "xhrConfiguration" : {
            "allowedOrigins" : [ ".*" ],
            "allowedOriginPatterns" : [ ],
            "allowedUris" : [ ".*" ],
            "allowedUriPatterns" : [ ],
            "allowedHeaders" : [ "Accept", "Authorization", "Content-Type" ],
            "allowedMethods" : [ "GET" ],
            "allowedCredentials" : false,
            "maxAge" : 1728000
          },
          "defaultConfiguration" : {
            "allowedOrigins" : [ ".*" ],
            "allowedOriginPatterns" : [ ],
            "allowedUris" : [ ".*" ],
            "allowedUriPatterns" : [ ],
            "allowedHeaders" : [ "Accept", "Authorization", "Content-Type" ],
            "allowedMethods" : [ "GET" ],
            "allowedCredentials" : false,
            "maxAge" : 1728000
          }
        },
        "links" : {
          "logout" : {
            "redirectUrl" : "/login",
            "redirectParameterName" : "redirect",
            "disableRedirectParameter" : false,
            "whitelist" : null
          },
          "homeRedirect" : "http://my.hosted.homepage.com/",
          "selfService" : {
            "selfServiceLinksEnabled" : true,
            "signup" : null,
            "passwd" : null
          }
        },
        "prompts" : [ {
          "name" : "username",
          "type" : "text",
          "text" : "Username"
        }, {
          "name" : "password",
          "type" : "password",
          "text" : "Password"
        }, {
          "name" : "passcode",
          "type" : "password",
          "text" : "One Time Code (Get on at /passcode)"
        } ],
        "idpDiscoveryEnabled" : false,
        "branding" : {
          "companyName" : "Test Company",
          "productLogo" : "VGVzdFByb2R1Y3RMb2dv",
          "squareLogo" : "VGVzdFNxdWFyZUxvZ28=",
          "footerLegalText" : "Test footer legal text",
          "footerLinks" : {
            "Support" : "http://support.example.com"
          },
          "banner" : {
            "logo" : "VGVzdFByb2R1Y3RMb2dv",
            "text" : "Announcement",
            "textColor" : "#000000",
            "backgroundColor" : "#89cff0",
            "link" : "http://announce.example.com"
          }
        },
        "accountChooserEnabled" : false,
        "userConfig" : {
          "defaultGroups" : [ "openid", "password.write", "uaa.user", "approvals.me", "profile", "roles", "user_attributes", "uaa.offline_token" ]
        },
        "mfaConfig" : {
          "enabled" : false
        }
      },
      "name" : "The Updated Twiglet Zone",
      "version" : 0,
      "description" : "Like the Twilight Zone but not tastier.",
      "created" : 1525217101448,
      "enable_redirect_uri_check" : true,
      "last_modified" : 1525217101448
    }'
    
    PUT /identity-zones/twiglet-update HTTP/1.1
    Content-Type: application/json
    Authorization: Bearer bbd10279a3f544f4980255069a83f771
    Host: localhost
    Content-Length: 6309
    
    {
      "subdomain" : "twiglet-update",
      "config" : {
        "clientSecretPolicy" : {
          "minLength" : -1,
          "maxLength" : -1,
          "requireUpperCaseCharacter" : -1,
          "requireLowerCaseCharacter" : -1,
          "requireDigit" : -1,
          "requireSpecialCharacter" : -1
        },
        "tokenPolicy" : {
          "accessTokenValidity" : -1,
          "refreshTokenValidity" : -1,
          "jwtRevocable" : false,
          "refreshTokenUnique" : false,
          "refreshTokenFormat" : "jwt",
          "activeKeyId" : null,
          "keys" : {
            "updatedKeyId" : {
              "signingKey" : "upD4t3d.s1gNiNg.K3y/t3XT"
            }
          }
        },
        "samlConfig" : {
          "assertionSigned" : true,
          "requestSigned" : true,
          "wantAssertionSigned" : true,
          "wantAuthnRequestSigned" : false,
          "assertionTimeToLiveSeconds" : 600,
          "activeKeyId" : "legacy-saml-key",
          "keys" : {
            "legacy-saml-key" : {
              "key" : "-----BEGIN RSA PRIVATE KEY-----\nMIIBOwIBAAJBAJv8ZpB5hEK7qxP9K3v43hUS5fGT4waKe7ix4Z4mu5UBv+cw7WSF\nAt0Vaag0sAbsPzU8Hhsrj/qPABvfB8asUwcCAwEAAQJAG0r3ezH35WFG1tGGaUOr\nQA61cyaII53ZdgCR1IU8bx7AUevmkFtBf+aqMWusWVOWJvGu2r5VpHVAIl8nF6DS\nkQIhAMjEJ3zVYa2/Mo4ey+iU9J9Vd+WoyXDQD4EEtwmyG1PpAiEAxuZlvhDIbbce\n7o5BvOhnCZ2N7kYb1ZC57g3F+cbJyW8CIQCbsDGHBto2qJyFxbAO7uQ8Y0UVHa0J\nBO/g900SAcJbcQIgRtEljIShOB8pDjrsQPxmI1BLhnjD1EhRSubwhDw5AFUCIQCN\nA24pDtdOHydwtSB5+zFqFLfmVZplQM/g5kb4so70Yw==\n-----END RSA PRIVATE KEY-----\n",
              "passphrase" : "password",
              "certificate" : "-----BEGIN CERTIFICATE-----\nMIICEjCCAXsCAg36MA0GCSqGSIb3DQEBBQUAMIGbMQswCQYDVQQGEwJKUDEOMAwG\nA1UECBMFVG9reW8xEDAOBgNVBAcTB0NodW8ta3UxETAPBgNVBAoTCEZyYW5rNERE\nMRgwFgYDVQQLEw9XZWJDZXJ0IFN1cHBvcnQxGDAWBgNVBAMTD0ZyYW5rNEREIFdl\nYiBDQTEjMCEGCSqGSIb3DQEJARYUc3VwcG9ydEBmcmFuazRkZC5jb20wHhcNMTIw\nODIyMDUyNjU0WhcNMTcwODIxMDUyNjU0WjBKMQswCQYDVQQGEwJKUDEOMAwGA1UE\nCAwFVG9reW8xETAPBgNVBAoMCEZyYW5rNEREMRgwFgYDVQQDDA93d3cuZXhhbXBs\nZS5jb20wXDANBgkqhkiG9w0BAQEFAANLADBIAkEAm/xmkHmEQrurE/0re/jeFRLl\n8ZPjBop7uLHhnia7lQG/5zDtZIUC3RVpqDSwBuw/NTweGyuP+o8AG98HxqxTBwID\nAQABMA0GCSqGSIb3DQEBBQUAA4GBABS2TLuBeTPmcaTaUW/LCB2NYOy8GMdzR1mx\n8iBIu2H6/E2tiY3RIevV2OW61qY2/XRQg7YPxx3ffeUugX9F4J/iPnnu1zAxxyBy\n2VguKv4SWjRFoRkIfIlHX0qVviMhSlNy2ioFLy7JcPZb+v3ftDGywUqcBiVDoea0\nHn+GmxZA\n-----END CERTIFICATE-----\n"
            }
          },
          "entityID" : "cloudfoundry-saml-login",
          "disableInResponseToCheck" : false,
          "signatureAlgorithm" : "SHA256",
          "privateKey" : "-----BEGIN RSA PRIVATE KEY-----\nMIIBOwIBAAJBAJv8ZpB5hEK7qxP9K3v43hUS5fGT4waKe7ix4Z4mu5UBv+cw7WSF\nAt0Vaag0sAbsPzU8Hhsrj/qPABvfB8asUwcCAwEAAQJAG0r3ezH35WFG1tGGaUOr\nQA61cyaII53ZdgCR1IU8bx7AUevmkFtBf+aqMWusWVOWJvGu2r5VpHVAIl8nF6DS\nkQIhAMjEJ3zVYa2/Mo4ey+iU9J9Vd+WoyXDQD4EEtwmyG1PpAiEAxuZlvhDIbbce\n7o5BvOhnCZ2N7kYb1ZC57g3F+cbJyW8CIQCbsDGHBto2qJyFxbAO7uQ8Y0UVHa0J\nBO/g900SAcJbcQIgRtEljIShOB8pDjrsQPxmI1BLhnjD1EhRSubwhDw5AFUCIQCN\nA24pDtdOHydwtSB5+zFqFLfmVZplQM/g5kb4so70Yw==\n-----END RSA PRIVATE KEY-----\n",
          "privateKeyPassword" : "password",
          "certificate" : "-----BEGIN CERTIFICATE-----\nMIICEjCCAXsCAg36MA0GCSqGSIb3DQEBBQUAMIGbMQswCQYDVQQGEwJKUDEOMAwG\nA1UECBMFVG9reW8xEDAOBgNVBAcTB0NodW8ta3UxETAPBgNVBAoTCEZyYW5rNERE\nMRgwFgYDVQQLEw9XZWJDZXJ0IFN1cHBvcnQxGDAWBgNVBAMTD0ZyYW5rNEREIFdl\nYiBDQTEjMCEGCSqGSIb3DQEJARYUc3VwcG9ydEBmcmFuazRkZC5jb20wHhcNMTIw\nODIyMDUyNjU0WhcNMTcwODIxMDUyNjU0WjBKMQswCQYDVQQGEwJKUDEOMAwGA1UE\nCAwFVG9reW8xETAPBgNVBAoMCEZyYW5rNEREMRgwFgYDVQQDDA93d3cuZXhhbXBs\nZS5jb20wXDANBgkqhkiG9w0BAQEFAANLADBIAkEAm/xmkHmEQrurE/0re/jeFRLl\n8ZPjBop7uLHhnia7lQG/5zDtZIUC3RVpqDSwBuw/NTweGyuP+o8AG98HxqxTBwID\nAQABMA0GCSqGSIb3DQEBBQUAA4GBABS2TLuBeTPmcaTaUW/LCB2NYOy8GMdzR1mx\n8iBIu2H6/E2tiY3RIevV2OW61qY2/XRQg7YPxx3ffeUugX9F4J/iPnnu1zAxxyBy\n2VguKv4SWjRFoRkIfIlHX0qVviMhSlNy2ioFLy7JcPZb+v3ftDGywUqcBiVDoea0\nHn+GmxZA\n-----END CERTIFICATE-----\n"
        },
        "corsPolicy" : {
          "xhrConfiguration" : {
            "allowedOrigins" : [ ".*" ],
            "allowedOriginPatterns" : [ ],
            "allowedUris" : [ ".*" ],
            "allowedUriPatterns" : [ ],
            "allowedHeaders" : [ "Accept", "Authorization", "Content-Type" ],
            "allowedMethods" : [ "GET" ],
            "allowedCredentials" : false,
            "maxAge" : 1728000
          },
          "defaultConfiguration" : {
            "allowedOrigins" : [ ".*" ],
            "allowedOriginPatterns" : [ ],
            "allowedUris" : [ ".*" ],
            "allowedUriPatterns" : [ ],
            "allowedHeaders" : [ "Accept", "Authorization", "Content-Type" ],
            "allowedMethods" : [ "GET" ],
            "allowedCredentials" : false,
            "maxAge" : 1728000
          }
        },
        "links" : {
          "logout" : {
            "redirectUrl" : "/login",
            "redirectParameterName" : "redirect",
            "disableRedirectParameter" : false,
            "whitelist" : null
          },
          "homeRedirect" : "http://my.hosted.homepage.com/",
          "selfService" : {
            "selfServiceLinksEnabled" : true,
            "signup" : null,
            "passwd" : null
          }
        },
        "prompts" : [ {
          "name" : "username",
          "type" : "text",
          "text" : "Username"
        }, {
          "name" : "password",
          "type" : "password",
          "text" : "Password"
        }, {
          "name" : "passcode",
          "type" : "password",
          "text" : "One Time Code (Get on at /passcode)"
        } ],
        "idpDiscoveryEnabled" : false,
        "branding" : {
          "companyName" : "Test Company",
          "productLogo" : "VGVzdFByb2R1Y3RMb2dv",
          "squareLogo" : "VGVzdFNxdWFyZUxvZ28=",
          "footerLegalText" : "Test footer legal text",
          "footerLinks" : {
            "Support" : "http://support.example.com"
          },
          "banner" : {
            "logo" : "VGVzdFByb2R1Y3RMb2dv",
            "text" : "Announcement",
            "textColor" : "#000000",
            "backgroundColor" : "#89cff0",
            "link" : "http://announce.example.com"
          }
        },
        "accountChooserEnabled" : false,
        "userConfig" : {
          "defaultGroups" : [ "openid", "password.write", "uaa.user", "approvals.me", "profile", "roles", "user_attributes", "uaa.offline_token" ]
        },
        "mfaConfig" : {
          "enabled" : false
        }
      },
      "name" : "The Updated Twiglet Zone",
      "version" : 0,
      "description" : "Like the Twilight Zone but not tastier.",
      "created" : 1525217101448,
      "enable_redirect_uri_check" : true,
      "last_modified" : 1525217101448
    }
    
    HTTP/1.1 200 OK
    X-B3-TraceId: 422c5dd7-4231-4ebc-906b-be72d6f1bd57
    Cache-Control: no-cache, no-store, max-age=0, must-revalidate
    Pragma: no-cache
    Expires: 0
    X-XSS-Protection: 1; mode=block
    X-Frame-Options: DENY
    X-Content-Type-Options: nosniff
    Content-Type: application/json;charset=UTF-8
    Content-Length: 5084
    
    {
      "id" : "twiglet-update",
      "subdomain" : "twiglet-update",
      "config" : {
        "clientSecretPolicy" : {
          "minLength" : -1,
          "maxLength" : -1,
          "requireUpperCaseCharacter" : -1,
          "requireLowerCaseCharacter" : -1,
          "requireDigit" : -1,
          "requireSpecialCharacter" : -1
        },
        "tokenPolicy" : {
          "accessTokenValidity" : -1,
          "refreshTokenValidity" : -1,
          "jwtRevocable" : false,
          "refreshTokenUnique" : false,
          "refreshTokenFormat" : "jwt",
          "activeKeyId" : null
        },
        "samlConfig" : {
          "assertionSigned" : true,
          "requestSigned" : true,
          "wantAssertionSigned" : true,
          "wantAuthnRequestSigned" : false,
          "assertionTimeToLiveSeconds" : 600,
          "activeKeyId" : "legacy-saml-key",
          "keys" : {
            "legacy-saml-key" : {
              "certificate" : "-----BEGIN CERTIFICATE-----\nMIICEjCCAXsCAg36MA0GCSqGSIb3DQEBBQUAMIGbMQswCQYDVQQGEwJKUDEOMAwG\nA1UECBMFVG9reW8xEDAOBgNVBAcTB0NodW8ta3UxETAPBgNVBAoTCEZyYW5rNERE\nMRgwFgYDVQQLEw9XZWJDZXJ0IFN1cHBvcnQxGDAWBgNVBAMTD0ZyYW5rNEREIFdl\nYiBDQTEjMCEGCSqGSIb3DQEJARYUc3VwcG9ydEBmcmFuazRkZC5jb20wHhcNMTIw\nODIyMDUyNjU0WhcNMTcwODIxMDUyNjU0WjBKMQswCQYDVQQGEwJKUDEOMAwGA1UE\nCAwFVG9reW8xETAPBgNVBAoMCEZyYW5rNEREMRgwFgYDVQQDDA93d3cuZXhhbXBs\nZS5jb20wXDANBgkqhkiG9w0BAQEFAANLADBIAkEAm/xmkHmEQrurE/0re/jeFRLl\n8ZPjBop7uLHhnia7lQG/5zDtZIUC3RVpqDSwBuw/NTweGyuP+o8AG98HxqxTBwID\nAQABMA0GCSqGSIb3DQEBBQUAA4GBABS2TLuBeTPmcaTaUW/LCB2NYOy8GMdzR1mx\n8iBIu2H6/E2tiY3RIevV2OW61qY2/XRQg7YPxx3ffeUugX9F4J/iPnnu1zAxxyBy\n2VguKv4SWjRFoRkIfIlHX0qVviMhSlNy2ioFLy7JcPZb+v3ftDGywUqcBiVDoea0\nHn+GmxZA\n-----END CERTIFICATE-----\n"
            }
          },
          "entityID" : "cloudfoundry-saml-login",
          "disableInResponseToCheck" : false,
          "signatureAlgorithm" : "SHA256",
          "certificate" : "-----BEGIN CERTIFICATE-----\nMIICEjCCAXsCAg36MA0GCSqGSIb3DQEBBQUAMIGbMQswCQYDVQQGEwJKUDEOMAwG\nA1UECBMFVG9reW8xEDAOBgNVBAcTB0NodW8ta3UxETAPBgNVBAoTCEZyYW5rNERE\nMRgwFgYDVQQLEw9XZWJDZXJ0IFN1cHBvcnQxGDAWBgNVBAMTD0ZyYW5rNEREIFdl\nYiBDQTEjMCEGCSqGSIb3DQEJARYUc3VwcG9ydEBmcmFuazRkZC5jb20wHhcNMTIw\nODIyMDUyNjU0WhcNMTcwODIxMDUyNjU0WjBKMQswCQYDVQQGEwJKUDEOMAwGA1UE\nCAwFVG9reW8xETAPBgNVBAoMCEZyYW5rNEREMRgwFgYDVQQDDA93d3cuZXhhbXBs\nZS5jb20wXDANBgkqhkiG9w0BAQEFAANLADBIAkEAm/xmkHmEQrurE/0re/jeFRLl\n8ZPjBop7uLHhnia7lQG/5zDtZIUC3RVpqDSwBuw/NTweGyuP+o8AG98HxqxTBwID\nAQABMA0GCSqGSIb3DQEBBQUAA4GBABS2TLuBeTPmcaTaUW/LCB2NYOy8GMdzR1mx\n8iBIu2H6/E2tiY3RIevV2OW61qY2/XRQg7YPxx3ffeUugX9F4J/iPnnu1zAxxyBy\n2VguKv4SWjRFoRkIfIlHX0qVviMhSlNy2ioFLy7JcPZb+v3ftDGywUqcBiVDoea0\nHn+GmxZA\n-----END CERTIFICATE-----\n"
        },
        "corsPolicy" : {
          "xhrConfiguration" : {
            "allowedOrigins" : [ ".*" ],
            "allowedOriginPatterns" : [ ],
            "allowedUris" : [ ".*" ],
            "allowedUriPatterns" : [ ],
            "allowedHeaders" : [ "Accept", "Authorization", "Content-Type" ],
            "allowedMethods" : [ "GET" ],
            "allowedCredentials" : false,
            "maxAge" : 1728000
          },
          "defaultConfiguration" : {
            "allowedOrigins" : [ ".*" ],
            "allowedOriginPatterns" : [ ],
            "allowedUris" : [ ".*" ],
            "allowedUriPatterns" : [ ],
            "allowedHeaders" : [ "Accept", "Authorization", "Content-Type" ],
            "allowedMethods" : [ "GET" ],
            "allowedCredentials" : false,
            "maxAge" : 1728000
          }
        },
        "links" : {
          "logout" : {
            "redirectUrl" : "/login",
            "redirectParameterName" : "redirect",
            "disableRedirectParameter" : false,
            "whitelist" : null
          },
          "homeRedirect" : "http://my.hosted.homepage.com/",
          "selfService" : {
            "selfServiceLinksEnabled" : true,
            "signup" : null,
            "passwd" : null
          }
        },
        "prompts" : [ {
          "name" : "username",
          "type" : "text",
          "text" : "Username"
        }, {
          "name" : "password",
          "type" : "password",
          "text" : "Password"
        }, {
          "name" : "passcode",
          "type" : "password",
          "text" : "One Time Code (Get on at /passcode)"
        } ],
        "idpDiscoveryEnabled" : false,
        "branding" : {
          "companyName" : "Test Company",
          "productLogo" : "VGVzdFByb2R1Y3RMb2dv",
          "squareLogo" : "VGVzdFNxdWFyZUxvZ28=",
          "footerLegalText" : "Test footer legal text",
          "footerLinks" : {
            "Support" : "http://support.example.com"
          },
          "banner" : {
            "logo" : "VGVzdFByb2R1Y3RMb2dv",
            "text" : "Announcement",
            "textColor" : "#000000",
            "backgroundColor" : "#89cff0",
            "link" : "http://announce.example.com"
          }
        },
        "accountChooserEnabled" : false,
        "userConfig" : {
          "defaultGroups" : [ "openid", "password.write", "uaa.user", "approvals.me", "profile", "roles", "user_attributes", "uaa.offline_token" ]
        },
        "mfaConfig" : {
          "enabled" : false
        }
      },
      "name" : "The Updated Twiglet Zone",
      "version" : 1,
      "description" : "Like the Twilight Zone but not tastier.",
      "created" : 1525217101392,
      "enable_redirect_uri_check" : true,
      "last_modified" : 1525217101465
    }
    

    Path Parameters

    /identity-zones/{id}

    Parameter Description
    id Unique ID of the identity zone to update

    Request Headers

    Name Description
    Authorization Bearer token containing zones.write or uaa.admin. If you use the zone-switching header, bear token containing zones.<zone id>.admin can be used.
    X-Identity-Zone-Id May include this header to administer another zone if using zones.<zoneId>.admin or uaa.admin scope against the default UAA zone.
    X-Identity-Zone-Subdomain If using a zones.<zoneId>.admin scope/token, indicates what Identity Zone this request goes to by supplying a subdomain.

    Request Fields

    Path Type Constraints Description
    subdomain String Required Unique subdomain for the running instance. May only contain legal characters for a subdomain name.
    name String Required Human-readable zone name
    description String Optional Description of the zone
    version Number Optional Reserved for future use of E-Tag versioning
    config.tokenPolicy.activeKeyId String Required if config.tokenPolicy.keys are set The ID for the key that is being used to sign tokens
    config.tokenPolicy.keys.. String Optional Keys which will be used to sign the token. If null value is specified for keys, then existing value will be retained.
    config.tokenPolicy.accessTokenValidity Number Optional Time in seconds between when a access token is issued and when it expires. Defaults to global accessTokenValidity
    config.tokenPolicy.refreshTokenValidity Number Optional Time in seconds between when a refresh token is issued and when it expires. Defaults to global refreshTokenValidity
    config.tokenPolicy.jwtRevocable Boolean Optional Set to true if JWT tokens should be stored in the token store, and thus made individually revocable. Opaque tokens are always stored and revocable.
    config.tokenPolicy.refreshTokenUnique Boolean Optional If true, uaa will only issue one refresh token per client_id/user_id combination. Defaults to false.
    config.tokenPolicy.refreshTokenFormat String Optional The format for the refresh token. Allowed values are jwt, opaque. Defaults to jwt.
    config.clientSecretPolicy.minLength Number Required when clientSecretPolicy in the config is not null Minimum number of characters required for secret to be considered valid (defaults to 0).
    config.clientSecretPolicy.maxLength Number Required when clientSecretPolicy in the config is not null Maximum number of characters required for secret to be considered valid (defaults to 255).
    config.clientSecretPolicy.requireUpperCaseCharacter Number Required when clientSecretPolicy in the config is not null Minimum number of uppercase characters required for secret to be considered valid (defaults to 0).
    config.clientSecretPolicy.requireLowerCaseCharacter Number Required when clientSecretPolicy in the config is not null Minimum number of lowercase characters required for secret to be considered valid (defaults to 0).
    config.clientSecretPolicy.requireDigit Number Required when clientSecretPolicy in the config is not null Minimum number of digits required for secret to be considered valid (defaults to 0).
    config.clientSecretPolicy.requireSpecialCharacter Number Required when clientSecretPolicy in the config is not null Minimum number of special characters required for secret to be considered valid (defaults to 0).
    config.samlConfig.disableInResponseToCheck Boolean Optional If true, this zone will not validate the InResponseToField part of an incoming IDP assertion. Please see https://docs.spring.io/spring-security-saml/docs/current/reference/html/chapter-troubleshooting.html
    config.samlConfig.assertionSigned Boolean Optional If true, the SAML provider will sign all assertions
    config.samlConfig.wantAssertionSigned Boolean Optional Exposed SAML metadata property. If true, all assertions received by the SAML provider must be signed. Defaults to true.
    config.samlConfig.requestSigned Boolean Optional Exposed SAML metadata property. If true, the service provider will sign all outgoing authentication requests. Defaults to true.
    config.samlConfig.wantAuthnRequestSigned Boolean Optional If true, the authentication request from the partner service provider must be signed.
    config.samlConfig.signatureAlgorithm String Optional Exposed SAML metadata property. The signature algorithm that will be used to sign the authentication request and SAML assertion. Defaults to SHA256.
    config.samlConfig.assertionTimeToLiveSeconds Number Optional The lifetime of a SAML assertion in seconds. Defaults to 600.
    config.samlConfig.entityID String Optional Unique ID of the SAML2 entity
    config.samlConfig.certificate String Deprecated Exposed SAML metadata property. The certificate used to verify the authenticity all communications.
    config.samlConfig.privateKey String Deprecated Exposed SAML metadata property. The SAML provider's private key.
    config.samlConfig.privateKeyPassword String Deprecated Exposed SAML metadata property. The SAML provider's private key password. Reserved for future use.
    config.samlConfig.activeKeyId String Required if a list of keys defined in keys map The ID of the key that should be used for signing metadata and assertions.
    config.samlConfig.keys.*.key String Optional. Can only be used in conjunction with keys.<key-id>.passphrase and keys.<key-id>.certificate Exposed SAML metadata property. The SAML provider's private key.
    config.samlConfig.keys.*.passphrase String Optional. Can only be used in conjunction with keys.<key-id>.key and keys.<key-id>.certificate Exposed SAML metadata property. The SAML provider's private key password. Reserved for future use.
    config.samlConfig.keys.*.certificate String Optional. Can only be used in conjunction with keys.<key-id>.key and keys.<key-id>.passphrase Exposed SAML metadata property. The certificate used to verify the authenticity all communications.
    config.links.logout.redirectUrl String Optional Logout redirect url
    config.links.homeRedirect String Optional Overrides the UAA home page and issues a redirect to this URL when the browser requests / and /home.
    config.links.logout.redirectParameterName String Optional Changes the name of the redirect parameter
    config.links.logout.disableRedirectParameter Boolean Optional Deprecated, no longer affects zone behavior. Whether or not to allow the redirect parameter on logout
    config.links.logout.whitelist Array Optional List of allowed whitelist redirects
    config.links.selfService.selfServiceLinksEnabled Boolean Optional Whether or not users are allowed to sign up or reset their passwords via the UI
    config.links.selfService.signup Null Optional Where users are directed upon clicking the account creation link
    config.links.selfService.passwd Null Optional Where users are directed upon clicking the password reset link
    config.prompts[] Array Optional List of fields that users are prompted for to login. Defaults to username, password, and passcode.
    config.prompts[].name String Optional Name of field
    config.prompts[].type String Optional What kind of field this is (e.g. text or password)
    config.prompts[].text String Optional Actual text displayed on prompt for field
    config.idpDiscoveryEnabled Boolean Optional IDP Discovery should be set to true if you have configured more than one identity provider for UAA. The discovery relies on email domain being set for each additional provider
    config.accountChooserEnabled Boolean Optional This flag is required to enable account choosing functionality for IDP discovery page.
    config.branding.companyName String Optional This name is used on the UAA Pages and in account management related communication in UAA
    config.branding.productLogo String Optional This is a base64Url encoded PNG image which will be used as the logo on all UAA pages like Login, Sign Up etc.
    config.branding.squareLogo String Optional This is a base64 encoded PNG image which will be used as the favicon for the UAA pages
    config.branding.footerLegalText String Optional This text appears on the footer of all UAA pages
    config.branding.footerLinks.* Array Optional These links (Map) appear on the footer of all UAA pages. You may choose to add multiple urls for things like Support, Terms of Service etc.
    config.branding.banner.text String Optional This is text displayed in a banner at the top of the UAA login page
    config.branding.banner.logo String Optional This is base64 encoded PNG data displayed in a banner at the top of the UAA login page, overrides banner text
    config.branding.banner.link String Optional The UAA login banner will be a link pointing to this url
    config.branding.banner.textColor String Optional Hexadecimal color code for banner text color, does not allow color names
    config.branding.banner.backgroundColor String Optional Hexadecimal color code for banner background color, does not allow color names
    config.corsPolicy.xhrConfiguration.allowedOrigins Array Optional Access-Control-Allow-Origin header. Indicates whether a resource can be shared based by returning the value of the Origin request header, "*", or "null" in the response.
    config.corsPolicy.xhrConfiguration.allowedOriginPatterns Array Optional Indicates whether a resource can be shared based by returning the value of the Origin patterns.
    config.corsPolicy.xhrConfiguration.allowedUris Array Optional The list of allowed URIs.
    config.corsPolicy.xhrConfiguration.allowedUriPatterns Array Optional The list of allowed URI patterns.
    config.corsPolicy.xhrConfiguration.allowedHeaders Array Optional Access-Control-Allow-Headers header. Indicates which header field names can be used during the actual response
    config.corsPolicy.xhrConfiguration.allowedMethods Array Optional Access-Control-Allow-Methods header. Indicates which method will be used in the actual request as part of the preflight request.
    config.corsPolicy.xhrConfiguration.allowedCredentials Boolean Optional Access-Control-Allow-Credentials header. Indicates whether the response to request can be exposed when the omit credentials flag is unset. When part of the response to a preflight request it indicates that the actual request can include user credentials..
    config.corsPolicy.xhrConfiguration.maxAge Number Optional Access-Control-Max-Age header. Indicates how long the results of a preflight request can be cached in a preflight result cache
    config.corsPolicy.defaultConfiguration.allowedOrigins Array Optional Access-Control-Allow-Origin header. Indicates whether a resource can be shared based by returning the value of the Origin request header, "*", or "null" in the response.
    config.corsPolicy.defaultConfiguration.allowedOriginPatterns Array Optional Indicates whether a resource can be shared based by returning the value of the Origin patterns.
    config.corsPolicy.defaultConfiguration.allowedUris Array Optional The list of allowed URIs.
    config.corsPolicy.defaultConfiguration.allowedUriPatterns Array Optional The list of allowed URI patterns.
    config.corsPolicy.defaultConfiguration.allowedHeaders Array Optional Access-Control-Allow-Headers header. Indicates which header field names can be used during the actual response
    config.corsPolicy.defaultConfiguration.allowedMethods Array Optional Access-Control-Allow-Methods header. Indicates which method will be used in the actual request as part of the preflight request.
    config.corsPolicy.defaultConfiguration.allowedCredentials Boolean Optional Access-Control-Allow-Credentials header. Indicates whether the response to request can be exposed when the omit credentials flag is unset. When part of the response to a preflight request it indicates that the actual request can include user credentials..
    config.corsPolicy.defaultConfiguration.maxAge Number Optional Access-Control-Max-Age header. Indicates how long the results of a preflight request can be cached in a preflight result cache
    config.userConfig.defaultGroups Array Optional Default groups each user in the zone inherits.
    config.mfaConfig.enabled Boolean Optional Set true to enable Multi-factor Authentication (MFA) for the current zone. Defaults to false
    config.mfaConfig.providerName String Required when config.mfaConfig.enabled is true The unique name of the MFA provider to use for this zone.
    enable_redirect_uri_check Boolean Optional Zone-level flag that will enforce client redirect uri rules as deployed in 4.4.0. If true, check will perform at authorization. Defaults to true

    Response Fields

    Path Type Description
    id String Unique ID of the identity zone
    subdomain String Unique subdomain for the running instance. May only contain legal characters for a subdomain name.
    name String Human-readable zone name
    description String Description of the zone
    version Number Reserved for future use of E-Tag versioning
    config.tokenPolicy.activeKeyId String The ID for the key that is being used to sign tokens
    config.tokenPolicy.accessTokenValidity Number Time in seconds between when a access token is issued and when it expires. Defaults to global accessTokenValidity
    config.tokenPolicy.refreshTokenValidity Number Time in seconds between when a refresh token is issued and when it expires. Defaults to global refreshTokenValidity
    config.tokenPolicy.jwtRevocable Boolean Set to true if JWT tokens should be stored in the token store, and thus made individually revocable. Opaque tokens are always stored and revocable.
    config.tokenPolicy.refreshTokenUnique Boolean If true, uaa will only issue one refresh token per client_id/user_id combination. Defaults to false.
    config.tokenPolicy.refreshTokenFormat String The format for the refresh token. Allowed values are jwt, opaque. Defaults to jwt.
    config.clientSecretPolicy.minLength Number Minimum number of characters required for secret to be considered valid (defaults to 0).
    config.clientSecretPolicy.maxLength Number Maximum number of characters required for secret to be considered valid (defaults to 255).
    config.clientSecretPolicy.requireUpperCaseCharacter Number Minimum number of uppercase characters required for secret to be considered valid (defaults to 0).
    config.clientSecretPolicy.requireLowerCaseCharacter Number Minimum number of lowercase characters required for secret to be considered valid (defaults to 0).
    config.clientSecretPolicy.requireDigit Number Minimum number of digits required for secret to be considered valid (defaults to 0).
    config.clientSecretPolicy.requireSpecialCharacter Number Minimum number of special characters required for secret to be considered valid (defaults to 0).
    config.samlConfig.disableInResponseToCheck Boolean If true, this zone will not validate the InResponseToField part of an incoming IDP assertion. Please see https://docs.spring.io/spring-security-saml/docs/current/reference/html/chapter-troubleshooting.html
    config.samlConfig.assertionSigned Boolean If true, the SAML provider will sign all assertions
    config.samlConfig.wantAssertionSigned Boolean Exposed SAML metadata property. If true, all assertions received by the SAML provider must be signed. Defaults to true.
    config.samlConfig.requestSigned Boolean Exposed SAML metadata property. If true, the service provider will sign all outgoing authentication requests. Defaults to true.
    config.samlConfig.wantAuthnRequestSigned Boolean If true, the authentication request from the partner service provider must be signed.
    config.samlConfig.signatureAlgorithm String Exposed SAML metadata property. The signature algorithm that will be used to sign the authentication request and SAML assertion. Defaults to SHA256.
    config.samlConfig.assertionTimeToLiveSeconds Number The lifetime of a SAML assertion in seconds. Defaults to 600.
    config.samlConfig.entityID String Unique ID of the SAML2 entity
    config.samlConfig.certificate String Exposed SAML metadata property. The certificate used to verify the authenticity all communications.
    config.samlConfig.activeKeyId String The ID of the key that should be used for signing metadata and assertions.
    config.samlConfig.keys.*.certificate String Exposed SAML metadata property. The certificate used to verify the authenticity all communications.
    config.links.logout.redirectUrl String Logout redirect url
    config.links.homeRedirect String Overrides the UAA home page and issues a redirect to this URL when the browser requests / and /home.
    config.links.logout.redirectParameterName String Changes the name of the redirect parameter
    config.links.logout.disableRedirectParameter Boolean Deprecated, no longer affects zone behavior. Whether or not to allow the redirect parameter on logout
    config.links.logout.whitelist Array List of allowed whitelist redirects
    config.links.selfService.selfServiceLinksEnabled Boolean Whether or not users are allowed to sign up or reset their passwords via the UI
    config.links.selfService.signup Null Where users are directed upon clicking the account creation link
    config.links.selfService.passwd Null Where users are directed upon clicking the password reset link
    config.prompts[] Array List of fields that users are prompted for to login. Defaults to username, password, and passcode.
    config.prompts[].name String Name of field
    config.prompts[].type String What kind of field this is (e.g. text or password)
    config.prompts[].text String Actual text displayed on prompt for field
    config.idpDiscoveryEnabled Boolean IDP Discovery should be set to true if you have configured more than one identity provider for UAA. The discovery relies on email domain being set for each additional provider
    config.accountChooserEnabled Boolean This flag is required to enable account choosing functionality for IDP discovery page.
    config.branding.companyName String This name is used on the UAA Pages and in account management related communication in UAA
    config.branding.productLogo String This is a base64Url encoded PNG image which will be used as the logo on all UAA pages like Login, Sign Up etc.
    config.branding.squareLogo String This is a base64 encoded PNG image which will be used as the favicon for the UAA pages
    config.branding.footerLegalText String This text appears on the footer of all UAA pages
    config.branding.footerLinks.* Array These links (Map) appear on the footer of all UAA pages. You may choose to add multiple urls for things like Support, Terms of Service etc.
    config.branding.banner.text String This is text displayed in a banner at the top of the UAA login page
    config.branding.banner.logo String This is base64 encoded PNG data displayed in a banner at the top of the UAA login page, overrides banner text
    config.branding.banner.link String The UAA login banner will be a link pointing to this url
    config.branding.banner.textColor String Hexadecimal color code for banner text color, does not allow color names
    config.branding.banner.backgroundColor String Hexadecimal color code for banner background color, does not allow color names
    config.corsPolicy.defaultConfiguration.allowedOrigins Array Access-Control-Allow-Origin header. Indicates whether a resource can be shared based by returning the value of the Origin request header, "*", or "null" in the response.
    config.corsPolicy.defaultConfiguration.allowedOriginPatterns Array Indicates whether a resource can be shared based by returning the value of the Origin patterns.
    config.corsPolicy.defaultConfiguration.allowedUris Array The list of allowed URIs.
    config.corsPolicy.defaultConfiguration.allowedUriPatterns Array The list of allowed URI patterns.
    config.corsPolicy.defaultConfiguration.allowedHeaders Array Access-Control-Allow-Headers header. Indicates which header field names can be used during the actual response
    config.corsPolicy.defaultConfiguration.allowedMethods Array Access-Control-Allow-Methods header. Indicates which method will be used in the actual request as part of the preflight request.
    config.corsPolicy.defaultConfiguration.allowedCredentials Boolean Access-Control-Allow-Credentials header. Indicates whether the response to request can be exposed when the omit credentials flag is unset. When part of the response to a preflight request it indicates that the actual request can include user credentials..
    config.corsPolicy.defaultConfiguration.maxAge Number Access-Control-Max-Age header. Indicates how long the results of a preflight request can be cached in a preflight result cache
    config.corsPolicy.xhrConfiguration.allowedOrigins Array Access-Control-Allow-Origin header. Indicates whether a resource can be shared based by returning the value of the Origin request header, "*", or "null" in the response.
    config.corsPolicy.xhrConfiguration.allowedOriginPatterns Array Indicates whether a resource can be shared based by returning the value of the Origin patterns.
    config.corsPolicy.xhrConfiguration.allowedUris Array The list of allowed URIs.
    config.corsPolicy.xhrConfiguration.allowedUriPatterns Array The list of allowed URI patterns.
    config.corsPolicy.xhrConfiguration.allowedHeaders Array Access-Control-Allow-Headers header. Indicates which header field names can be used during the actual response
    config.corsPolicy.xhrConfiguration.allowedMethods Array Access-Control-Allow-Methods header. Indicates which method will be used in the actual request as part of the preflight request.
    config.corsPolicy.xhrConfiguration.allowedCredentials Boolean Access-Control-Allow-Credentials header. Indicates whether the response to request can be exposed when the omit credentials flag is unset. When part of the response to a preflight request it indicates that the actual request can include user credentials..
    config.corsPolicy.xhrConfiguration.maxAge Number Access-Control-Max-Age header. Indicates how long the results of a preflight request can be cached in a preflight result cache
    config.userConfig.defaultGroups Array Default groups each user in the zone inherits.
    config.mfaConfig.enabled Boolean Set true to enable Multi-factor Authentication (MFA) for the current zone. Defaults to false
    config.mfaConfig.providerName String The unique name of the MFA provider to use for this zone.
    enable_redirect_uri_check Boolean Zone-level flag that will enforce client redirect uri rules as deployed in 4.4.0. If true, check will perform at authorization. Defaults to true

    Error Codes

    Error Code Description
    400 Bad Request
    401 Unauthorized - Invalid token
    403 Forbidden - Insufficient scope (zone admins can only update own zone)
    404 Not Found - Update to nonexistent zone
    422 Unprocessable Entity - Invalid zone details

    Deleting an Identity Zone

    $ curl 'http://localhost/identity-zones/twiglet-delete' -i -X DELETE \
        -H 'Content-Type: application/json' \
        -H 'Authorization: Bearer 9e27d50f656a48f5b7d837366f5386aa'
    
    DELETE /identity-zones/twiglet-delete HTTP/1.1
    Content-Type: application/json
    Authorization: Bearer 9e27d50f656a48f5b7d837366f5386aa
    Host: localhost
    
    
    HTTP/1.1 200 OK
    X-B3-TraceId: 7893cf59-30a2-4cd1-9dd0-685aeafeef1e
    Cache-Control: no-cache, no-store, max-age=0, must-revalidate
    Pragma: no-cache
    Expires: 0
    X-XSS-Protection: 1; mode=block
    X-Frame-Options: DENY
    X-Content-Type-Options: nosniff
    Content-Type: application/json;charset=UTF-8
    Content-Length: 5015
    
    {
      "id" : "twiglet-delete",
      "subdomain" : "twiglet-delete",
      "config" : {
        "clientSecretPolicy" : {
          "minLength" : -1,
          "maxLength" : -1,
          "requireUpperCaseCharacter" : -1,
          "requireLowerCaseCharacter" : -1,
          "requireDigit" : -1,
          "requireSpecialCharacter" : -1
        },
        "tokenPolicy" : {
          "accessTokenValidity" : -1,
          "refreshTokenValidity" : -1,
          "jwtRevocable" : false,
          "refreshTokenUnique" : false,
          "refreshTokenFormat" : "jwt",
          "activeKeyId" : null
        },
        "samlConfig" : {
          "assertionSigned" : true,
          "requestSigned" : true,
          "wantAssertionSigned" : true,
          "wantAuthnRequestSigned" : false,
          "assertionTimeToLiveSeconds" : 600,
          "activeKeyId" : "legacy-saml-key",
          "keys" : {
            "legacy-saml-key" : {
              "certificate" : "-----BEGIN CERTIFICATE-----\nMIICEjCCAXsCAg36MA0GCSqGSIb3DQEBBQUAMIGbMQswCQYDVQQGEwJKUDEOMAwG\nA1UECBMFVG9reW8xEDAOBgNVBAcTB0NodW8ta3UxETAPBgNVBAoTCEZyYW5rNERE\nMRgwFgYDVQQLEw9XZWJDZXJ0IFN1cHBvcnQxGDAWBgNVBAMTD0ZyYW5rNEREIFdl\nYiBDQTEjMCEGCSqGSIb3DQEJARYUc3VwcG9ydEBmcmFuazRkZC5jb20wHhcNMTIw\nODIyMDUyNjU0WhcNMTcwODIxMDUyNjU0WjBKMQswCQYDVQQGEwJKUDEOMAwGA1UE\nCAwFVG9reW8xETAPBgNVBAoMCEZyYW5rNEREMRgwFgYDVQQDDA93d3cuZXhhbXBs\nZS5jb20wXDANBgkqhkiG9w0BAQEFAANLADBIAkEAm/xmkHmEQrurE/0re/jeFRLl\n8ZPjBop7uLHhnia7lQG/5zDtZIUC3RVpqDSwBuw/NTweGyuP+o8AG98HxqxTBwID\nAQABMA0GCSqGSIb3DQEBBQUAA4GBABS2TLuBeTPmcaTaUW/LCB2NYOy8GMdzR1mx\n8iBIu2H6/E2tiY3RIevV2OW61qY2/XRQg7YPxx3ffeUugX9F4J/iPnnu1zAxxyBy\n2VguKv4SWjRFoRkIfIlHX0qVviMhSlNy2ioFLy7JcPZb+v3ftDGywUqcBiVDoea0\nHn+GmxZA\n-----END CERTIFICATE-----\n"
            }
          },
          "entityID" : "cloudfoundry-saml-login",
          "disableInResponseToCheck" : false,
          "signatureAlgorithm" : "SHA256",
          "certificate" : "-----BEGIN CERTIFICATE-----\nMIICEjCCAXsCAg36MA0GCSqGSIb3DQEBBQUAMIGbMQswCQYDVQQGEwJKUDEOMAwG\nA1UECBMFVG9reW8xEDAOBgNVBAcTB0NodW8ta3UxETAPBgNVBAoTCEZyYW5rNERE\nMRgwFgYDVQQLEw9XZWJDZXJ0IFN1cHBvcnQxGDAWBgNVBAMTD0ZyYW5rNEREIFdl\nYiBDQTEjMCEGCSqGSIb3DQEJARYUc3VwcG9ydEBmcmFuazRkZC5jb20wHhcNMTIw\nODIyMDUyNjU0WhcNMTcwODIxMDUyNjU0WjBKMQswCQYDVQQGEwJKUDEOMAwGA1UE\nCAwFVG9reW8xETAPBgNVBAoMCEZyYW5rNEREMRgwFgYDVQQDDA93d3cuZXhhbXBs\nZS5jb20wXDANBgkqhkiG9w0BAQEFAANLADBIAkEAm/xmkHmEQrurE/0re/jeFRLl\n8ZPjBop7uLHhnia7lQG/5zDtZIUC3RVpqDSwBuw/NTweGyuP+o8AG98HxqxTBwID\nAQABMA0GCSqGSIb3DQEBBQUAA4GBABS2TLuBeTPmcaTaUW/LCB2NYOy8GMdzR1mx\n8iBIu2H6/E2tiY3RIevV2OW61qY2/XRQg7YPxx3ffeUugX9F4J/iPnnu1zAxxyBy\n2VguKv4SWjRFoRkIfIlHX0qVviMhSlNy2ioFLy7JcPZb+v3ftDGywUqcBiVDoea0\nHn+GmxZA\n-----END CERTIFICATE-----\n"
        },
        "corsPolicy" : {
          "xhrConfiguration" : {
            "allowedOrigins" : [ ".*" ],
            "allowedOriginPatterns" : [ ],
            "allowedUris" : [ ".*" ],
            "allowedUriPatterns" : [ ],
            "allowedHeaders" : [ "Accept", "Authorization", "Content-Type" ],
            "allowedMethods" : [ "GET" ],
            "allowedCredentials" : false,
            "maxAge" : 1728000
          },
          "defaultConfiguration" : {
            "allowedOrigins" : [ ".*" ],
            "allowedOriginPatterns" : [ ],
            "allowedUris" : [ ".*" ],
            "allowedUriPatterns" : [ ],
            "allowedHeaders" : [ "Accept", "Authorization", "Content-Type" ],
            "allowedMethods" : [ "GET" ],
            "allowedCredentials" : false,
            "maxAge" : 1728000
          }
        },
        "links" : {
          "logout" : {
            "redirectUrl" : "/login",
            "redirectParameterName" : "redirect",
            "disableRedirectParameter" : false,
            "whitelist" : null
          },
          "homeRedirect" : "http://my.hosted.homepage.com/",
          "selfService" : {
            "selfServiceLinksEnabled" : true,
            "signup" : null,
            "passwd" : null
          }
        },
        "prompts" : [ {
          "name" : "username",
          "type" : "text",
          "text" : "Username"
        }, {
          "name" : "password",
          "type" : "password",
          "text" : "Password"
        }, {
          "name" : "passcode",
          "type" : "password",
          "text" : "One Time Code (Get on at /passcode)"
        } ],
        "idpDiscoveryEnabled" : false,
        "branding" : {
          "companyName" : "Test Company",
          "productLogo" : "VGVzdFByb2R1Y3RMb2dv",
          "squareLogo" : "VGVzdFNxdWFyZUxvZ28=",
          "footerLegalText" : "Test footer legal text",
          "footerLinks" : {
            "Support" : "http://support.example.com"
          },
          "banner" : {
            "logo" : "VGVzdFByb2R1Y3RMb2dv",
            "text" : "Announcement",
            "textColor" : "#000000",
            "backgroundColor" : "#89cff0",
            "link" : "http://announce.example.com"
          }
        },
        "accountChooserEnabled" : false,
        "userConfig" : {
          "defaultGroups" : [ "openid", "password.write", "uaa.user", "approvals.me", "profile", "roles", "user_attributes", "uaa.offline_token" ]
        },
        "mfaConfig" : {
          "enabled" : false
        }
      },
      "name" : "The Twiglet Zone",
      "version" : 0,
      "created" : 1525217100790,
      "enable_redirect_uri_check" : true,
      "last_modified" : 1525217100790
    }
    

    Path Parameters

    /identity-zones/{id}

    Parameter Description
    id Unique ID of the identity zone to delete

    Request Headers

    Name Description
    Authorization Bearer token containing zones.write or uaa.admin. If you use the zone-switching header, bear token containing zones.<zone id>.admin can be used.
    X-Identity-Zone-Id May include this header to administer another zone if using zones.<zoneId>.admin or uaa.admin scope against the default UAA zone.
    X-Identity-Zone-Subdomain If using a zones.<zoneId>.admin scope/token, indicates what Identity Zone this request goes to by supplying a subdomain.

    Response Fields

    Path Type Description
    id String Unique ID of the identity zone
    subdomain String Unique subdomain for the running instance. May only contain legal characters for a subdomain name.
    name String Human-readable zone name
    description String Description of the zone
    version Number Reserved for future use of E-Tag versioning
    config.tokenPolicy.activeKeyId String The ID for the key that is being used to sign tokens
    config.tokenPolicy.accessTokenValidity Number Time in seconds between when a access token is issued and when it expires. Defaults to global accessTokenValidity
    config.tokenPolicy.refreshTokenValidity Number Time in seconds between when a refresh token is issued and when it expires. Defaults to global refreshTokenValidity
    config.tokenPolicy.jwtRevocable Boolean Set to true if JWT tokens should be stored in the token store, and thus made individually revocable. Opaque tokens are always stored and revocable.
    config.tokenPolicy.refreshTokenUnique Boolean If true, uaa will only issue one refresh token per client_id/user_id combination. Defaults to false.
    config.tokenPolicy.refreshTokenFormat String The format for the refresh token. Allowed values are jwt, opaque. Defaults to jwt.
    config.clientSecretPolicy.minLength Number Minimum number of characters required for secret to be considered valid (defaults to 0).
    config.clientSecretPolicy.maxLength Number Maximum number of characters required for secret to be considered valid (defaults to 255).
    config.clientSecretPolicy.requireUpperCaseCharacter Number Minimum number of uppercase characters required for secret to be considered valid (defaults to 0).
    config.clientSecretPolicy.requireLowerCaseCharacter Number Minimum number of lowercase characters required for secret to be considered valid (defaults to 0).
    config.clientSecretPolicy.requireDigit Number Minimum number of digits required for secret to be considered valid (defaults to 0).
    config.clientSecretPolicy.requireSpecialCharacter Number Minimum number of special characters required for secret to be considered valid (defaults to 0).
    config.samlConfig.disableInResponseToCheck Boolean If true, this zone will not validate the InResponseToField part of an incoming IDP assertion. Please see https://docs.spring.io/spring-security-saml/docs/current/reference/html/chapter-troubleshooting.html
    config.samlConfig.assertionSigned Boolean If true, the SAML provider will sign all assertions
    config.samlConfig.wantAssertionSigned Boolean Exposed SAML metadata property. If true, all assertions received by the SAML provider must be signed. Defaults to true.
    config.samlConfig.requestSigned Boolean Exposed SAML metadata property. If true, the service provider will sign all outgoing authentication requests. Defaults to true.
    config.samlConfig.wantAuthnRequestSigned Boolean If true, the authentication request from the partner service provider must be signed.
    config.samlConfig.signatureAlgorithm String Exposed SAML metadata property. The signature algorithm that will be used to sign the authentication request and SAML assertion. Defaults to SHA256.
    config.samlConfig.assertionTimeToLiveSeconds Number The lifetime of a SAML assertion in seconds. Defaults to 600.
    config.samlConfig.entityID String Unique ID of the SAML2 entity
    config.samlConfig.certificate String Exposed SAML metadata property. The certificate used to verify the authenticity all communications.
    config.samlConfig.activeKeyId String The ID of the key that should be used for signing metadata and assertions.
    config.samlConfig.keys.*.certificate String Exposed SAML metadata property. The certificate used to verify the authenticity all communications.
    config.links.logout.redirectUrl String Logout redirect url
    config.links.homeRedirect String Overrides the UAA home page and issues a redirect to this URL when the browser requests / and /home.
    config.links.logout.redirectParameterName String Changes the name of the redirect parameter
    config.links.logout.disableRedirectParameter Boolean Deprecated, no longer affects zone behavior. Whether or not to allow the redirect parameter on logout
    config.links.logout.whitelist Array List of allowed whitelist redirects
    config.links.selfService.selfServiceLinksEnabled Boolean Whether or not users are allowed to sign up or reset their passwords via the UI
    config.links.selfService.signup Null Where users are directed upon clicking the account creation link
    config.links.selfService.passwd Null Where users are directed upon clicking the password reset link
    config.prompts[] Array List of fields that users are prompted for to login. Defaults to username, password, and passcode.
    config.prompts[].name String Name of field
    config.prompts[].type String What kind of field this is (e.g. text or password)
    config.prompts[].text String Actual text displayed on prompt for field
    config.idpDiscoveryEnabled Boolean IDP Discovery should be set to true if you have configured more than one identity provider for UAA. The discovery relies on email domain being set for each additional provider
    config.accountChooserEnabled Boolean This flag is required to enable account choosing functionality for IDP discovery page.
    config.branding.companyName String This name is used on the UAA Pages and in account management related communication in UAA
    config.branding.productLogo String This is a base64Url encoded PNG image which will be used as the logo on all UAA pages like Login, Sign Up etc.
    config.branding.squareLogo String This is a base64 encoded PNG image which will be used as the favicon for the UAA pages
    config.branding.footerLegalText String This text appears on the footer of all UAA pages
    config.branding.footerLinks.* Array These links (Map) appear on the footer of all UAA pages. You may choose to add multiple urls for things like Support, Terms of Service etc.
    config.branding.banner.text String This is text displayed in a banner at the top of the UAA login page
    config.branding.banner.logo String This is base64 encoded PNG data displayed in a banner at the top of the UAA login page, overrides banner text
    config.branding.banner.link String The UAA login banner will be a link pointing to this url
    config.branding.banner.textColor String Hexadecimal color code for banner text color, does not allow color names
    config.branding.banner.backgroundColor String Hexadecimal color code for banner background color, does not allow color names
    config.corsPolicy.defaultConfiguration.allowedOrigins Array Access-Control-Allow-Origin header. Indicates whether a resource can be shared based by returning the value of the Origin request header, "*", or "null" in the response.
    config.corsPolicy.defaultConfiguration.allowedOriginPatterns Array Indicates whether a resource can be shared based by returning the value of the Origin patterns.
    config.corsPolicy.defaultConfiguration.allowedUris Array The list of allowed URIs.
    config.corsPolicy.defaultConfiguration.allowedUriPatterns Array The list of allowed URI patterns.
    config.corsPolicy.defaultConfiguration.allowedHeaders Array Access-Control-Allow-Headers header. Indicates which header field names can be used during the actual response
    config.corsPolicy.defaultConfiguration.allowedMethods Array Access-Control-Allow-Methods header. Indicates which method will be used in the actual request as part of the preflight request.
    config.corsPolicy.defaultConfiguration.allowedCredentials Boolean Access-Control-Allow-Credentials header. Indicates whether the response to request can be exposed when the omit credentials flag is unset. When part of the response to a preflight request it indicates that the actual request can include user credentials..
    config.corsPolicy.defaultConfiguration.maxAge Number Access-Control-Max-Age header. Indicates how long the results of a preflight request can be cached in a preflight result cache
    config.corsPolicy.xhrConfiguration.allowedOrigins Array Access-Control-Allow-Origin header. Indicates whether a resource can be shared based by returning the value of the Origin request header, "*", or "null" in the response.
    config.corsPolicy.xhrConfiguration.allowedOriginPatterns Array Indicates whether a resource can be shared based by returning the value of the Origin patterns.
    config.corsPolicy.xhrConfiguration.allowedUris Array The list of allowed URIs.
    config.corsPolicy.xhrConfiguration.allowedUriPatterns Array The list of allowed URI patterns.
    config.corsPolicy.xhrConfiguration.allowedHeaders Array Access-Control-Allow-Headers header. Indicates which header field names can be used during the actual response
    config.corsPolicy.xhrConfiguration.allowedMethods Array Access-Control-Allow-Methods header. Indicates which method will be used in the actual request as part of the preflight request.
    config.corsPolicy.xhrConfiguration.allowedCredentials Boolean Access-Control-Allow-Credentials header. Indicates whether the response to request can be exposed when the omit credentials flag is unset. When part of the response to a preflight request it indicates that the actual request can include user credentials..
    config.corsPolicy.xhrConfiguration.maxAge Number Access-Control-Max-Age header. Indicates how long the results of a preflight request can be cached in a preflight result cache
    config.userConfig.defaultGroups Array Default groups each user in the zone inherits.
    config.mfaConfig.enabled Boolean Set true to enable Multi-factor Authentication (MFA) for the current zone. Defaults to false
    config.mfaConfig.providerName String The unique name of the MFA provider to use for this zone.
    enable_redirect_uri_check Boolean Zone-level flag that will enforce client redirect uri rules as deployed in 4.4.0. If true, check will perform at authorization. Defaults to true

    Error Codes

    Error Code Description
    400 Bad Request
    401 Unauthorized - Invalid token
    403 Forbidden - Insufficient scope (zone admins can only delete their own zone)
    404 Not Found - Zone does not exist

    Creating a Key Provider Config

    A key provider config is used during the jwt bearer flow to authenticate devices. It provides DCS client and tenant information so that a public key can be obtained from DCS to validate device jwt signatures. A key provider config is created using a POST with a KeyProviderConfig object. An identifier will be generated for this object. Currently, only one can be created per zone.

    $ curl 'http://localhost/identity-zones/keyproviderzone/key-provider-config' -i -X POST \
        -H 'Content-Type: application/json' \
        -H 'Authorization: Bearer 9dbf49502b754f88a6e27ec96f5dd989' \
        -H 'X-Identity-Zone-Id: keyproviderzone' \
        -H 'Accept: application/json' \
        -d '{
      "clientId" : "dcs-client-id",
      "dcsTenantId" : "dcs-tenant-id"
    }'
    
    POST /identity-zones/keyproviderzone/key-provider-config HTTP/1.1
    Content-Type: application/json
    Authorization: Bearer 9dbf49502b754f88a6e27ec96f5dd989
    X-Identity-Zone-Id: keyproviderzone
    Accept: application/json
    Host: localhost
    Content-Length: 69
    
    {
      "clientId" : "dcs-client-id",
      "dcsTenantId" : "dcs-tenant-id"
    }
    
    HTTP/1.1 201 Created
    X-B3-TraceId: 2de06595-5598-4f22-b6eb-13e00707dcd2
    Cache-Control: no-cache, no-store, max-age=0, must-revalidate
    Pragma: no-cache
    Expires: 0
    X-XSS-Protection: 1; mode=block
    X-Frame-Options: DENY
    X-Content-Type-Options: nosniff
    Content-Type: application/json;charset=UTF-8
    Content-Length: 158
    
    {
      "id" : "71c657d4-0143-4eff-ae54-98a5fb48450c",
      "clientId" : "dcs-client-id",
      "dcsTenantId" : "dcs-tenant-id",
      "identityZoneId" : "keyproviderzone"
    }
    

    Request Headers

    Name Description
    Authorization Bearer token containing zones.write or zones.<zone id>.admin
    X-Identity-Zone-Id May include this header to administer another zone if using zones.<zone id>.admin

    Request Fields

    Path Type Constraints Description
    clientId String Optional The client id used to authenticate with DCS for the jwt bearer flow.
    dcsTenantId String Optional The DCS tenant id for the jwt bearer flow.

    Response Fields

    Path Type Description
    id String The unique id of the key provider config.
    identityZoneId String The identity zone to which the key provider config belongs. It will always be the same as the current zone.
    clientId String The client id used to authenticate with DCS for the jwt bearer flow.
    dcsTenantId String The DCS tenant id for the jwt bearer flow.

    Error Codes

    Error Code Description
    400 Bad Request
    401 Unauthorized - Invalid token
    403 Forbidden - Insufficient scope (KeyProviderConfig can only be created with zones.write or zones.zone_id.admin permissions for a given zone.)
    404 Not Found - The KeyProviderConfig does not exist
    422 Unprocessable Entity - Invalid KeyProviderConfig

    Retrieving a Key Provider Config

    $ curl 'http://localhost/identity-zones/retrievekeyproviderzone/key-provider-config/2c40419a-e16f-4b31-b4a5-64d67439424f' -i \
        -H 'Content-Type: application/json' \
        -H 'Authorization: Bearer 894ff6a8220d481f99be06263a8a232a' \
        -H 'X-Identity-Zone-Id: retrievekeyproviderzone' \
        -H 'Accept: application/json'
    
    GET /identity-zones/retrievekeyproviderzone/key-provider-config/2c40419a-e16f-4b31-b4a5-64d67439424f HTTP/1.1
    Content-Type: application/json
    Authorization: Bearer 894ff6a8220d481f99be06263a8a232a
    X-Identity-Zone-Id: retrievekeyproviderzone
    Accept: application/json
    Host: localhost
    
    
    HTTP/1.1 200 OK
    X-B3-TraceId: 7725aa68-9845-4e4d-acd9-b9d2a0399e52
    Cache-Control: no-cache, no-store, max-age=0, must-revalidate
    Pragma: no-cache
    Expires: 0
    X-XSS-Protection: 1; mode=block
    X-Frame-Options: DENY
    X-Content-Type-Options: nosniff
    Content-Type: application/json;charset=UTF-8
    Content-Length: 166
    
    {
      "id" : "2c40419a-e16f-4b31-b4a5-64d67439424f",
      "clientId" : "dcs-client-id",
      "dcsTenantId" : "dcs-tenant-id",
      "identityZoneId" : "retrievekeyproviderzone"
    }
    

    Request Headers

    Name Description
    Authorization Bearer token containing zones.write or zones.<zone id>.admin
    X-Identity-Zone-Id May include this header to administer another zone if using zones.<zone id>.admin

    Response Fields

    Path Type Description
    id String The unique id of the key provider config.
    identityZoneId String The identity zone to which the key provider config belongs. It will always be the same as the current zone.
    clientId String The client id used to authenticate with DCS for the jwt bearer flow.
    dcsTenantId String The DCS tenant id for the jwt bearer flow.

    Error Codes

    Error Code Description
    400 Bad Request
    401 Unauthorized - Invalid token
    403 Forbidden - Insufficient scope
    404 Not Found - The KeyProviderConfig does not exist

    Finding all Key Provider Configs

    $ curl 'http://localhost/identity-zones/findallkeyproviderszone/key-provider-config' -i \
        -H 'Content-Type: application/json' \
        -H 'Authorization: Bearer ec3c40de4e574315bb68c71636ca31c2' \
        -H 'X-Identity-Zone-Id: findallkeyproviderszone' \
        -H 'Accept: application/json'
    
    GET /identity-zones/findallkeyproviderszone/key-provider-config HTTP/1.1
    Content-Type: application/json
    Authorization: Bearer ec3c40de4e574315bb68c71636ca31c2
    X-Identity-Zone-Id: findallkeyproviderszone
    Accept: application/json
    Host: localhost
    
    
    HTTP/1.1 200 OK
    X-B3-TraceId: 1c021e83-6c5a-49c0-bd2f-248c1d4a101a
    Cache-Control: no-cache, no-store, max-age=0, must-revalidate
    Pragma: no-cache
    Expires: 0
    X-XSS-Protection: 1; mode=block
    X-Frame-Options: DENY
    X-Content-Type-Options: nosniff
    Content-Type: application/json;charset=UTF-8
    Content-Length: 166
    
    {
      "id" : "5b43071b-f972-4eaa-900f-34b3a48517f6",
      "clientId" : "dcs-client-id",
      "dcsTenantId" : "dcs-tenant-id",
      "identityZoneId" : "findallkeyproviderszone"
    }
    

    Request Headers

    Name Description
    Authorization Bearer token containing zones.write or zones.<zone id>.admin
    X-Identity-Zone-Id May include this header to administer another zone if using zones.<zone id>.admin

    Response Fields

    Path Type Description
    id String The unique id of the key provider config.
    identityZoneId String The identity zone to which the key provider config belongs. It will always be the same as the current zone.
    clientId String The client id used to authenticate with DCS for the jwt bearer flow.
    dcsTenantId String The DCS tenant id for the jwt bearer flow.

    Error Codes

    Error Code Description
    400 Bad Request
    401 Unauthorized - Invalid token
    403 Forbidden - Insufficient scope
    404 Not Found - The KeyProviderConfig does not exist

    Deleting a Key Provider Config

    $ curl 'http://localhost/identity-zones/deletekeyproviderzone/key-provider-config/44e07ec6-6abb-4de0-8fe7-ebc16cf06942' -i -X DELETE \
        -H 'Content-Type: application/json' \
        -H 'Authorization: Bearer f667e61b6d32459389f22cd7d8be6128' \
        -H 'X-Identity-Zone-Id: deletekeyproviderzone' \
        -H 'Accept: application/json'
    
    DELETE /identity-zones/deletekeyproviderzone/key-provider-config/44e07ec6-6abb-4de0-8fe7-ebc16cf06942 HTTP/1.1
    Content-Type: application/json
    Authorization: Bearer f667e61b6d32459389f22cd7d8be6128
    X-Identity-Zone-Id: deletekeyproviderzone
    Accept: application/json
    Host: localhost
    
    
    HTTP/1.1 204 No Content
    X-B3-TraceId: bd3b72b0-ac58-423d-8410-a4bce415c6fe
    Cache-Control: no-cache, no-store, max-age=0, must-revalidate
    Pragma: no-cache
    Expires: 0
    X-XSS-Protection: 1; mode=block
    X-Frame-Options: DENY
    X-Content-Type-Options: nosniff
    
    

    Path Parameters

    /identity-zones/{identityZoneId}/key-provider-config/{keyProviderId}

    Parameter Description
    identityZoneId Unique ID of the identity zone where the key provider config is being added.
    keyProviderId Unique ID of the key provider config.

    Request Headers

    Name Description
    Authorization Bearer token containing zones.write or zones.<zone id>.admin
    X-Identity-Zone-Id May include this header to administer another zone if using zones.<zone id>.admin

    Error Codes

    Error Code Description
    400 Bad Request
    401 Unauthorized - Invalid token
    403 Forbidden - Insufficient scope
    404 Not Found - The KeyProviderConfig does not exist

    Identity Providers

    Create

    SAML

    $ curl 'http://localhost/identity-providers?rawConfig=true' -i -X POST \
        -H 'Content-Type: application/json' \
        -H 'Authorization: Bearer daab9ffcde2945a8aa08b1ce63a93049' \
        -d '{
      "type" : "saml",
      "config" : {
        "emailDomain" : null,
        "providerDescription" : null,
        "externalGroupsWhitelist" : [ ],
        "attributeMappings" : {
          "external_groups" : [ "roles" ],
          "user.attribute.department" : "department",
          "phone_number" : "telephone",
          "given_name" : "first_name",
          "family_name" : "last_name",
          "email" : "emailAddress"
        },
        "addShadowUserOnLogin" : true,
        "storeCustomAttributes" : true,
        "metaDataLocation" : "<?xml version=\"1.0\" encoding=\"UTF-8\"?><md:EntityDescriptor xmlns:md=\"urn:oasis:names:tc:SAML:2.0:metadata\" entityID=\"http://www.okta.com/SAML\"><md:IDPSSODescriptor WantAuthnRequestsSigned=\"true\" protocolSupportEnumeration=\"urn:oasis:names:tc:SAML:2.0:protocol\"><md:KeyDescriptor use=\"signing\"><ds:KeyInfo xmlns:ds=\"http://www.w3.org/2000/09/xmldsig#\"><ds:X509Data><ds:X509Certificate>MIICmTCCAgKgAwIBAgIGAUPATqmEMA0GCSqGSIb3DQEBBQUAMIGPMQswCQYDVQQGEwJVUzETMBEG\nA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzENMAsGA1UECgwET2t0YTEU\nMBIGA1UECwwLU1NPUHJvdmlkZXIxEDAOBgNVBAMMB1Bpdm90YWwxHDAaBgkqhkiG9w0BCQEWDWlu\nZm9Ab2t0YS5jb20wHhcNMTQwMTIzMTgxMjM3WhcNNDQwMTIzMTgxMzM3WjCBjzELMAkGA1UEBhMC\nVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xDTALBgNVBAoM\nBE9rdGExFDASBgNVBAsMC1NTT1Byb3ZpZGVyMRAwDgYDVQQDDAdQaXZvdGFsMRwwGgYJKoZIhvcN\nAQkBFg1pbmZvQG9rdGEuY29tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCeil67/TLOiTZU\nWWgW2XEGgFZ94bVO90v5J1XmcHMwL8v5Z/8qjdZLpGdwI7Ph0CyXMMNklpaR/Ljb8fsls3amdT5O\nBw92Zo8ulcpjw2wuezTwL0eC0wY/GQDAZiXL59npE6U+fH1lbJIq92hx0HJSru/0O1q3+A/+jjZL\n3tL/SwIDAQABMA0GCSqGSIb3DQEBBQUAA4GBAI5BoWZoH6Mz9vhypZPOJCEKa/K+biZQsA4Zqsuk\nvvphhSERhqk/Nv76Vkl8uvJwwHbQrR9KJx4L3PRkGCG24rix71jEuXVGZUsDNM3CUKnARx4MEab6\nGFHNkZ6DmoT/PFagngecHu+EwmuDtaG0rEkFrARwe+d8Ru0BN558abFb</ds:X509Certificate></ds:X509Data></ds:KeyInfo></md:KeyDescriptor><md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</md:NameIDFormat><md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</md:NameIDFormat><md:SingleSignOnService Binding=\"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST\" Location=\"https://pivotal.oktapreview.com/app/pivotal_pivotalcfstaging_1/k2lw4l5bPODCMIIDBRYZ/sso/saml\"/><md:SingleSignOnService Binding=\"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect\" Location=\"https://pivotal.oktapreview.com/app/pivotal_pivotalcfstaging_1/k2lw4l5bPODCMIIDBRYZ/sso/saml\"/></md:IDPSSODescriptor></md:EntityDescriptor>\n",
        "nameID" : "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress",
        "assertionConsumerIndex" : 0,
        "metadataTrustCheck" : false,
        "showSamlLink" : false,
        "linkText" : "IDPEndpointsMockTests Saml Provider:SAML",
        "iconUrl" : null,
        "groupMappingMode" : "EXPLICITLY_MAPPED",
        "skipSslValidation" : false,
        "authnContext" : null,
        "socketFactoryClassName" : null
      },
      "originKey" : "SAML",
      "name" : "SAML name",
      "active" : true
    }'
    
    POST /identity-providers?rawConfig=true HTTP/1.1
    Content-Type: application/json
    Authorization: Bearer daab9ffcde2945a8aa08b1ce63a93049
    Host: localhost
    Content-Length: 2948
    
    {
      "type" : "saml",
      "config" : {
        "emailDomain" : null,
        "providerDescription" : null,
        "externalGroupsWhitelist" : [ ],
        "attributeMappings" : {
          "external_groups" : [ "roles" ],
          "user.attribute.department" : "department",
          "phone_number" : "telephone",
          "given_name" : "first_name",
          "family_name" : "last_name",
          "email" : "emailAddress"
        },
        "addShadowUserOnLogin" : true,
        "storeCustomAttributes" : true,
        "metaDataLocation" : "<?xml version=\"1.0\" encoding=\"UTF-8\"?><md:EntityDescriptor xmlns:md=\"urn:oasis:names:tc:SAML:2.0:metadata\" entityID=\"http://www.okta.com/SAML\"><md:IDPSSODescriptor WantAuthnRequestsSigned=\"true\" protocolSupportEnumeration=\"urn:oasis:names:tc:SAML:2.0:protocol\"><md:KeyDescriptor use=\"signing\"><ds:KeyInfo xmlns:ds=\"http://www.w3.org/2000/09/xmldsig#\"><ds:X509Data><ds:X509Certificate>MIICmTCCAgKgAwIBAgIGAUPATqmEMA0GCSqGSIb3DQEBBQUAMIGPMQswCQYDVQQGEwJVUzETMBEG\nA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzENMAsGA1UECgwET2t0YTEU\nMBIGA1UECwwLU1NPUHJvdmlkZXIxEDAOBgNVBAMMB1Bpdm90YWwxHDAaBgkqhkiG9w0BCQEWDWlu\nZm9Ab2t0YS5jb20wHhcNMTQwMTIzMTgxMjM3WhcNNDQwMTIzMTgxMzM3WjCBjzELMAkGA1UEBhMC\nVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xDTALBgNVBAoM\nBE9rdGExFDASBgNVBAsMC1NTT1Byb3ZpZGVyMRAwDgYDVQQDDAdQaXZvdGFsMRwwGgYJKoZIhvcN\nAQkBFg1pbmZvQG9rdGEuY29tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCeil67/TLOiTZU\nWWgW2XEGgFZ94bVO90v5J1XmcHMwL8v5Z/8qjdZLpGdwI7Ph0CyXMMNklpaR/Ljb8fsls3amdT5O\nBw92Zo8ulcpjw2wuezTwL0eC0wY/GQDAZiXL59npE6U+fH1lbJIq92hx0HJSru/0O1q3+A/+jjZL\n3tL/SwIDAQABMA0GCSqGSIb3DQEBBQUAA4GBAI5BoWZoH6Mz9vhypZPOJCEKa/K+biZQsA4Zqsuk\nvvphhSERhqk/Nv76Vkl8uvJwwHbQrR9KJx4L3PRkGCG24rix71jEuXVGZUsDNM3CUKnARx4MEab6\nGFHNkZ6DmoT/PFagngecHu+EwmuDtaG0rEkFrARwe+d8Ru0BN558abFb</ds:X509Certificate></ds:X509Data></ds:KeyInfo></md:KeyDescriptor><md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</md:NameIDFormat><md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</md:NameIDFormat><md:SingleSignOnService Binding=\"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST\" Location=\"https://pivotal.oktapreview.com/app/pivotal_pivotalcfstaging_1/k2lw4l5bPODCMIIDBRYZ/sso/saml\"/><md:SingleSignOnService Binding=\"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect\" Location=\"https://pivotal.oktapreview.com/app/pivotal_pivotalcfstaging_1/k2lw4l5bPODCMIIDBRYZ/sso/saml\"/></md:IDPSSODescriptor></md:EntityDescriptor>\n",
        "nameID" : "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress",
        "assertionConsumerIndex" : 0,
        "metadataTrustCheck" : false,
        "showSamlLink" : false,
        "linkText" : "IDPEndpointsMockTests Saml Provider:SAML",
        "iconUrl" : null,
        "groupMappingMode" : "EXPLICITLY_MAPPED",
        "skipSslValidation" : false,
        "authnContext" : null,
        "socketFactoryClassName" : null
      },
      "originKey" : "SAML",
      "name" : "SAML name",
      "active" : true
    }
    
    HTTP/1.1 201 Created
    X-B3-TraceId: 6f6ddf91-6dad-4b8d-8d8e-55cc09c921cb
    Cache-Control: no-cache, no-store, max-age=0, must-revalidate
    Pragma: no-cache
    Expires: 0
    X-XSS-Protection: 1; mode=block
    X-Frame-Options: DENY
    X-Content-Type-Options: nosniff
    Content-Type: application/json;charset=UTF-8
    Content-Length: 3197
    
    {
      "type" : "saml",
      "config" : {
        "emailDomain" : null,
        "additionalConfiguration" : null,
        "providerDescription" : null,
        "externalGroupsWhitelist" : [ ],
        "attributeMappings" : {
          "external_groups" : [ "roles" ],
          "user.attribute.department" : "department",
          "phone_number" : "telephone",
          "given_name" : "first_name",
          "family_name" : "last_name",
          "email" : "emailAddress"
        },
        "addShadowUserOnLogin" : true,
        "storeCustomAttributes" : true,
        "metaDataLocation" : "<?xml version=\"1.0\" encoding=\"UTF-8\"?><md:EntityDescriptor xmlns:md=\"urn:oasis:names:tc:SAML:2.0:metadata\" entityID=\"http://www.okta.com/SAML\"><md:IDPSSODescriptor WantAuthnRequestsSigned=\"true\" protocolSupportEnumeration=\"urn:oasis:names:tc:SAML:2.0:protocol\"><md:KeyDescriptor use=\"signing\"><ds:KeyInfo xmlns:ds=\"http://www.w3.org/2000/09/xmldsig#\"><ds:X509Data><ds:X509Certificate>MIICmTCCAgKgAwIBAgIGAUPATqmEMA0GCSqGSIb3DQEBBQUAMIGPMQswCQYDVQQGEwJVUzETMBEG\nA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzENMAsGA1UECgwET2t0YTEU\nMBIGA1UECwwLU1NPUHJvdmlkZXIxEDAOBgNVBAMMB1Bpdm90YWwxHDAaBgkqhkiG9w0BCQEWDWlu\nZm9Ab2t0YS5jb20wHhcNMTQwMTIzMTgxMjM3WhcNNDQwMTIzMTgxMzM3WjCBjzELMAkGA1UEBhMC\nVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xDTALBgNVBAoM\nBE9rdGExFDASBgNVBAsMC1NTT1Byb3ZpZGVyMRAwDgYDVQQDDAdQaXZvdGFsMRwwGgYJKoZIhvcN\nAQkBFg1pbmZvQG9rdGEuY29tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCeil67/TLOiTZU\nWWgW2XEGgFZ94bVO90v5J1XmcHMwL8v5Z/8qjdZLpGdwI7Ph0CyXMMNklpaR/Ljb8fsls3amdT5O\nBw92Zo8ulcpjw2wuezTwL0eC0wY/GQDAZiXL59npE6U+fH1lbJIq92hx0HJSru/0O1q3+A/+jjZL\n3tL/SwIDAQABMA0GCSqGSIb3DQEBBQUAA4GBAI5BoWZoH6Mz9vhypZPOJCEKa/K+biZQsA4Zqsuk\nvvphhSERhqk/Nv76Vkl8uvJwwHbQrR9KJx4L3PRkGCG24rix71jEuXVGZUsDNM3CUKnARx4MEab6\nGFHNkZ6DmoT/PFagngecHu+EwmuDtaG0rEkFrARwe+d8Ru0BN558abFb</ds:X509Certificate></ds:X509Data></ds:KeyInfo></md:KeyDescriptor><md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</md:NameIDFormat><md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</md:NameIDFormat><md:SingleSignOnService Binding=\"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST\" Location=\"https://pivotal.oktapreview.com/app/pivotal_pivotalcfstaging_1/k2lw4l5bPODCMIIDBRYZ/sso/saml\"/><md:SingleSignOnService Binding=\"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect\" Location=\"https://pivotal.oktapreview.com/app/pivotal_pivotalcfstaging_1/k2lw4l5bPODCMIIDBRYZ/sso/saml\"/></md:IDPSSODescriptor></md:EntityDescriptor>\n",
        "idpEntityAlias" : "SAML",
        "zoneId" : "uaa",
        "nameID" : "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress",
        "assertionConsumerIndex" : 0,
        "metadataTrustCheck" : false,
        "showSamlLink" : false,
        "linkText" : "IDPEndpointsMockTests Saml Provider:SAML",
        "iconUrl" : null,
        "groupMappingMode" : "EXPLICITLY_MAPPED",
        "skipSslValidation" : false,
        "authnContext" : null,
        "socketFactoryClassName" : null
      },
      "id" : "47aed27d-8ac9-407c-9b3b-867244e0cc70",
      "originKey" : "SAML",
      "name" : "SAML name",
      "version" : 0,
      "created" : 1525217092688,
      "last_modified" : 1525217092688,
      "active" : true,
      "identityZoneId" : "uaa"
    }
    
    $ curl 'http://localhost/identity-providers?rawConfig=true' -i -X POST \
        -H 'Content-Type: application/json' \
        -H 'Authorization: Bearer daab9ffcde2945a8aa08b1ce63a93049' \
        -d '{
      "type" : "saml",
      "config" : {
        "emailDomain" : null,
        "providerDescription" : null,
        "externalGroupsWhitelist" : [ ],
        "attributeMappings" : { },
        "addShadowUserOnLogin" : true,
        "storeCustomAttributes" : true,
        "metaDataLocation" : "http://simplesamlphp.cfapps.io/saml2/idp/metadata.php",
        "nameID" : "urn:oasis:names:tc:SAML:1.1:nameid-format:transient",
        "assertionConsumerIndex" : 0,
        "metadataTrustCheck" : false,
        "showSamlLink" : false,
        "linkText" : "IDPEndpointsMockTests Saml Provider:SAML",
        "iconUrl" : null,
        "groupMappingMode" : "EXPLICITLY_MAPPED",
        "skipSslValidation" : false,
        "authnContext" : null,
        "socketFactoryClassName" : null
      },
      "originKey" : "SAMLMetadataUrl",
      "name" : "SAML name",
      "active" : true
    }'
    
    POST /identity-providers?rawConfig=true HTTP/1.1
    Content-Type: application/json
    Authorization: Bearer daab9ffcde2945a8aa08b1ce63a93049
    Host: localhost
    Content-Length: 791
    
    {
      "type" : "saml",
      "config" : {
        "emailDomain" : null,
        "providerDescription" : null,
        "externalGroupsWhitelist" : [ ],
        "attributeMappings" : { },
        "addShadowUserOnLogin" : true,
        "storeCustomAttributes" : true,
        "metaDataLocation" : "http://simplesamlphp.cfapps.io/saml2/idp/metadata.php",
        "nameID" : "urn:oasis:names:tc:SAML:1.1:nameid-format:transient",
        "assertionConsumerIndex" : 0,
        "metadataTrustCheck" : false,
        "showSamlLink" : false,
        "linkText" : "IDPEndpointsMockTests Saml Provider:SAML",
        "iconUrl" : null,
        "groupMappingMode" : "EXPLICITLY_MAPPED",
        "skipSslValidation" : false,
        "authnContext" : null,
        "socketFactoryClassName" : null
      },
      "originKey" : "SAMLMetadataUrl",
      "name" : "SAML name",
      "active" : true
    }
    
    HTTP/1.1 201 Created
    X-B3-TraceId: 689d435a-1c80-4c87-8852-e3de2a53815a
    Cache-Control: no-cache, no-store, max-age=0, must-revalidate
    Pragma: no-cache
    Expires: 0
    X-XSS-Protection: 1; mode=block
    X-Frame-Options: DENY
    X-Content-Type-Options: nosniff
    Content-Type: application/json;charset=UTF-8
    Content-Length: 1051
    
    {
      "type" : "saml",
      "config" : {
        "emailDomain" : null,
        "additionalConfiguration" : null,
        "providerDescription" : null,
        "externalGroupsWhitelist" : [ ],
        "attributeMappings" : { },
        "addShadowUserOnLogin" : true,
        "storeCustomAttributes" : true,
        "metaDataLocation" : "http://simplesamlphp.cfapps.io/saml2/idp/metadata.php",
        "idpEntityAlias" : "SAMLMetadataUrl",
        "zoneId" : "uaa",
        "nameID" : "urn:oasis:names:tc:SAML:1.1:nameid-format:transient",
        "assertionConsumerIndex" : 0,
        "metadataTrustCheck" : false,
        "showSamlLink" : false,
        "linkText" : "IDPEndpointsMockTests Saml Provider:SAML",
        "iconUrl" : null,
        "groupMappingMode" : "EXPLICITLY_MAPPED",
        "skipSslValidation" : false,
        "authnContext" : null,
        "socketFactoryClassName" : null
      },
      "id" : "2ffe62da-992d-44f3-ba8b-76d2aca17794",
      "originKey" : "SAMLMetadataUrl",
      "name" : "SAML name",
      "version" : 0,
      "created" : 1525217093151,
      "last_modified" : 1525217093151,
      "active" : true,
      "identityZoneId" : "uaa"
    }
    

    Request Headers

    Name Description
    Authorization Bearer token containing zones.<zone id>.admin or uaa.admin or idps.write (only in the same zone that you are a user of)
    X-Identity-Zone-Id May include this header to administer another zone if using zones.<zoneId>.admin or uaa.admin scope against the default UAA zone.
    X-Identity-Zone-Subdomain If using a zones.<zoneId>.admin scope/token, indicates what Identity Zone this request goes to by supplying a subdomain.

    Request Parameters

    Parameter Type Constraints Description
    rawConfig Boolean Optional (defaults to false) UAA 3.4.0 Flag indicating whether the response should use raw, unescaped JSON for the config field of the IDP, rather than the default behavior of encoding the JSON as a string.

    Request Fields

    Path Type Constraints Description
    name String Required Human-readable name for this provider
    config.providerDescription String Optional Human readable name/description of this provider
    config.emailDomain Array Optional List of email domains associated with the provider for the purpose of associating users to the correct origin upon invitation. If empty list, no invitations are accepted. Wildcards supported.
    active Boolean Optional Defaults to true.
    config.addShadowUserOnLogin Boolean Optional (defaults to true) Determines whether users should be allowed to authenticate without having a user pre-populated in the users database (if true), or whether shadow users must be created before login by an administrator (if false).
    config.storeCustomAttributes Boolean Optional (defaults to true) Set to true, to store custom user attributes to be fetched from the /userinfo endpoint
    type String Required saml
    originKey String Required A unique alias for the SAML provider
    config.skipSslValidation Boolean Optional (defaults to false) Set to true, to skip SSL validation when fetching metadata.
    config.storeCustomAttributes Boolean Optional (defaults to true) Set to true, to store custom user attributes to be fetched from the /userinfo endpoint
    config.metaDataLocation String Required SAML Metadata - either an XML string or a URL that will deliver XML content
    config.nameID String Optional The name ID to use for the username, default is "urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified".
    config.assertionConsumerIndex Number Optional SAML assertion consumer index, default is 0
    config.metadataTrustCheck Boolean Optional Should metadata be validated, defaults to false
    config.showSamlLink Boolean Optional Should the SAML login link be displayed on the login page, defaults to false
    config.linkText String Required if the showSamlLink is set to true The link text for the SAML IDP on the login page
    config.groupMappingMode String Optional (defaults to "EXPLICITLY_MAPPED") Either EXPLICITLY_MAPPED in order to map external groups to OAuth scopes using the group mappings, or AS_SCOPES to use SAML group names as scopes.
    config.iconUrl String Optional Reserved for future use
    config.socketFactoryClassName Null Optional Property is deprecated and value is ignored.
    config.authnContext Array Optional List of AuthnContextClassRef to include in the SAMLRequest. If not specified no AuthnContext will be requested.
    config.attributeMappings.user_name String Optional (defaults to "NameID") Map user_name to the attribute for user name in the provider assertion or token. The default for SAML is NameID.
    config.attributeMappings Object Optional Map external attribute to UAA recognized mappings.
    config.attributeMappings.email String Optional Map email to the attribute for email in the provider assertion or token.
    config.attributeMappings.given_name String Optional Map given_name to the attribute for given name in the provider assertion or token.
    config.attributeMappings.family_name String Optional Map family_name to the attribute for family name in the provider assertion or token.
    config.attributeMappings.phone_number String Optional Map phone_number to the attribute for phone number in the provider assertion or token.
    config.attributeMappings.external_groups Array Optional Map external_groups to the attribute for groups in the provider assertion.
    config.attributeMappings['user.attribute.department'] String Optional Map external attribute to UAA recognized mappings. Mapping should be of the format user.attribute.<attribute_name>. department is used in the documentation as an example attribute.

    Response Fields

    Path Type Description
    name String Human-readable name for this provider
    config.providerDescription String Human readable name/description of this provider
    config.emailDomain Array List of email domains associated with the provider for the purpose of associating users to the correct origin upon invitation. If empty list, no invitations are accepted. Wildcards supported.
    active Boolean Defaults to true.
    config.addShadowUserOnLogin Boolean Determines whether users should be allowed to authenticate without having a user pre-populated in the users database (if true), or whether shadow users must be created before login by an administrator (if false).
    config.storeCustomAttributes Boolean Set to true, to store custom user attributes to be fetched from the /userinfo endpoint
    type String saml
    originKey String A unique alias for the SAML provider
    config.skipSslValidation Boolean Set to true, to skip SSL validation when fetching metadata.
    config.storeCustomAttributes Boolean Set to true, to store custom user attributes to be fetched from the /userinfo endpoint
    config.metaDataLocation String SAML Metadata - either an XML string or a URL that will deliver XML content
    config.nameID String The name ID to use for the username, default is "urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified".
    config.assertionConsumerIndex Number SAML assertion consumer index, default is 0
    config.metadataTrustCheck Boolean Should metadata be validated, defaults to false
    config.showSamlLink Boolean Should the SAML login link be displayed on the login page, defaults to false
    config.linkText String The link text for the SAML IDP on the login page
    config.groupMappingMode String Either EXPLICITLY_MAPPED in order to map external groups to OAuth scopes using the group mappings, or AS_SCOPES to use SAML group names as scopes.
    config.iconUrl String Reserved for future use
    config.socketFactoryClassName Null Property is deprecated and value is ignored.
    config.authnContext Array List of AuthnContextClassRef to include in the SAMLRequest. If not specified no AuthnContext will be requested.
    config.attributeMappings.user_name String Map user_name to the attribute for user name in the provider assertion or token. The default for SAML is NameID.
    config.attributeMappings Object Map external attribute to UAA recognized mappings.
    config.attributeMappings.email String Map email to the attribute for email in the provider assertion or token.
    config.attributeMappings.given_name String Map given_name to the attribute for given name in the provider assertion or token.
    config.attributeMappings.family_name String Map family_name to the attribute for family name in the provider assertion or token.
    config.attributeMappings.phone_number String Map phone_number to the attribute for phone number in the provider assertion or token.
    config.attributeMappings.external_groups Array Map external_groups to the attribute for groups in the provider assertion.
    config.attributeMappings['user.attribute.department'] String Map external attribute to UAA recognized mappings. Mapping should be of the format user.attribute.<attribute_name>. department is used in the documentation as an example attribute.
    version Number Version of the identity provider data. Clients can use this to protect against conflicting updates
    id String Unique identifier for this provider - GUID generated by the UAA
    config.additionalConfiguration Object (Unused.)
    identityZoneId String Set to the zone that this provider will be active in. Determined either by the Host header or the zone switch header.
    created Number UAA sets the creation date
    last_modified Number UAA sets the modification date
    config.idpEntityAlias String This will be set to originKey
    config.zoneId String This will be set to the ID of the zone where the provider is being created

    Error Codes

    Error Code Description
    403 Forbidden - Insufficient scope
    409 Conflict - Provider with same origin and zone id exists
    422 Unprocessable Entity - Invalid configuration
    500 Internal Server Error

    LDAP

    LDAP supports several different configurations. The most common one is that authentication is done using a search and bind strategy. The available strategies for authentication are

    Group integration also supports different strategies

    LDAP Simple Bind

    $ curl 'http://localhost/identity-providers?rawConfig=true' -i -X POST \
        -H 'Content-Type: application/json' \
        -H 'X-Identity-Zone-Subdomain: gjhfcnpr' \
        -H 'Authorization: Bearer 505bf00201794d1d9a25a5dbf5bbcf59' \
        -d '{
      "type" : "ldap",
      "config" : {
        "emailDomain" : null,
        "providerDescription" : null,
        "externalGroupsWhitelist" : [ ],
        "attributeMappings" : { },
        "addShadowUserOnLogin" : true,
        "storeCustomAttributes" : true,
        "ldapProfileFile" : "ldap/ldap-simple-bind.xml",
        "baseUrl" : "ldap://localhost:23389",
        "referral" : null,
        "skipSSLVerification" : false,
        "userDNPattern" : "cn={0},ou=Users,dc=test,dc=com",
        "userDNPatternDelimiter" : ";",
        "bindUserDn" : null,
        "userSearchBase" : null,
        "userSearchFilter" : null,
        "passwordAttributeName" : null,
        "passwordEncoder" : null,
        "localPasswordCompare" : null,
        "mailAttributeName" : "mail",
        "mailSubstitute" : null,
        "mailSubstituteOverridesLdap" : false,
        "ldapGroupFile" : "ldap/ldap-groups-null.xml",
        "groupSearchBase" : null,
        "groupSearchFilter" : null,
        "groupsIgnorePartialResults" : null,
        "autoAddGroups" : true,
        "groupSearchSubTree" : true,
        "maxGroupSearchDepth" : 10,
        "groupRoleAttribute" : null,
        "tlsConfiguration" : "none"
      },
      "originKey" : "ldap",
      "name" : "ldap name",
      "active" : true
    }'
    
    POST /identity-providers?rawConfig=true HTTP/1.1
    Content-Type: application/json
    X-Identity-Zone-Subdomain: gjhfcnpr
    Authorization: Bearer 505bf00201794d1d9a25a5dbf5bbcf59
    Host: localhost
    Content-Length: 1156
    
    {
      "type" : "ldap",
      "config" : {
        "emailDomain" : null,
        "providerDescription" : null,
        "externalGroupsWhitelist" : [ ],
        "attributeMappings" : { },
        "addShadowUserOnLogin" : true,
        "storeCustomAttributes" : true,
        "ldapProfileFile" : "ldap/ldap-simple-bind.xml",
        "baseUrl" : "ldap://localhost:23389",
        "referral" : null,
        "skipSSLVerification" : false,
        "userDNPattern" : "cn={0},ou=Users,dc=test,dc=com",
        "userDNPatternDelimiter" : ";",
        "bindUserDn" : null,
        "userSearchBase" : null,
        "userSearchFilter" : null,
        "passwordAttributeName" : null,
        "passwordEncoder" : null,
        "localPasswordCompare" : null,
        "mailAttributeName" : "mail",
        "mailSubstitute" : null,
        "mailSubstituteOverridesLdap" : false,
        "ldapGroupFile" : "ldap/ldap-groups-null.xml",
        "groupSearchBase" : null,
        "groupSearchFilter" : null,
        "groupsIgnorePartialResults" : null,
        "autoAddGroups" : true,
        "groupSearchSubTree" : true,
        "maxGroupSearchDepth" : 10,
        "groupRoleAttribute" : null,
        "tlsConfiguration" : "none"
      },
      "originKey" : "ldap",
      "name" : "ldap name",
      "active" : true
    }
    
    HTTP/1.1 201 Created
    X-B3-TraceId: 6b7f0d2e-1cc2-463c-845f-f4457053b609
    Cache-Control: no-cache, no-store, max-age=0, must-revalidate
    Pragma: no-cache
    Expires: 0
    X-XSS-Protection: 1; mode=block
    X-Frame-Options: DENY
    X-Content-Type-Options: nosniff
    Content-Type: application/json;charset=UTF-8
    Content-Length: 1357
    
    {
      "type" : "ldap",
      "config" : {
        "emailDomain" : null,
        "additionalConfiguration" : null,
        "providerDescription" : null,
        "externalGroupsWhitelist" : [ ],
        "attributeMappings" : { },
        "addShadowUserOnLogin" : true,
        "storeCustomAttributes" : true,
        "ldapProfileFile" : "ldap/ldap-simple-bind.xml",
        "baseUrl" : "ldap://localhost:23389",
        "referral" : null,
        "skipSSLVerification" : false,
        "userDNPattern" : "cn={0},ou=Users,dc=test,dc=com",
        "userDNPatternDelimiter" : ";",
        "bindUserDn" : null,
        "userSearchBase" : null,
        "userSearchFilter" : null,
        "passwordAttributeName" : null,
        "passwordEncoder" : null,
        "localPasswordCompare" : null,
        "mailAttributeName" : "mail",
        "mailSubstitute" : null,
        "mailSubstituteOverridesLdap" : false,
        "ldapGroupFile" : "ldap/ldap-groups-null.xml",
        "groupSearchBase" : null,
        "groupSearchFilter" : null,
        "groupsIgnorePartialResults" : null,
        "autoAddGroups" : true,
        "groupSearchSubTree" : true,
        "maxGroupSearchDepth" : 10,
        "groupRoleAttribute" : null,
        "tlsConfiguration" : "none"
      },
      "id" : "00ceb564-8515-4199-bb55-cc78faab1442",
      "originKey" : "ldap",
      "name" : "ldap name",
      "version" : 0,
      "created" : 1525217097792,
      "last_modified" : 1525217097792,
      "active" : true,
      "identityZoneId" : "gjhfcnpr"
    }
    

    Request Headers

    Name Description
    Authorization Bearer token containing zones.<zone id>.admin or uaa.admin or idps.write (only in the same zone that you are a user of)
    X-Identity-Zone-Id May include this header to administer another zone if using zones.<zoneId>.admin or uaa.admin scope against the default UAA zone.
    X-Identity-Zone-Subdomain If using a zones.<zoneId>.admin scope/token, indicates what Identity Zone this request goes to by supplying a subdomain.

    Request Parameters

    Parameter Type Constraints Description
    rawConfig Boolean Optional (defaults to false) UAA 3.4.0 Flag indicating whether the response should use raw, unescaped JSON for the config field of the IDP, rather than the default behavior of encoding the JSON as a string.

    Request Fields

    Path Type Constraints Description
    name String Required Human-readable name for this provider
    config.providerDescription String Optional Human readable name/description of this provider
    config.emailDomain Array Optional List of email domains associated with the provider for the purpose of associating users to the correct origin upon invitation. If empty list, no invitations are accepted. Wildcards supported.
    active Boolean Optional Defaults to true.
    config.addShadowUserOnLogin Boolean Optional (defaults to true) Determines whether users should be allowed to authenticate without having a user pre-populated in the users database (if true), or whether shadow users must be created before login by an administrator (if false).
    config.storeCustomAttributes Boolean Optional (defaults to true) Set to true, to store custom user attributes to be fetched from the /userinfo endpoint
    type String Required ldap
    originKey String Required Origin key must be ldap for an LDAP provider
    config.ldapProfileFile String Required The file to be used for configuring the LDAP authentication. Options are: ldap/ldap-simple-bind.xml, ldap/ldap-search-and-bind.xml, ldap/ldap-search-and-compare.xml
    config.ldapGroupFile String Required The file to be used for group integration. Options are: ldap/ldap-groups-null.xml, ldap/ldap-groups-as-scopes.xml, ldap/ldap-groups-map-to-scopes.xml
    config.baseUrl String Required The URL to the ldap server, must start with ldap:// or ldaps://
    config.mailAttributeName String Optional (defaults to "mail") The name of the LDAP attribute that contains the user's email address
    config.mailSubstitute String Optional Defines an email pattern containing a {0} to generate an email address for an LDAP user during authentication
    config.mailSubstituteOverridesLdap Boolean Optional (defaults to false) Set to true if you wish to override an LDAP user email address with a generated one
    config.skipSSLVerification Boolean Optional (defaults to false) Skips validation of the LDAP cert if set to true.
    config.tlsConfiguration String Optional (defaults to "none") Sets the StartTLS options, valid values are none, simple or external
    config.referral String Optional (defaults to "follow") Configures the UAA LDAP referral behavior. The following values are possible:
    • follow → Referrals are followed
    • ignore → Referrals are ignored and the partial result is returned
    • throw → An error is thrown and the authentication is aborted
    Reference: http://docs.oracle.com/javase/jndi/tutorial/ldap/referral/jndi.html
    config.attributeMappings Object Optional Map external attribute to UAA recognized mappings.
    config.attributeMappings.user_name String Optional (defaults to "user_name") Map user_name to the attribute for user name in the provider assertion or token. The default for LDAP is the User Name filter
    config.attributeMappings.first_name String Optional (defaults to "givenname") Map given_name to the attribute for given name in the provider assertion or token.
    config.attributeMappings.family_name String Optional (defaults to "sn") Map family_name to the attribute for family name in the provider assertion or token.
    config.attributeMappings.phone_number String Optional (defaults to "telephonenumber") Map phone_number to the attribute for phone number in the provider assertion or token.

    Response Fields

    Path Type Constraints Description
    name String Required Human-readable name for this provider
    config.providerDescription String Optional Human readable name/description of this provider
    config.emailDomain Array Optional List of email domains associated with the provider for the purpose of associating users to the correct origin upon invitation. If empty list, no invitations are accepted. Wildcards supported.
    active Boolean Optional Defaults to true.
    config.addShadowUserOnLogin Boolean Optional (defaults to true) Determines whether users should be allowed to authenticate without having a user pre-populated in the users database (if true), or whether shadow users must be created before login by an administrator (if false).
    config.storeCustomAttributes Boolean Optional (defaults to true) Set to true, to store custom user attributes to be fetched from the /userinfo endpoint
    type String Required ldap
    originKey String Required Origin key must be ldap for an LDAP provider
    config.ldapProfileFile String Required The file to be used for configuring the LDAP authentication. Options are: ldap/ldap-simple-bind.xml, ldap/ldap-search-and-bind.xml, ldap/ldap-search-and-compare.xml
    config.ldapGroupFile String Required The file to be used for group integration. Options are: ldap/ldap-groups-null.xml, ldap/ldap-groups-as-scopes.xml, ldap/ldap-groups-map-to-scopes.xml
    config.baseUrl String Required The URL to the ldap server, must start with ldap:// or ldaps://
    config.mailAttributeName String Optional (defaults to "mail") The name of the LDAP attribute that contains the user's email address
    config.mailSubstitute String Optional Defines an email pattern containing a {0} to generate an email address for an LDAP user during authentication
    config.mailSubstituteOverridesLdap Boolean Optional (defaults to false) Set to true if you wish to override an LDAP user email address with a generated one
    config.skipSSLVerification Boolean Optional (defaults to false) Skips validation of the LDAP cert if set to true.
    config.tlsConfiguration String Optional (defaults to "none") Sets the StartTLS options, valid values are none, simple or external
    config.referral String Optional (defaults to "follow") Configures the UAA LDAP referral behavior. The following values are possible:
    • follow → Referrals are followed
    • ignore → Referrals are ignored and the partial result is returned
    • throw → An error is thrown and the authentication is aborted
    Reference: http://docs.oracle.com/javase/jndi/tutorial/ldap/referral/jndi.html
    config.attributeMappings Object Optional Map external attribute to UAA recognized mappings.
    config.attributeMappings.user_name String Optional (defaults to "user_name") Map user_name to the attribute for user name in the provider assertion or token. The default for LDAP is the User Name filter
    config.attributeMappings.first_name String Optional (defaults to "givenname") Map given_name to the attribute for given name in the provider assertion or token.
    config.attributeMappings.family_name String Optional (defaults to "sn") Map family_name to the attribute for family name in the provider assertion or token.
    config.attributeMappings.phone_number String Optional (defaults to "telephonenumber") Map phone_number to the attribute for phone number in the provider assertion or token.

    Error Codes

    Error Code Description
    401 Unauthorized - Missing or invalid token
    403 Forbidden - Insufficient scope
    409 Conflict - Provider with same origin and zone id exists
    422 Unprocessable Entity - Invalid configuration
    500 Internal Server Error

    LDAP Search and Bind

    $ curl 'http://localhost/identity-providers?rawConfig=true' -i -X POST \
        -H 'Content-Type: application/json' \
        -H 'X-Identity-Zone-Subdomain: 2jncg4hg' \
        -H 'Authorization: Bearer 891066a00ed3448a83e69d5124aae84d' \
        -d '{
      "type" : "ldap",
      "config" : {
        "emailDomain" : null,
        "providerDescription" : null,
        "externalGroupsWhitelist" : [ ],
        "attributeMappings" : { },
        "addShadowUserOnLogin" : true,
        "storeCustomAttributes" : true,
        "ldapProfileFile" : "ldap/ldap-search-and-bind.xml",
        "baseUrl" : "ldap://localhost:23389",
        "referral" : null,
        "skipSSLVerification" : false,
        "userDNPattern" : null,
        "userDNPatternDelimiter" : null,
        "bindUserDn" : "cn=admin,ou=Users,dc=test,dc=com",
        "bindPassword" : "adminsecret",
        "userSearchBase" : "dc=test,dc=com",
        "userSearchFilter" : "cn={0}",
        "passwordAttributeName" : null,
        "passwordEncoder" : null,
        "localPasswordCompare" : null,
        "mailAttributeName" : "mail",
        "mailSubstitute" : "{0}@my.org",
        "mailSubstituteOverridesLdap" : false,
        "ldapGroupFile" : "ldap/ldap-groups-map-to-scopes.xml",
        "groupSearchBase" : "ou=scopes,dc=test,dc=com",
        "groupSearchFilter" : "member={0}",
        "groupsIgnorePartialResults" : null,
        "autoAddGroups" : true,
        "groupSearchSubTree" : true,
        "maxGroupSearchDepth" : 3,
        "groupRoleAttribute" : null,
        "tlsConfiguration" : "none"
      },
      "originKey" : "ldap",
      "name" : "ldap name",
      "active" : true
    }'
    
    POST /identity-providers?rawConfig=true HTTP/1.1
    Content-Type: application/json
    X-Identity-Zone-Subdomain: 2jncg4hg
    Authorization: Bearer 891066a00ed3448a83e69d5124aae84d
    Host: localhost
    Content-Length: 1261
    
    {
      "type" : "ldap",
      "config" : {
        "emailDomain" : null,
        "providerDescription" : null,
        "externalGroupsWhitelist" : [ ],
        "attributeMappings" : { },
        "addShadowUserOnLogin" : true,
        "storeCustomAttributes" : true,
        "ldapProfileFile" : "ldap/ldap-search-and-bind.xml",
        "baseUrl" : "ldap://localhost:23389",
        "referral" : null,
        "skipSSLVerification" : false,
        "userDNPattern" : null,
        "userDNPatternDelimiter" : null,
        "bindUserDn" : "cn=admin,ou=Users,dc=test,dc=com",
        "bindPassword" : "adminsecret",
        "userSearchBase" : "dc=test,dc=com",
        "userSearchFilter" : "cn={0}",
        "passwordAttributeName" : null,
        "passwordEncoder" : null,
        "localPasswordCompare" : null,
        "mailAttributeName" : "mail",
        "mailSubstitute" : "{0}@my.org",
        "mailSubstituteOverridesLdap" : false,
        "ldapGroupFile" : "ldap/ldap-groups-map-to-scopes.xml",
        "groupSearchBase" : "ou=scopes,dc=test,dc=com",
        "groupSearchFilter" : "member={0}",
        "groupsIgnorePartialResults" : null,
        "autoAddGroups" : true,
        "groupSearchSubTree" : true,
        "maxGroupSearchDepth" : 3,
        "groupRoleAttribute" : null,
        "tlsConfiguration" : "none"
      },
      "originKey" : "ldap",
      "name" : "ldap name",
      "active" : true
    }
    
    HTTP/1.1 201 Created
    X-B3-TraceId: 6f3d23ea-3e1b-4097-a210-34579b002b59
    Cache-Control: no-cache, no-store, max-age=0, must-revalidate
    Pragma: no-cache
    Expires: 0
    X-XSS-Protection: 1; mode=block
    X-Frame-Options: DENY
    X-Content-Type-Options: nosniff
    Content-Type: application/json;charset=UTF-8
    Content-Length: 1426
    
    {
      "type" : "ldap",
      "config" : {
        "emailDomain" : null,
        "additionalConfiguration" : null,
        "providerDescription" : null,
        "externalGroupsWhitelist" : [ ],
        "attributeMappings" : { },
        "addShadowUserOnLogin" : true,
        "storeCustomAttributes" : true,
        "ldapProfileFile" : "ldap/ldap-search-and-bind.xml",
        "baseUrl" : "ldap://localhost:23389",
        "referral" : null,
        "skipSSLVerification" : false,
        "userDNPattern" : null,
        "userDNPatternDelimiter" : null,
        "bindUserDn" : "cn=admin,ou=Users,dc=test,dc=com",
        "userSearchBase" : "dc=test,dc=com",
        "userSearchFilter" : "cn={0}",
        "passwordAttributeName" : null,
        "passwordEncoder" : null,
        "localPasswordCompare" : null,
        "mailAttributeName" : "mail",
        "mailSubstitute" : "{0}@my.org",
        "mailSubstituteOverridesLdap" : false,
        "ldapGroupFile" : "ldap/ldap-groups-map-to-scopes.xml",
        "groupSearchBase" : "ou=scopes,dc=test,dc=com",
        "groupSearchFilter" : "member={0}",
        "groupsIgnorePartialResults" : null,
        "autoAddGroups" : true,
        "groupSearchSubTree" : true,
        "maxGroupSearchDepth" : 3,
        "groupRoleAttribute" : null,
        "tlsConfiguration" : "none"
      },
      "id" : "e25969e0-918f-435e-974b-d1a8717f7aef",
      "originKey" : "ldap",
      "name" : "ldap name",
      "version" : 0,
      "created" : 1525217094660,
      "last_modified" : 1525217094660,
      "active" : true,
      "identityZoneId" : "2jncg4hg"
    }
    

    Request Headers

    Name Description
    Authorization Bearer token containing zones.<zone id>.admin or uaa.admin or idps.write (only in the same zone that you are a user of)
    X-Identity-Zone-Id May include this header to administer another zone if using zones.<zoneId>.admin or uaa.admin scope against the default UAA zone.
    X-Identity-Zone-Subdomain If using a zones.<zoneId>.admin scope/token, indicates what Identity Zone this request goes to by supplying a subdomain.

    Request Parameters

    Parameter Type Constraints Description
    rawConfig Boolean Optional (defaults to false) UAA 3.4.0 Flag indicating whether the response should use raw, unescaped JSON for the config field of the IDP, rather than the default behavior of encoding the JSON as a string.

    Request Fields

    Path Type Constraints Description
    name String Required Human-readable name for this provider
    config.providerDescription String Optional Human readable name/description of this provider
    config.emailDomain Array Optional List of email domains associated with the provider for the purpose of associating users to the correct origin upon invitation. If empty list, no invitations are accepted. Wildcards supported.
    active Boolean Optional Defaults to true.
    config.addShadowUserOnLogin Boolean Optional (defaults to true) Determines whether users should be allowed to authenticate without having a user pre-populated in the users database (if true), or whether shadow users must be created before login by an administrator (if false).
    config.storeCustomAttributes Boolean Optional (defaults to true) Set to true, to store custom user attributes to be fetched from the /userinfo endpoint
    type String Required ldap
    originKey String Required Origin key must be ldap for an LDAP provider
    config.ldapProfileFile String Required The file to be used for configuring the LDAP authentication. Options are: ldap/ldap-simple-bind.xml, ldap/ldap-search-and-bind.xml, ldap/ldap-search-and-compare.xml
    config.ldapGroupFile String Required The file to be used for group integration. Options are: ldap/ldap-groups-null.xml, ldap/ldap-groups-as-scopes.xml, ldap/ldap-groups-map-to-scopes.xml
    config.baseUrl String Required The URL to the ldap server, must start with ldap:// or ldaps://
    config.bindPassword String Required Used with search-and-bind and search-and-compare. Password for the LDAP ID that performs a search of the LDAP tree for user information.
    config.mailAttributeName String Optional (defaults to "mail") The name of the LDAP attribute that contains the user's email address
    config.mailSubstitute String Optional Defines an email pattern containing a {0} to generate an email address for an LDAP user during authentication
    config.mailSubstituteOverridesLdap Boolean Optional (defaults to false) Set to true if you wish to override an LDAP user email address with a generated one
    config.skipSSLVerification Boolean Optional (defaults to false) Skips validation of the LDAP cert if set to true.
    config.tlsConfiguration String Optional (defaults to "none") Sets the StartTLS options, valid values are none, simple or external
    config.referral String Optional (defaults to "follow") Configures the UAA LDAP referral behavior. The following values are possible:
    • follow → Referrals are followed
    • ignore → Referrals are ignored and the partial result is returned
    • throw → An error is thrown and the authentication is aborted
    Reference: http://docs.oracle.com/javase/jndi/tutorial/ldap/referral/jndi.html
    config.attributeMappings Object Optional Map external attribute to UAA recognized mappings.
    config.attributeMappings.user_name String Optional (defaults to "user_name") Map user_name to the attribute for user name in the provider assertion or token. The default for LDAP is the User Name filter
    config.attributeMappings.first_name String Optional (defaults to "givenname") Map given_name to the attribute for given name in the provider assertion or token.
    config.attributeMappings.family_name String Optional (defaults to "sn") Map family_name to the attribute for family name in the provider assertion or token.
    config.attributeMappings.phone_number String Optional (defaults to "telephonenumber") Map phone_number to the attribute for phone number in the provider assertion or token.
    config.bindPassword String Required Used with search-and-bind and search-and-compare. Password for the LDAP ID that performs a search of the LDAP tree for user information.

    Response Fields

    Path Type Constraints Description
    name String Required Human-readable name for this provider
    config.providerDescription String Optional Human readable name/description of this provider
    config.emailDomain Array Optional List of email domains associated with the provider for the purpose of associating users to the correct origin upon invitation. If empty list, no invitations are accepted. Wildcards supported.
    active Boolean Optional Defaults to true.
    config.addShadowUserOnLogin Boolean Optional (defaults to true) Determines whether users should be allowed to authenticate without having a user pre-populated in the users database (if true), or whether shadow users must be created before login by an administrator (if false).
    config.storeCustomAttributes Boolean Optional (defaults to true) Set to true, to store custom user attributes to be fetched from the /userinfo endpoint
    type String Required ldap
    originKey String Required Origin key must be ldap for an LDAP provider
    config.ldapProfileFile String Required The file to be used for configuring the LDAP authentication. Options are: ldap/ldap-simple-bind.xml, ldap/ldap-search-and-bind.xml, ldap/ldap-search-and-compare.xml
    config.ldapGroupFile String Required The file to be used for group integration. Options are: ldap/ldap-groups-null.xml, ldap/ldap-groups-as-scopes.xml, ldap/ldap-groups-map-to-scopes.xml
    config.baseUrl String Required The URL to the ldap server, must start with ldap:// or ldaps://
    config.bindPassword String Required Used with search-and-bind and search-and-compare. Password for the LDAP ID that performs a search of the LDAP tree for user information.
    config.mailAttributeName String Optional (defaults to "mail") The name of the LDAP attribute that contains the user's email address
    config.mailSubstitute String Optional Defines an email pattern containing a {0} to generate an email address for an LDAP user during authentication
    config.mailSubstituteOverridesLdap Boolean Optional (defaults to false) Set to true if you wish to override an LDAP user email address with a generated one
    config.skipSSLVerification Boolean Optional (defaults to false) Skips validation of the LDAP cert if set to true.
    config.tlsConfiguration String Optional (defaults to "none") Sets the StartTLS options, valid values are none, simple or external
    config.referral String Optional (defaults to "follow") Configures the UAA LDAP referral behavior. The following values are possible:
    • follow → Referrals are followed
    • ignore → Referrals are ignored and the partial result is returned
    • throw → An error is thrown and the authentication is aborted
    Reference: http://docs.oracle.com/javase/jndi/tutorial/ldap/referral/jndi.html
    config.attributeMappings Object Optional Map external attribute to UAA recognized mappings.
    config.attributeMappings.user_name String Optional (defaults to "user_name") Map user_name to the attribute for user name in the provider assertion or token. The default for LDAP is the User Name filter
    config.attributeMappings.first_name String Optional (defaults to "givenname") Map given_name to the attribute for given name in the provider assertion or token.
    config.attributeMappings.family_name String Optional (defaults to "sn") Map family_name to the attribute for family name in the provider assertion or token.
    config.attributeMappings.phone_number String Optional (defaults to "telephonenumber") Map phone_number to the attribute for phone number in the provider assertion or token.
    config.bindPassword String Required Used with search-and-bind and search-and-compare. Password for the LDAP ID that performs a search of the LDAP tree for user information.

    Error Codes

    Error Code Description
    401 Unauthorized - Missing or invalid token
    403 Forbidden - Insufficient scope
    409 Conflict - Provider with same origin and zone id exists
    422 Unprocessable Entity - Invalid configuration
    500 Internal Server Error

    LDAP Search and Compare

    $ curl 'http://localhost/identity-providers?rawConfig=true' -i -X POST \
        -H 'Content-Type: application/json' \
        -H 'X-Identity-Zone-Subdomain: 9ag5irj5' \
        -H 'Authorization: Bearer 44249eb937f546c488adba4233db285c' \
        -d '{
      "type" : "ldap",
      "config" : {
        "emailDomain" : null,
        "providerDescription" : null,
        "externalGroupsWhitelist" : [ ],
        "attributeMappings" : { },
        "addShadowUserOnLogin" : true,
        "storeCustomAttributes" : true,
        "ldapProfileFile" : "ldap/ldap-search-and-compare.xml",
        "baseUrl" : "ldap://localhost:23389",
        "referral" : null,
        "skipSSLVerification" : false,
        "userDNPattern" : null,
        "userDNPatternDelimiter" : null,
        "bindUserDn" : "cn=admin,ou=Users,dc=test,dc=com",
        "bindPassword" : "adminsecret",
        "userSearchBase" : "dc=test,dc=com",
        "userSearchFilter" : "cn={0}",
        "passwordAttributeName" : "userPassword",
        "passwordEncoder" : "org.cloudfoundry.identity.uaa.provider.ldap.DynamicPasswordComparator",
        "localPasswordCompare" : true,
        "mailAttributeName" : "mail",
        "mailSubstitute" : null,
        "mailSubstituteOverridesLdap" : false,
        "ldapGroupFile" : "ldap/ldap-groups-as-scopes.xml",
        "groupSearchBase" : "ou=scopes,dc=test,dc=com",
        "groupSearchFilter" : "member={0}",
        "groupsIgnorePartialResults" : null,
        "autoAddGroups" : true,
        "groupSearchSubTree" : true,
        "maxGroupSearchDepth" : 3,
        "groupRoleAttribute" : "description",
        "tlsConfiguration" : "none"
      },
      "originKey" : "ldap",
      "name" : "ldap name",
      "active" : true
    }'
    
    POST /identity-providers?rawConfig=true HTTP/1.1
    Content-Type: application/json
    X-Identity-Zone-Subdomain: 9ag5irj5
    Authorization: Bearer 44249eb937f546c488adba4233db285c
    Host: localhost
    Content-Length: 1338
    
    {
      "type" : "ldap",
      "config" : {
        "emailDomain" : null,
        "providerDescription" : null,
        "externalGroupsWhitelist" : [ ],
        "attributeMappings" : { },
        "addShadowUserOnLogin" : true,
        "storeCustomAttributes" : true,
        "ldapProfileFile" : "ldap/ldap-search-and-compare.xml",
        "baseUrl" : "ldap://localhost:23389",
        "referral" : null,
        "skipSSLVerification" : false,
        "userDNPattern" : null,
        "userDNPatternDelimiter" : null,
        "bindUserDn" : "cn=admin,ou=Users,dc=test,dc=com",
        "bindPassword" : "adminsecret",
        "userSearchBase" : "dc=test,dc=com",
        "userSearchFilter" : "cn={0}",
        "passwordAttributeName" : "userPassword",
        "passwordEncoder" : "org.cloudfoundry.identity.uaa.provider.ldap.DynamicPasswordComparator",
        "localPasswordCompare" : true,
        "mailAttributeName" : "mail",
        "mailSubstitute" : null,
        "mailSubstituteOverridesLdap" : false,
        "ldapGroupFile" : "ldap/ldap-groups-as-scopes.xml",
        "groupSearchBase" : "ou=scopes,dc=test,dc=com",
        "groupSearchFilter" : "member={0}",
        "groupsIgnorePartialResults" : null,
        "autoAddGroups" : true,
        "groupSearchSubTree" : true,
        "maxGroupSearchDepth" : 3,
        "groupRoleAttribute" : "description",
        "tlsConfiguration" : "none"
      },
      "originKey" : "ldap",
      "name" : "ldap name",
      "active" : true
    }
    
    HTTP/1.1 201 Created
    X-B3-TraceId: 98ab0ced-b115-4d61-afd6-9c191495c453
    Cache-Control: no-cache, no-store, max-age=0, must-revalidate
    Pragma: no-cache
    Expires: 0
    X-XSS-Protection: 1; mode=block
    X-Frame-Options: DENY
    X-Content-Type-Options: nosniff
    Content-Type: application/json;charset=UTF-8
    Content-Length: 1503
    
    {
      "type" : "ldap",
      "config" : {
        "emailDomain" : null,
        "additionalConfiguration" : null,
        "providerDescription" : null,
        "externalGroupsWhitelist" : [ ],
        "attributeMappings" : { },
        "addShadowUserOnLogin" : true,
        "storeCustomAttributes" : true,
        "ldapProfileFile" : "ldap/ldap-search-and-compare.xml",
        "baseUrl" : "ldap://localhost:23389",
        "referral" : null,
        "skipSSLVerification" : false,
        "userDNPattern" : null,
        "userDNPatternDelimiter" : null,
        "bindUserDn" : "cn=admin,ou=Users,dc=test,dc=com",
        "userSearchBase" : "dc=test,dc=com",
        "userSearchFilter" : "cn={0}",
        "passwordAttributeName" : "userPassword",
        "passwordEncoder" : "org.cloudfoundry.identity.uaa.provider.ldap.DynamicPasswordComparator",
        "localPasswordCompare" : true,
        "mailAttributeName" : "mail",
        "mailSubstitute" : null,
        "mailSubstituteOverridesLdap" : false,
        "ldapGroupFile" : "ldap/ldap-groups-as-scopes.xml",
        "groupSearchBase" : "ou=scopes,dc=test,dc=com",
        "groupSearchFilter" : "member={0}",
        "groupsIgnorePartialResults" : null,
        "autoAddGroups" : true,
        "groupSearchSubTree" : true,
        "maxGroupSearchDepth" : 3,
        "groupRoleAttribute" : "description",
        "tlsConfiguration" : "none"
      },
      "id" : "637d84c1-d08d-480b-ba8b-ac6d43036ae2",
      "originKey" : "ldap",
      "name" : "ldap name",
      "version" : 0,
      "created" : 1525217096695,
      "last_modified" : 1525217096695,
      "active" : true,
      "identityZoneId" : "9ag5irj5"
    }
    

    Request Headers

    Name Description
    Authorization Bearer token containing zones.<zone id>.admin or uaa.admin or idps.write (only in the same zone that you are a user of)
    X-Identity-Zone-Id May include this header to administer another zone if using zones.<zoneId>.admin or uaa.admin scope against the default UAA zone.
    X-Identity-Zone-Subdomain If using a zones.<zoneId>.admin scope/token, indicates what Identity Zone this request goes to by supplying a subdomain.

    Request Parameters

    Parameter Type Constraints Description
    rawConfig Boolean Optional (defaults to false) UAA 3.4.0 Flag indicating whether the response should use raw, unescaped JSON for the config field of the IDP, rather than the default behavior of encoding the JSON as a string.

    Request Fields

    Path Type Constraints Description
    name String Required Human-readable name for this provider
    config.providerDescription String Optional Human readable name/description of this provider
    config.emailDomain Array Optional List of email domains associated with the provider for the purpose of associating users to the correct origin upon invitation. If empty list, no invitations are accepted. Wildcards supported.
    active Boolean Optional Defaults to true.
    config.addShadowUserOnLogin Boolean Optional (defaults to true) Determines whether users should be allowed to authenticate without having a user pre-populated in the users database (if true), or whether shadow users must be created before login by an administrator (if false).
    config.storeCustomAttributes Boolean Optional (defaults to true) Set to true, to store custom user attributes to be fetched from the /userinfo endpoint
    type String Required ldap
    originKey String Required Origin key must be ldap for an LDAP provider
    config.ldapProfileFile String Required The file to be used for configuring the LDAP authentication. Options are: ldap/ldap-simple-bind.xml, ldap/ldap-search-and-bind.xml, ldap/ldap-search-and-compare.xml
    config.ldapGroupFile String Required The file to be used for group integration. Options are: ldap/ldap-groups-null.xml, ldap/ldap-groups-as-scopes.xml, ldap/ldap-groups-map-to-scopes.xml
    config.baseUrl String Required The URL to the ldap server, must start with ldap:// or ldaps://
    config.bindPassword String Required Used with search-and-bind and search-and-compare. Password for the LDAP ID that performs a search of the LDAP tree for user information.
    config.mailAttributeName String Optional (defaults to "mail") The name of the LDAP attribute that contains the user's email address
    config.mailSubstitute String Optional Defines an email pattern containing a {0} to generate an email address for an LDAP user during authentication
    config.mailSubstituteOverridesLdap Boolean Optional (defaults to false) Set to true if you wish to override an LDAP user email address with a generated one
    config.skipSSLVerification Boolean Optional (defaults to false) Skips validation of the LDAP cert if set to true.
    config.tlsConfiguration String Optional (defaults to "none") Sets the StartTLS options, valid values are none, simple or external
    config.referral String Optional (defaults to "follow") Configures the UAA LDAP referral behavior. The following values are possible:
    • follow → Referrals are followed
    • ignore → Referrals are ignored and the partial result is returned
    • throw → An error is thrown and the authentication is aborted
    Reference: http://docs.oracle.com/javase/jndi/tutorial/ldap/referral/jndi.html
    config.attributeMappings Object Optional Map external attribute to UAA recognized mappings.
    config.attributeMappings.user_name String Optional (defaults to "user_name") Map user_name to the attribute for user name in the provider assertion or token. The default for LDAP is the User Name filter
    config.attributeMappings.first_name String Optional (defaults to "givenname") Map given_name to the attribute for given name in the provider assertion or token.
    config.attributeMappings.family_name String Optional (defaults to "sn") Map family_name to the attribute for family name in the provider assertion or token.
    config.attributeMappings.phone_number String Optional (defaults to "telephonenumber") Map phone_number to the attribute for phone number in the provider assertion or token.

    Response Fields

    Path Type Constraints Description
    name String Required Human-readable name for this provider
    config.providerDescription String Optional Human readable name/description of this provider
    config.emailDomain Array Optional List of email domains associated with the provider for the purpose of associating users to the correct origin upon invitation. If empty list, no invitations are accepted. Wildcards supported.
    active Boolean Optional Defaults to true.
    config.addShadowUserOnLogin Boolean Optional (defaults to true) Determines whether users should be allowed to authenticate without having a user pre-populated in the users database (if true), or whether shadow users must be created before login by an administrator (if false).
    config.storeCustomAttributes Boolean Optional (defaults to true) Set to true, to store custom user attributes to be fetched from the /userinfo endpoint
    type String Required ldap
    originKey String Required Origin key must be ldap for an LDAP provider
    config.ldapProfileFile String Required The file to be used for configuring the LDAP authentication. Options are: ldap/ldap-simple-bind.xml, ldap/ldap-search-and-bind.xml, ldap/ldap-search-and-compare.xml
    config.ldapGroupFile String Required The file to be used for group integration. Options are: ldap/ldap-groups-null.xml, ldap/ldap-groups-as-scopes.xml, ldap/ldap-groups-map-to-scopes.xml
    config.baseUrl String Required The URL to the ldap server, must start with ldap:// or ldaps://
    config.bindPassword String Required Used with search-and-bind and search-and-compare. Password for the LDAP ID that performs a search of the LDAP tree for user information.
    config.mailAttributeName String Optional (defaults to "mail") The name of the LDAP attribute that contains the user's email address
    config.mailSubstitute String Optional Defines an email pattern containing a {0} to generate an email address for an LDAP user during authentication
    config.mailSubstituteOverridesLdap Boolean Optional (defaults to false) Set to true if you wish to override an LDAP user email address with a generated one
    config.skipSSLVerification Boolean Optional (defaults to false) Skips validation of the LDAP cert if set to true.
    config.tlsConfiguration String Optional (defaults to "none") Sets the StartTLS options, valid values are none, simple or external
    config.referral String Optional (defaults to "follow") Configures the UAA LDAP referral behavior. The following values are possible:
    • follow → Referrals are followed
    • ignore → Referrals are ignored and the partial result is returned
    • throw → An error is thrown and the authentication is aborted
    Reference: http://docs.oracle.com/javase/jndi/tutorial/ldap/referral/jndi.html
    config.attributeMappings Object Optional Map external attribute to UAA recognized mappings.
    config.attributeMappings.user_name String Optional (defaults to "user_name") Map user_name to the attribute for user name in the provider assertion or token. The default for LDAP is the User Name filter
    config.attributeMappings.first_name String Optional (defaults to "givenname") Map given_name to the attribute for given name in the provider assertion or token.
    config.attributeMappings.family_name String Optional (defaults to "sn") Map family_name to the attribute for family name in the provider assertion or token.
    config.attributeMappings.phone_number String Optional (defaults to "telephonenumber") Map phone_number to the attribute for phone number in the provider assertion or token.

    Error Codes

    Error Code Description
    401 Unauthorized - Missing or invalid token
    403 Forbidden - Insufficient scope
    409 Conflict - Provider with same origin and zone id exists
    422 Unprocessable Entity - Invalid configuration
    500 Internal Server Error

    OAuth/OIDC

    $ curl 'http://localhost/identity-providers?rawConfig=true' -i -X POST \
        -H 'Content-Type: application/json' \
        -H 'Authorization: Bearer 339c37aefdd04d9b9858272911d02418' \
        -d '{
      "type" : "oauth2.0",
      "config" : {
        "emailDomain" : null,
        "providerDescription" : null,
        "attributeMappings" : {
          "external_groups" : [ "roles" ],
          "user.attribute.department" : "department",
          "phone_number" : "telephone",
          "given_name" : "first_name",
          "family_name" : "last_name",
          "email" : "emailAddress"
        },
        "addShadowUserOnLogin" : true,
        "storeCustomAttributes" : true,
        "authUrl" : "http://auth.url",
        "tokenUrl" : "http://token.url",
        "tokenKeyUrl" : null,
        "tokenKey" : "token-key",
        "linkText" : null,
        "showLinkText" : false,
        "clientAuthInBody" : false,
        "skipSslValidation" : false,
        "relyingPartyId" : "uaa",
        "relyingPartySecret" : "secret",
        "scopes" : null,
        "issuer" : null,
        "responseType" : "code"
      },
      "originKey" : "my-oauth2-provider",
      "name" : "UAA Provider",
      "active" : true
    }'
    
    POST /identity-providers?rawConfig=true HTTP/1.1
    Content-Type: application/json
    Authorization: Bearer 339c37aefdd04d9b9858272911d02418
    Host: localhost
    Content-Length: 902
    
    {
      "type" : "oauth2.0",
      "config" : {
        "emailDomain" : null,
        "providerDescription" : null,
        "attributeMappings" : {
          "external_groups" : [ "roles" ],
          "user.attribute.department" : "department",
          "phone_number" : "telephone",
          "given_name" : "first_name",
          "family_name" : "last_name",
          "email" : "emailAddress"
        },
        "addShadowUserOnLogin" : true,
        "storeCustomAttributes" : true,
        "authUrl" : "http://auth.url",
        "tokenUrl" : "http://token.url",
        "tokenKeyUrl" : null,
        "tokenKey" : "token-key",
        "linkText" : null,
        "showLinkText" : false,
        "clientAuthInBody" : false,
        "skipSslValidation" : false,
        "relyingPartyId" : "uaa",
        "relyingPartySecret" : "secret",
        "scopes" : null,
        "issuer" : null,
        "responseType" : "code"
      },
      "originKey" : "my-oauth2-provider",
      "name" : "UAA Provider",
      "active" : true
    }
    
    HTTP/1.1 201 Created
    X-B3-TraceId: 1548028d-9690-474b-b9d2-09492e3f4f96
    Cache-Control: no-cache, no-store, max-age=0, must-revalidate
    Pragma: no-cache
    Expires: 0
    X-XSS-Protection: 1; mode=block
    X-Frame-Options: DENY
    X-Content-Type-Options: nosniff
    Content-Type: application/json;charset=UTF-8
    Content-Length: 1126
    
    {
      "type" : "oauth2.0",
      "config" : {
        "emailDomain" : null,
        "additionalConfiguration" : null,
        "providerDescription" : null,
        "externalGroupsWhitelist" : [ ],
        "attributeMappings" : {
          "external_groups" : [ "roles" ],
          "user.attribute.department" : "department",
          "phone_number" : "telephone",
          "given_name" : "first_name",
          "family_name" : "last_name",
          "email" : "emailAddress"
        },
        "addShadowUserOnLogin" : true,
        "storeCustomAttributes" : true,
        "authUrl" : "http://auth.url",
        "tokenUrl" : "http://token.url",
        "tokenKeyUrl" : null,
        "tokenKey" : "token-key",
        "linkText" : null,
        "showLinkText" : false,
        "clientAuthInBody" : false,
        "skipSslValidation" : false,
        "relyingPartyId" : "uaa",
        "scopes" : null,
        "issuer" : null,
        "responseType" : "code",
        "checkTokenUrl" : null
      },
      "id" : "d6a39944-ba22-43ca-b0ae-aaa34ff2c551",
      "originKey" : "my-oauth2-provider",
      "name" : "UAA Provider",
      "version" : 0,
      "created" : 1525217096083,
      "last_modified" : 1525217096083,
      "active" : true,
      "identityZoneId" : "uaa"
    }
    

    Request Headers

    Name Description
    Authorization Bearer token containing zones.<zone id>.admin or uaa.admin or idps.write (only in the same zone that you are a user of)
    X-Identity-Zone-Id May include this header to administer another zone if using zones.<zoneId>.admin or uaa.admin scope against the default UAA zone.
    X-Identity-Zone-Subdomain If using a zones.<zoneId>.admin scope/token, indicates what Identity Zone this request goes to by supplying a subdomain.

    Request Parameters

    Parameter Type Constraints Description
    rawConfig Boolean Optional (defaults to false) UAA 3.4.0 Flag indicating whether the response should use raw, unescaped JSON for the config field of the IDP, rather than the default behavior of encoding the JSON as a string.

    Request Fields

    Path Type Constraints Description
    name String Required Human-readable name for this provider
    config.providerDescription String Optional Human readable name/description of this provider
    config.emailDomain Array Optional List of email domains associated with the provider for the purpose of associating users to the correct origin upon invitation. If empty list, no invitations are accepted. Wildcards supported.
    active Boolean Optional Defaults to true.
    config.addShadowUserOnLogin Boolean Optional (defaults to true) Determines whether users should be allowed to authenticate without having a user pre-populated in the users database (if true), or whether shadow users must be created before login by an administrator (if false).
    config.storeCustomAttributes Boolean Optional (defaults to true) Set to true, to store custom user attributes to be fetched from the /userinfo endpoint
    type String Required "oauth2.0"
    originKey String Required A unique alias for a OAuth provider
    config.authUrl String Required The OAuth 2.0 authorization endpoint URL
    config.tokenUrl String Required The OAuth 2.0 token endpoint URL
    config.tokenKeyUrl String Optional The URL of the token key endpoint which renders a verification key for validating token signatures
    config.tokenKey String Optional A verification key for validating token signatures, set to null if a tokenKeyUrl is provided.
    config.showLinkText Boolean Optional (defaults to true) A flag controlling whether a link to this provider's login will be shown on the UAA login page
    config.linkText String Optional Text to use for the login link to the provider
    config.relyingPartyId String Required The client ID which is registered with the external OAuth provider for use by the UAA
    config.skipSslValidation Boolean Optional A flag controlling whether SSL validation should be skipped when communicating with the external OAuth server
    config.scopes Array Optional What scopes to request on a call to the external OAuth provider
    config.checkTokenUrl Object Optional Reserved for future OAuth use.
    config.responseType String Optional (defaults to "code") Response type for the authorize request, will be sent to OAuth server, defaults to code
    config.clientAuthInBody Boolean Optional (defaults to false) Sends the client credentials in the token retrieval call as body parameters instead of a Basic Authorization header.
    config.issuer String Optional The OAuth 2.0 token issuer. This value is used to validate the issuer inside the token.
    config.attributeMappings.user_name String Optional (defaults to "sub") Map user_name to the attribute for user name in the provider assertion or token. The default for OpenID Connect is sub
    config.attributeMappings Object Optional Map external attribute to UAA recognized mappings.
    config.attributeMappings.email String Optional Map email to the attribute for email in the provider assertion or token.
    config.attributeMappings.given_name String Optional Map given_name to the attribute for given name in the provider assertion or token.
    config.attributeMappings.family_name String Optional Map family_name to the attribute for family name in the provider assertion or token.
    config.attributeMappings.phone_number String Optional Map phone_number to the attribute for phone number in the provider assertion or token.
    config.attributeMappings.external_groups Array Optional Map external_groups to the attribute for groups in the provider assertion.
    config.attributeMappings['user.attribute.department'] String Optional Map external attribute to UAA recognized mappings. Mapping should be of the format user.attribute.<attribute_name>. department is used in the documentation as an example attribute.
    config.relyingPartySecret String Required The client secret of the relying party at the external OAuth provider

    Response Fields

    Path Type Constraints Description
    name String Required Human-readable name for this provider
    config.providerDescription String Optional Human readable name/description of this provider
    config.emailDomain Array Optional List of email domains associated with the provider for the purpose of associating users to the correct origin upon invitation. If empty list, no invitations are accepted. Wildcards supported.
    active Boolean Optional Defaults to true.
    config.addShadowUserOnLogin Boolean Optional (defaults to true) Determines whether users should be allowed to authenticate without having a user pre-populated in the users database (if true), or whether shadow users must be created before login by an administrator (if false).
    config.storeCustomAttributes Boolean Optional (defaults to true) Set to true, to store custom user attributes to be fetched from the /userinfo endpoint
    type String Required "oauth2.0"
    originKey String Required A unique alias for a OAuth provider
    config.authUrl String Required The OAuth 2.0 authorization endpoint URL
    config.tokenUrl String Required The OAuth 2.0 token endpoint URL
    config.tokenKeyUrl String Optional The URL of the token key endpoint which renders a verification key for validating token signatures
    config.tokenKey String Optional A verification key for validating token signatures, set to null if a tokenKeyUrl is provided.
    config.showLinkText Boolean Optional (defaults to true) A flag controlling whether a link to this provider's login will be shown on the UAA login page
    config.linkText String Optional Text to use for the login link to the provider
    config.relyingPartyId String Required The client ID which is registered with the external OAuth provider for use by the UAA
    config.skipSslValidation Boolean Optional A flag controlling whether SSL validation should be skipped when communicating with the external OAuth server
    config.scopes Array Optional What scopes to request on a call to the external OAuth provider
    config.checkTokenUrl Object Optional Reserved for future OAuth use.
    config.responseType String Optional (defaults to "code") Response type for the authorize request, will be sent to OAuth server, defaults to code
    config.clientAuthInBody Boolean Optional (defaults to false) Sends the client credentials in the token retrieval call as body parameters instead of a Basic Authorization header.
    config.issuer String Optional The OAuth 2.0 token issuer. This value is used to validate the issuer inside the token.
    config.attributeMappings.user_name String Optional (defaults to "sub") Map user_name to the attribute for user name in the provider assertion or token. The default for OpenID Connect is sub
    config.attributeMappings Object Optional Map external attribute to UAA recognized mappings.
    config.attributeMappings.email String Optional Map email to the attribute for email in the provider assertion or token.
    config.attributeMappings.given_name String Optional Map given_name to the attribute for given name in the provider assertion or token.
    config.attributeMappings.family_name String Optional Map family_name to the attribute for family name in the provider assertion or token.
    config.attributeMappings.phone_number String Optional Map phone_number to the attribute for phone number in the provider assertion or token.
    config.attributeMappings.external_groups Array Optional Map external_groups to the attribute for groups in the provider assertion.
    config.attributeMappings['user.attribute.department'] String Optional Map external attribute to UAA recognized mappings. Mapping should be of the format user.attribute.<attribute_name>. department is used in the documentation as an example attribute.
    config.relyingPartySecret String Required The client secret of the relying party at the external OAuth provider

    Error Codes

    Error Code Description
    403 Forbidden - Insufficient scope
    409 Conflict - Provider with same origin and zone id exists
    422 Unprocessable Entity - Invalid configuration
    500 Internal Server Error
    $ curl 'http://localhost/identity-providers?rawConfig=true' -i -X POST \
        -H 'Content-Type: application/json' \
        -H 'Authorization: Bearer 4bbbbeab2ff84188be028ac75c1e2a28' \
        -d '{
      "type" : "oidc1.0",
      "config" : {
        "emailDomain" : null,
        "providerDescription" : null,
        "externalGroupsWhitelist" : [ "uaa.user" ],
        "attributeMappings" : {
          "external_groups" : [ "roles" ],
          "user.attribute.department" : "department",
          "phone_number" : "telephone",
          "given_name" : "first_name",
          "family_name" : "last_name",
          "email" : "emailAddress"
        },
        "addShadowUserOnLogin" : true,
        "storeCustomAttributes" : true,
        "authUrl" : null,
        "tokenUrl" : null,
        "tokenKeyUrl" : null,
        "tokenKey" : null,
        "linkText" : null,
        "showLinkText" : false,
        "clientAuthInBody" : false,
        "skipSslValidation" : true,
        "relyingPartyId" : "uaa",
        "relyingPartySecret" : "secret",
        "scopes" : null,
        "issuer" : null,
        "responseType" : "code",
        "userInfoUrl" : null,
        "discoveryUrl" : "https://accounts.google.com/.well-known/openid-configuration"
      },
      "originKey" : "my-oidc-provider-mtxnai",
      "name" : "UAA Provider",
      "active" : true
    }'
    
    POST /identity-providers?rawConfig=true HTTP/1.1
    Content-Type: application/json
    Authorization: Bearer 4bbbbeab2ff84188be028ac75c1e2a28
    Host: localhost
    Content-Length: 1030
    
    {
      "type" : "oidc1.0",
      "config" : {
        "emailDomain" : null,
        "providerDescription" : null,
        "externalGroupsWhitelist" : [ "uaa.user" ],
        "attributeMappings" : {
          "external_groups" : [ "roles" ],
          "user.attribute.department" : "department",
          "phone_number" : "telephone",
          "given_name" : "first_name",
          "family_name" : "last_name",
          "email" : "emailAddress"
        },
        "addShadowUserOnLogin" : true,
        "storeCustomAttributes" : true,
        "authUrl" : null,
        "tokenUrl" : null,
        "tokenKeyUrl" : null,
        "tokenKey" : null,
        "linkText" : null,
        "showLinkText" : false,
        "clientAuthInBody" : false,
        "skipSslValidation" : true,
        "relyingPartyId" : "uaa",
        "relyingPartySecret" : "secret",
        "scopes" : null,
        "issuer" : null,
        "responseType" : "code",
        "userInfoUrl" : null,
        "discoveryUrl" : "https://accounts.google.com/.well-known/openid-configuration"
      },
      "originKey" : "my-oidc-provider-mtxnai",
      "name" : "UAA Provider",
      "active" : true
    }
    
    HTTP/1.1 201 Created
    X-B3-TraceId: ffd5b65a-9fb0-47d4-8ce2-b9efb6f00af7
    Cache-Control: no-cache, no-store, max-age=0, must-revalidate
    Pragma: no-cache
    Expires: 0
    X-XSS-Protection: 1; mode=block
    X-Frame-Options: DENY
    X-Content-Type-Options: nosniff
    Content-Type: application/json;charset=UTF-8
    Content-Length: 1189
    
    {
      "type" : "oidc1.0",
      "config" : {
        "emailDomain" : null,
        "additionalConfiguration" : null,
        "providerDescription" : null,
        "externalGroupsWhitelist" : [ "uaa.user" ],
        "attributeMappings" : {
          "external_groups" : [ "roles" ],
          "user.attribute.department" : "department",
          "phone_number" : "telephone",
          "given_name" : "first_name",
          "family_name" : "last_name",
          "email" : "emailAddress"
        },
        "addShadowUserOnLogin" : true,
        "storeCustomAttributes" : true,
        "authUrl" : null,
        "tokenUrl" : null,
        "tokenKeyUrl" : null,
        "tokenKey" : null,
        "linkText" : null,
        "showLinkText" : false,
        "clientAuthInBody" : false,
        "skipSslValidation" : true,
        "relyingPartyId" : "uaa",
        "scopes" : null,
        "issuer" : null,
        "responseType" : "code",
        "userInfoUrl" : null,
        "discoveryUrl" : "https://accounts.google.com/.well-known/openid-configuration"
      },
      "id" : "afdffc59-f610-45b0-b1e3-f0c4838f2109",
      "originKey" : "my-oidc-provider-mtxnai",
      "name" : "UAA Provider",
      "version" : 0,
      "created" : 1525217096189,
      "last_modified" : 1525217096189,
      "active" : true,
      "identityZoneId" : "uaa"
    }
    

    Request Headers

    Name Description
    Authorization Bearer token containing zones.<zone id>.admin or uaa.admin or idps.write (only in the same zone that you are a user of)
    X-Identity-Zone-Id May include this header to administer another zone if using zones.<zoneId>.admin or uaa.admin scope against the default UAA zone.
    X-Identity-Zone-Subdomain If using a zones.<zoneId>.admin scope/token, indicates what Identity Zone this request goes to by supplying a subdomain.

    Request Parameters

    Parameter Type Constraints Description
    rawConfig Boolean Optional (defaults to false) UAA 3.4.0 Flag indicating whether the response should use raw, unescaped JSON for the config field of the IDP, rather than the default behavior of encoding the JSON as a string.

    Request Fields

    Path Type Constraints Description
    name String Required Human-readable name for this provider
    config.providerDescription String Optional Human readable name/description of this provider
    config.emailDomain Array Optional List of email domains associated with the provider for the purpose of associating users to the correct origin upon invitation. If empty list, no invitations are accepted. Wildcards supported.
    active Boolean Optional Defaults to true.
    config.addShadowUserOnLogin Boolean Optional (defaults to true) Determines whether users should be allowed to authenticate without having a user pre-populated in the users database (if true), or whether shadow users must be created before login by an administrator (if false).
    config.storeCustomAttributes Boolean Optional (defaults to true) Set to true, to store custom user attributes to be fetched from the /userinfo endpoint
    type String Required "oidc1.0"
    originKey String Required A unique alias for the OIDC 1.0 provider
    config.discoveryUrl String Optional The OpenID Connect Discovery URL, typically ends with /.well-known/openid-configurationmit
    config.authUrl String Required unless discoveryUrl is set. The OIDC 1.0 authorization endpoint URL. This can be left blank if a discovery URL is provided. If both are provided, this property overrides the discovery URL.
    config.tokenUrl String Required unless discoveryUrl is set. The OIDC 1.0 token endpoint URL. This can be left blank if a discovery URL is provided. If both are provided, this property overrides the discovery URL.
    config.tokenKeyUrl String Required unless discoveryUrl is set. The URL of the token key endpoint which renders a verification key for validating token signatures. This can be left blank if a discovery URL is provided. If both are provided, this property overrides the discovery URL.
    config.tokenKey String Required unless discoveryUrl is set. A verification key for validating token signatures. We recommend not setting this as it will not allow for key rotation. This can be left blank if a discovery URL is provided. If both are provided, this property overrides the discovery URL.
    config.showLinkText Boolean Optional (defaults to true) A flag controlling whether a link to this provider's login will be shown on the UAA login page
    config.linkText String Optional Text to use for the login link to the provider
    config.relyingPartyId String Required The client ID which is registered with the external OAuth provider for use by the UAA
    config.skipSslValidation Boolean Optional A flag controlling whether SSL validation should be skipped when communicating with the external OAuth server
    config.scopes Array Optional What scopes to request on a call to the external OAuth/OpenID provider. For example, can provide openid, roles, or profile to request ID token, scopes populated in the ID token external groups attribute mappings, or the user profile information, respectively.
    config.checkTokenUrl Object Optional Reserved for future OAuth/OIDC use.
    config.clientAuthInBody Boolean Optional (defaults to false) Sends the client credentials in the token retrieval call as body parameters instead of a Basic Authorization header.
    config.userInfoUrl Object Optional Reserved for future OIDC use. This can be left blank if a discovery URL is provided. If both are provided, this property overrides the discovery URL.
    config.responseType String Optional (defaults to "code") Response type for the authorize request, defaults to code, but can be code id_token if the OIDC server can return an id_token as a query parameter in the redirect.
    config.issuer String Optional The OAuth 2.0 token issuer. This value is used to validate the issuer inside the token.
    config.externalGroupsWhitelist Array Optional JSON Array containing the groups names which need to be populated in the user's id_token or response from /userinfo endpoint. If you don't specify the whitelist no groups will be populated in the id_token or /userinfo response.
    Please note that regex is allowed. Acceptable patterns are
    • * translates to all groups
    • *pattern* Contains pattern
    • pattern* Starts with pattern
    • *pattern Ends with pattern
    config.attributeMappings.user_name String Optional (defaults to "sub") Map user_name to the attribute for user name in the provider assertion or token. The default for OpenID Connect is sub.
    config.attributeMappings Object Optional Map external attribute to UAA recognized mappings.
    config.attributeMappings.email String Optional Map email to the attribute for email in the provider assertion or token.
    config.attributeMappings.given_name String Optional Map given_name to the attribute for given name in the provider assertion or token.
    config.attributeMappings.family_name String Optional Map family_name to the attribute for family name in the provider assertion or token.
    config.attributeMappings.phone_number String Optional Map phone_number to the attribute for phone number in the provider assertion or token.
    config.attributeMappings.external_groups Array Optional Map external_groups to the attribute for groups in the provider assertion.
    config.attributeMappings['user.attribute.department'] String Optional Map external attribute to UAA recognized mappings. Mapping should be of the format user.attribute.<attribute_name>. department is used in the documentation as an example attribute.
    config.relyingPartySecret String Required The client secret of the relying party at the external OAuth provider

    Response Fields

    Path Type Constraints Description
    name String Required Human-readable name for this provider
    config.providerDescription String Optional Human readable name/description of this provider
    config.emailDomain Array Optional List of email domains associated with the provider for the purpose of associating users to the correct origin upon invitation. If empty list, no invitations are accepted. Wildcards supported.
    active Boolean Optional Defaults to true.
    config.addShadowUserOnLogin Boolean Optional (defaults to true) Determines whether users should be allowed to authenticate without having a user pre-populated in the users database (if true), or whether shadow users must be created before login by an administrator (if false).
    config.storeCustomAttributes Boolean Optional (defaults to true) Set to true, to store custom user attributes to be fetched from the /userinfo endpoint
    type String Required "oidc1.0"
    originKey String Required A unique alias for the OIDC 1.0 provider
    config.discoveryUrl String Optional The OpenID Connect Discovery URL, typically ends with /.well-known/openid-configurationmit
    config.authUrl String Required unless discoveryUrl is set. The OIDC 1.0 authorization endpoint URL. This can be left blank if a discovery URL is provided. If both are provided, this property overrides the discovery URL.
    config.tokenUrl String Required unless discoveryUrl is set. The OIDC 1.0 token endpoint URL. This can be left blank if a discovery URL is provided. If both are provided, this property overrides the discovery URL.
    config.tokenKeyUrl String Required unless discoveryUrl is set. The URL of the token key endpoint which renders a verification key for validating token signatures. This can be left blank if a discovery URL is provided. If both are provided, this property overrides the discovery URL.
    config.tokenKey String Required unless discoveryUrl is set. A verification key for validating token signatures. We recommend not setting this as it will not allow for key rotation. This can be left blank if a discovery URL is provided. If both are provided, this property overrides the discovery URL.
    config.showLinkText Boolean Optional (defaults to true) A flag controlling whether a link to this provider's login will be shown on the UAA login page
    config.linkText String Optional Text to use for the login link to the provider
    config.relyingPartyId String Required The client ID which is registered with the external OAuth provider for use by the UAA
    config.skipSslValidation Boolean Optional A flag controlling whether SSL validation should be skipped when communicating with the external OAuth server
    config.scopes Array Optional What scopes to request on a call to the external OAuth/OpenID provider. For example, can provide openid, roles, or profile to request ID token, scopes populated in the ID token external groups attribute mappings, or the user profile information, respectively.
    config.checkTokenUrl Object Optional Reserved for future OAuth/OIDC use.
    config.clientAuthInBody Boolean Optional (defaults to false) Sends the client credentials in the token retrieval call as body parameters instead of a Basic Authorization header.
    config.userInfoUrl Object Optional Reserved for future OIDC use. This can be left blank if a discovery URL is provided. If both are provided, this property overrides the discovery URL.
    config.responseType String Optional (defaults to "code") Response type for the authorize request, defaults to code, but can be code id_token if the OIDC server can return an id_token as a query parameter in the redirect.
    config.issuer String Optional The OAuth 2.0 token issuer. This value is used to validate the issuer inside the token.
    config.externalGroupsWhitelist Array Optional JSON Array containing the groups names which need to be populated in the user's id_token or response from /userinfo endpoint. If you don't specify the whitelist no groups will be populated in the id_token or /userinfo response.
    Please note that regex is allowed. Acceptable patterns are
    • * translates to all groups
    • *pattern* Contains pattern
    • pattern* Starts with pattern
    • *pattern Ends with pattern
    config.attributeMappings.user_name String Optional (defaults to "sub") Map user_name to the attribute for user name in the provider assertion or token. The default for OpenID Connect is sub.
    config.attributeMappings Object Optional Map external attribute to UAA recognized mappings.
    config.attributeMappings.email String Optional Map email to the attribute for email in the provider assertion or token.
    config.attributeMappings.given_name String Optional Map given_name to the attribute for given name in the provider assertion or token.
    config.attributeMappings.family_name String Optional Map family_name to the attribute for family name in the provider assertion or token.
    config.attributeMappings.phone_number String Optional Map phone_number to the attribute for phone number in the provider assertion or token.
    config.attributeMappings.external_groups Array Optional Map external_groups to the attribute for groups in the provider assertion.
    config.attributeMappings['user.attribute.department'] String Optional Map external attribute to UAA recognized mappings. Mapping should be of the format user.attribute.<attribute_name>. department is used in the documentation as an example attribute.
    config.relyingPartySecret String Required The client secret of the relying party at the external OAuth provider

    Error Codes

    Error Code Description
    403 Forbidden - Insufficient scope
    409 Conflict - Provider with same origin and zone id exists
    422 Unprocessable Entity - Invalid configuration
    500 Internal Server Error

    Retrieve All

    $ curl 'http://localhost/identity-providers?rawConfig=false' -i \
        -H 'Content-Type: application/json' \
        -H 'Authorization: Bearer 0d611a8a720542549ad4b0bf82d41e42'
    
    GET /identity-providers?rawConfig=false HTTP/1.1
    Content-Type: application/json
    Authorization: Bearer 0d611a8a720542549ad4b0bf82d41e42
    Host: localhost
    
    
    HTTP/1.1 200 OK
    X-B3-TraceId: a4b89d85-cf93-4f95-aec0-75c0e271f6a7
    Cache-Control: no-cache, no-store, max-age=0, must-revalidate
    Pragma: no-cache
    Expires: 0
    X-XSS-Protection: 1; mode=block
    X-Frame-Options: DENY
    X-Content-Type-Options: nosniff
    Content-Type: application/json;charset=UTF-8
    Content-Length: 8084
    
    [ {
      "type" : "saml",
      "config" : "{\"emailDomain\":null,\"additionalConfiguration\":null,\"providerDescription\":null,\"externalGroupsWhitelist\":[],\"attributeMappings\":{\"external_groups\":[\"roles\"],\"user.attribute.department\":\"department\",\"phone_number\":\"telephone\",\"given_name\":\"first_name\",\"family_name\":\"last_name\",\"email\":\"emailAddress\"},\"addShadowUserOnLogin\":true,\"storeCustomAttributes\":true,\"metaDataLocation\":\"<?xml version=\\\"1.0\\\" encoding=\\\"UTF-8\\\"?><md:EntityDescriptor xmlns:md=\\\"urn:oasis:names:tc:SAML:2.0:metadata\\\" entityID=\\\"http://www.okta.com/SAML\\\"><md:IDPSSODescriptor WantAuthnRequestsSigned=\\\"true\\\" protocolSupportEnumeration=\\\"urn:oasis:names:tc:SAML:2.0:protocol\\\"><md:KeyDescriptor use=\\\"signing\\\"><ds:KeyInfo xmlns:ds=\\\"http://www.w3.org/2000/09/xmldsig#\\\"><ds:X509Data><ds:X509Certificate>MIICmTCCAgKgAwIBAgIGAUPATqmEMA0GCSqGSIb3DQEBBQUAMIGPMQswCQYDVQQGEwJVUzETMBEG\\nA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzENMAsGA1UECgwET2t0YTEU\\nMBIGA1UECwwLU1NPUHJvdmlkZXIxEDAOBgNVBAMMB1Bpdm90YWwxHDAaBgkqhkiG9w0BCQEWDWlu\\nZm9Ab2t0YS5jb20wHhcNMTQwMTIzMTgxMjM3WhcNNDQwMTIzMTgxMzM3WjCBjzELMAkGA1UEBhMC\\nVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xDTALBgNVBAoM\\nBE9rdGExFDASBgNVBAsMC1NTT1Byb3ZpZGVyMRAwDgYDVQQDDAdQaXZvdGFsMRwwGgYJKoZIhvcN\\nAQkBFg1pbmZvQG9rdGEuY29tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCeil67/TLOiTZU\\nWWgW2XEGgFZ94bVO90v5J1XmcHMwL8v5Z/8qjdZLpGdwI7Ph0CyXMMNklpaR/Ljb8fsls3amdT5O\\nBw92Zo8ulcpjw2wuezTwL0eC0wY/GQDAZiXL59npE6U+fH1lbJIq92hx0HJSru/0O1q3+A/+jjZL\\n3tL/SwIDAQABMA0GCSqGSIb3DQEBBQUAA4GBAI5BoWZoH6Mz9vhypZPOJCEKa/K+biZQsA4Zqsuk\\nvvphhSERhqk/Nv76Vkl8uvJwwHbQrR9KJx4L3PRkGCG24rix71jEuXVGZUsDNM3CUKnARx4MEab6\\nGFHNkZ6DmoT/PFagngecHu+EwmuDtaG0rEkFrARwe+d8Ru0BN558abFb</ds:X509Certificate></ds:X509Data></ds:KeyInfo></md:KeyDescriptor><md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</md:NameIDFormat><md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</md:NameIDFormat><md:SingleSignOnService Binding=\\\"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST\\\" Location=\\\"https://pivotal.oktapreview.com/app/pivotal_pivotalcfstaging_1/k2lw4l5bPODCMIIDBRYZ/sso/saml\\\"/><md:SingleSignOnService Binding=\\\"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect\\\" Location=\\\"https://pivotal.oktapreview.com/app/pivotal_pivotalcfstaging_1/k2lw4l5bPODCMIIDBRYZ/sso/saml\\\"/></md:IDPSSODescriptor></md:EntityDescriptor>\\n\",\"idpEntityAlias\":\"SAML\",\"zoneId\":\"uaa\",\"nameID\":\"urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress\",\"assertionConsumerIndex\":0,\"metadataTrustCheck\":false,\"showSamlLink\":false,\"linkText\":\"IDPEndpointsMockTests Saml Provider:SAML\",\"iconUrl\":null,\"groupMappingMode\":\"EXPLICITLY_MAPPED\",\"skipSslValidation\":false,\"authnContext\":null,\"socketFactoryClassName\":null}",
      "id" : "47aed27d-8ac9-407c-9b3b-867244e0cc70",
      "originKey" : "SAML",
      "name" : "SAML name",
      "version" : 0,
      "created" : 1525217092688,
      "last_modified" : 1525217092688,
      "active" : true,
      "identityZoneId" : "uaa"
    }, {
      "type" : "saml",
      "config" : "{\"emailDomain\":null,\"additionalConfiguration\":null,\"providerDescription\":null,\"externalGroupsWhitelist\":[],\"attributeMappings\":{},\"addShadowUserOnLogin\":true,\"storeCustomAttributes\":true,\"metaDataLocation\":\"http://simplesamlphp.cfapps.io/saml2/idp/metadata.php\",\"idpEntityAlias\":\"SAMLMetadataUrl\",\"zoneId\":\"uaa\",\"nameID\":\"urn:oasis:names:tc:SAML:1.1:nameid-format:transient\",\"assertionConsumerIndex\":0,\"metadataTrustCheck\":false,\"showSamlLink\":false,\"linkText\":\"IDPEndpointsMockTests Saml Provider:SAML\",\"iconUrl\":null,\"groupMappingMode\":\"EXPLICITLY_MAPPED\",\"skipSslValidation\":false,\"authnContext\":null,\"socketFactoryClassName\":null}",
      "id" : "2ffe62da-992d-44f3-ba8b-76d2aca17794",
      "originKey" : "SAMLMetadataUrl",
      "name" : "SAML name",
      "version" : 0,
      "created" : 1525217093151,
      "last_modified" : 1525217093151,
      "active" : true,
      "identityZoneId" : "uaa"
    }, {
      "type" : "keystone",
      "config" : "null",
      "id" : "a2b999a6-a72f-41cc-ae1e-4d09264c9f60",
      "originKey" : "keystone",
      "name" : "keystone",
      "version" : 0,
      "created" : 946684800000,
      "last_modified" : 946684800000,
      "active" : true,
      "identityZoneId" : "uaa"
    }, {
      "type" : "ldap",
      "config" : "{\"emailDomain\":null,\"additionalConfiguration\":null,\"providerDescription\":null,\"externalGroupsWhitelist\":[],\"attributeMappings\":{},\"addShadowUserOnLogin\":true,\"storeCustomAttributes\":true,\"ldapProfileFile\":null,\"baseUrl\":null,\"referral\":null,\"skipSSLVerification\":false,\"userDNPattern\":null,\"userDNPatternDelimiter\":null,\"bindUserDn\":null,\"userSearchBase\":null,\"userSearchFilter\":null,\"passwordAttributeName\":null,\"passwordEncoder\":null,\"localPasswordCompare\":null,\"mailAttributeName\":\"mail\",\"mailSubstitute\":null,\"mailSubstituteOverridesLdap\":false,\"ldapGroupFile\":null,\"groupSearchBase\":null,\"groupSearchFilter\":null,\"groupsIgnorePartialResults\":null,\"autoAddGroups\":true,\"groupSearchSubTree\":true,\"maxGroupSearchDepth\":10,\"groupRoleAttribute\":null,\"tlsConfiguration\":\"none\"}",
      "id" : "9eff6396-a0ef-429f-b8ca-a3b84a3d882f",
      "originKey" : "ldap",
      "name" : "UAA LDAP Provider",
      "version" : 1,
      "created" : 946684800000,
      "last_modified" : 1525217067689,
      "active" : false,
      "identityZoneId" : "uaa"
    }, {
      "type" : "login-server",
      "config" : "null",
      "id" : "db193d8f-b26d-4c7b-9b37-4350c240e6d5",
      "originKey" : "login-server",
      "name" : "login-server",
      "version" : 0,
      "created" : 946684800000,
      "last_modified" : 946684800000,
      "active" : true,
      "identityZoneId" : "uaa"
    }, {
      "type" : "oauth2.0",
      "config" : "{\"emailDomain\":null,\"additionalConfiguration\":null,\"providerDescription\":null,\"externalGroupsWhitelist\":[],\"attributeMappings\":{\"external_groups\":[\"roles\"],\"user.attribute.department\":\"department\",\"phone_number\":\"telephone\",\"given_name\":\"first_name\",\"family_name\":\"last_name\",\"email\":\"emailAddress\"},\"addShadowUserOnLogin\":true,\"storeCustomAttributes\":true,\"authUrl\":\"http://auth.url\",\"tokenUrl\":\"http://token.url\",\"tokenKeyUrl\":null,\"tokenKey\":\"token-key\",\"linkText\":null,\"showLinkText\":false,\"clientAuthInBody\":false,\"skipSslValidation\":false,\"relyingPartyId\":\"uaa\",\"scopes\":null,\"issuer\":null,\"responseType\":\"code\",\"checkTokenUrl\":null}",
      "id" : "d6a39944-ba22-43ca-b0ae-aaa34ff2c551",
      "originKey" : "my-oauth2-provider",
      "name" : "UAA Provider",
      "version" : 0,
      "created" : 1525217096083,
      "last_modified" : 1525217096083,
      "active" : true,
      "identityZoneId" : "uaa"
    }, {
      "type" : "oidc1.0",
      "config" : "{\"emailDomain\":null,\"additionalConfiguration\":null,\"providerDescription\":null,\"externalGroupsWhitelist\":[\"uaa.user\"],\"attributeMappings\":{\"external_groups\":[\"roles\"],\"user.attribute.department\":\"department\",\"phone_number\":\"telephone\",\"given_name\":\"first_name\",\"family_name\":\"last_name\",\"email\":\"emailAddress\"},\"addShadowUserOnLogin\":true,\"storeCustomAttributes\":true,\"authUrl\":null,\"tokenUrl\":null,\"tokenKeyUrl\":null,\"tokenKey\":null,\"linkText\":null,\"showLinkText\":false,\"clientAuthInBody\":false,\"skipSslValidation\":true,\"relyingPartyId\":\"uaa\",\"scopes\":null,\"issuer\":null,\"responseType\":\"code\",\"userInfoUrl\":null,\"discoveryUrl\":\"https://accounts.google.com/.well-known/openid-configuration\"}",
      "id" : "afdffc59-f610-45b0-b1e3-f0c4838f2109",
      "originKey" : "my-oidc-provider-mtxnai",
      "name" : "UAA Provider",
      "version" : 0,
      "created" : 1525217096189,
      "last_modified" : 1525217096189,
      "active" : true,
      "identityZoneId" : "uaa"
    }, {
      "type" : "uaa",
      "config" : "null",
      "id" : "92d4eeff-905e-4064-abe5-19840d2eb892",
      "originKey" : "uaa",
      "name" : "uaa",
      "version" : 3,
      "created" : 946684800000,
      "last_modified" : 1525217096284,
      "active" : true,
      "identityZoneId" : "uaa"
    } ]
    

    Request Headers

    Name Description
    Authorization Bearer token containing zones.<zone id>.admin or zones.<zone id>.idps.read or uaa.admin or idps.read (only in the same zone that you are a user of)
    X-Identity-Zone-Id May include this header to administer another zone if using zones.<zoneId>.admin or zones.<zone id>.idps.read or uaa.admin scope against the default UAA zone.
    X-Identity-Zone-Subdomain If using a zones.<zoneId>.admin scope/token, indicates what Identity Zone this request goes to by supplying a subdomain.

    Request Parameters

    Parameter Type Constraints Description
    rawConfig Boolean Optional (defaults to false) UAA 3.4.0 Flag indicating whether the response should use raw, unescaped JSON for the config field of the IDP, rather than the default behavior of encoding the JSON as a string.

    Response Fields

    Path Type Description
    [].type String Type of the identity provider.
    [].originKey String Unique identifier for the identity provider.
    [].name String Human-readable name for this provider
    [].config String Json config for the Identity Provider
    [].version Number Version of the identity provider data. Clients can use this to protect against conflicting updates
    [].active Boolean Defaults to true.
    [].id String Unique identifier for this provider - GUID generated by the UAA
    [].identityZoneId String Set to the zone that this provider will be active in. Determined either by the Host header or the zone switch header.
    [].created Number UAA sets the creation date
    [].last_modified Number UAA sets the modification date

    Error Codes

    Error Code Description
    403 Forbidden - Insufficient scope

    Retrieve

    $ curl 'http://localhost/identity-providers/9ae5be45-615e-42d8-904b-f75c63232305?rawConfig=false' -i \
        -H 'Content-Type: application/json' \
        -H 'Authorization: Bearer 68a735d02a5b46bf967e15d4bcd47c5b'
    
    GET /identity-providers/9ae5be45-615e-42d8-904b-f75c63232305?rawConfig=false HTTP/1.1
    Content-Type: application/json
    Authorization: Bearer 68a735d02a5b46bf967e15d4bcd47c5b
    Host: localhost
    
    
    HTTP/1.1 200 OK
    X-B3-TraceId: 15a792a6-cd71-4e47-97a8-98052a33b277
    Cache-Control: no-cache, no-store, max-age=0, must-revalidate
    Pragma: no-cache
    Expires: 0
    X-XSS-Protection: 1; mode=block
    X-Frame-Options: DENY
    X-Content-Type-Options: nosniff
    Content-Type: application/json;charset=UTF-8
    Content-Length: 3170
    
    {
      "type" : "saml",
      "config" : "{\"emailDomain\":null,\"additionalConfiguration\":null,\"providerDescription\":null,\"externalGroupsWhitelist\":[],\"attributeMappings\":{\"external_groups\":[\"roles\"],\"user.attribute.department\":\"department\",\"phone_number\":\"telephone\",\"given_name\":\"first_name\",\"family_name\":\"last_name\",\"email\":\"emailAddress\"},\"addShadowUserOnLogin\":true,\"storeCustomAttributes\":true,\"metaDataLocation\":\"<?xml version=\\\"1.0\\\" encoding=\\\"UTF-8\\\"?><md:EntityDescriptor xmlns:md=\\\"urn:oasis:names:tc:SAML:2.0:metadata\\\" entityID=\\\"http://www.okta.com/saml-for-get\\\"><md:IDPSSODescriptor WantAuthnRequestsSigned=\\\"true\\\" protocolSupportEnumeration=\\\"urn:oasis:names:tc:SAML:2.0:protocol\\\"><md:KeyDescriptor use=\\\"signing\\\"><ds:KeyInfo xmlns:ds=\\\"http://www.w3.org/2000/09/xmldsig#\\\"><ds:X509Data><ds:X509Certificate>MIICmTCCAgKgAwIBAgIGAUPATqmEMA0GCSqGSIb3DQEBBQUAMIGPMQswCQYDVQQGEwJVUzETMBEG\\nA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzENMAsGA1UECgwET2t0YTEU\\nMBIGA1UECwwLU1NPUHJvdmlkZXIxEDAOBgNVBAMMB1Bpdm90YWwxHDAaBgkqhkiG9w0BCQEWDWlu\\nZm9Ab2t0YS5jb20wHhcNMTQwMTIzMTgxMjM3WhcNNDQwMTIzMTgxMzM3WjCBjzELMAkGA1UEBhMC\\nVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xDTALBgNVBAoM\\nBE9rdGExFDASBgNVBAsMC1NTT1Byb3ZpZGVyMRAwDgYDVQQDDAdQaXZvdGFsMRwwGgYJKoZIhvcN\\nAQkBFg1pbmZvQG9rdGEuY29tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCeil67/TLOiTZU\\nWWgW2XEGgFZ94bVO90v5J1XmcHMwL8v5Z/8qjdZLpGdwI7Ph0CyXMMNklpaR/Ljb8fsls3amdT5O\\nBw92Zo8ulcpjw2wuezTwL0eC0wY/GQDAZiXL59npE6U+fH1lbJIq92hx0HJSru/0O1q3+A/+jjZL\\n3tL/SwIDAQABMA0GCSqGSIb3DQEBBQUAA4GBAI5BoWZoH6Mz9vhypZPOJCEKa/K+biZQsA4Zqsuk\\nvvphhSERhqk/Nv76Vkl8uvJwwHbQrR9KJx4L3PRkGCG24rix71jEuXVGZUsDNM3CUKnARx4MEab6\\nGFHNkZ6DmoT/PFagngecHu+EwmuDtaG0rEkFrARwe+d8Ru0BN558abFb</ds:X509Certificate></ds:X509Data></ds:KeyInfo></md:KeyDescriptor><md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</md:NameIDFormat><md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</md:NameIDFormat><md:SingleSignOnService Binding=\\\"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST\\\" Location=\\\"https://pivotal.oktapreview.com/app/pivotal_pivotalcfstaging_1/k2lw4l5bPODCMIIDBRYZ/sso/saml\\\"/><md:SingleSignOnService Binding=\\\"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect\\\" Location=\\\"https://pivotal.oktapreview.com/app/pivotal_pivotalcfstaging_1/k2lw4l5bPODCMIIDBRYZ/sso/saml\\\"/></md:IDPSSODescriptor></md:EntityDescriptor>\\n\",\"idpEntityAlias\":\"saml-for-get\",\"zoneId\":\"uaa\",\"nameID\":\"urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress\",\"assertionConsumerIndex\":0,\"metadataTrustCheck\":false,\"showSamlLink\":false,\"linkText\":\"IDPEndpointsMockTests Saml Provider:saml-for-get\",\"iconUrl\":null,\"groupMappingMode\":\"EXPLICITLY_MAPPED\",\"skipSslValidation\":false,\"authnContext\":null,\"socketFactoryClassName\":null}",
      "id" : "9ae5be45-615e-42d8-904b-f75c63232305",
      "originKey" : "saml-for-get",
      "name" : "saml-for-get name",
      "version" : 0,
      "created" : 1525217095957,
      "last_modified" : 1525217095957,
      "active" : true,
      "identityZoneId" : "uaa"
    }
    

    Path Parameters

    /identity-providers/{id}

    Parameter Description
    id Unique identifier for this provider - GUID generated by the UAA

    Request Headers

    Name Description
    Authorization Bearer token containing zones.<zone id>.admin or zones.<zone id>.idps.read or uaa.admin or idps.read (only in the same zone that you are a user of)
    X-Identity-Zone-Id May include this header to administer another zone if using zones.<zoneId>.admin or zones.<zone id>.idps.read or uaa.admin scope against the default UAA zone.
    X-Identity-Zone-Subdomain If using a zones.<zoneId>.admin scope/token, indicates what Identity Zone this request goes to by supplying a subdomain.

    Request Parameters

    Parameter Type Constraints Description
    rawConfig Boolean Optional (defaults to false) UAA 3.4.0 Flag indicating whether the response should use raw, unescaped JSON for the config field of the IDP, rather than the default behavior of encoding the JSON as a string.

    Response Fields

    Path Type Description
    name String Human-readable name for this provider
    config.providerDescription String Human readable name/description of this provider
    config.emailDomain Array List of email domains associated with the provider for the purpose of associating users to the correct origin upon invitation. If empty list, no invitations are accepted. Wildcards supported.
    active Boolean Defaults to true.
    config.addShadowUserOnLogin Boolean Determines whether users should be allowed to authenticate without having a user pre-populated in the users database (if true), or whether shadow users must be created before login by an administrator (if false).
    config.storeCustomAttributes Boolean Set to true, to store custom user attributes to be fetched from the /userinfo endpoint
    type String Type of the identity provider.
    originKey String Unique identifier for the identity provider.
    config String Various configuration properties for the identity provider.
    config.additionalConfiguration Object (Unused.)
    version Number Version of the identity provider data. Clients can use this to protect against conflicting updates
    id String Unique identifier for this provider - GUID generated by the UAA
    identityZoneId String Set to the zone that this provider will be active in. Determined either by the Host header or the zone switch header.
    created Number UAA sets the creation date
    last_modified Number UAA sets the modification date

    Error Codes

    Error Code Description
    403 Forbidden - Insufficient scope

    Update

    $ curl 'http://localhost/identity-providers/92d4eeff-905e-4064-abe5-19840d2eb892?rawConfig=true' -i -X PUT \
        -H 'Content-Type: application/json' \
        -H 'Authorization: Bearer 6f8bf54a07364a488bfe17925f9bcaea' \
        -d '{"type":"uaa","config":{"emailDomain":null,"providerDescription":null,"passwordPolicy":null,"lockoutPolicy":{"lockoutPeriodSeconds":8,"lockoutAfterFailures":8,"countFailuresWithin":8},"disableInternalUserManagement":false},"originKey":"uaa","name":"uaa","version":3,"active":true}'
    
    PUT /identity-providers/92d4eeff-905e-4064-abe5-19840d2eb892?rawConfig=true HTTP/1.1
    Content-Type: application/json
    Authorization: Bearer 6f8bf54a07364a488bfe17925f9bcaea
    Host: localhost
    Content-Length: 280
    
    {"type":"uaa","config":{"emailDomain":null,"providerDescription":null,"passwordPolicy":null,"lockoutPolicy":{"lockoutPeriodSeconds":8,"lockoutAfterFailures":8,"countFailuresWithin":8},"disableInternalUserManagement":false},"originKey":"uaa","name":"uaa","version":3,"active":true}
    
    HTTP/1.1 200 OK
    X-B3-TraceId: 10e82e23-0236-4c6a-ae3a-a305ec46f89e
    Cache-Control: no-cache, no-store, max-age=0, must-revalidate
    Pragma: no-cache
    Expires: 0
    X-XSS-Protection: 1; mode=block
    X-Frame-Options: DENY
    X-Content-Type-Options: nosniff
    Content-Type: application/json;charset=UTF-8
    Content-Length: 559
    
    {
      "type" : "uaa",
      "config" : {
        "emailDomain" : null,
        "additionalConfiguration" : null,
        "providerDescription" : null,
        "passwordPolicy" : null,
        "lockoutPolicy" : {
          "lockoutPeriodSeconds" : 8,
          "lockoutAfterFailures" : 8,
          "countFailuresWithin" : 8
        },
        "disableInternalUserManagement" : false
      },
      "id" : "92d4eeff-905e-4064-abe5-19840d2eb892",
      "originKey" : "uaa",
      "name" : "uaa",
      "version" : 4,
      "created" : 946684800000,
      "last_modified" : 1525217097405,
      "active" : true,
      "identityZoneId" : "uaa"
    }
    

    Path Parameters

    /identity-providers/{id}

    Parameter Description
    id Unique identifier for this provider - GUID generated by the UAA

    Request Headers

    Name Description
    Authorization Bearer token containing zones.<zone id>.admin or uaa.admin or idps.write (only in the same zone that you are a user of)
    X-Identity-Zone-Id May include this header to administer another zone if using zones.<zoneId>.admin or uaa.admin scope against the default UAA zone.
    X-Identity-Zone-Subdomain If using a zones.<zoneId>.admin scope/token, indicates what Identity Zone this request goes to by supplying a subdomain.

    Request Parameters

    Parameter Type Constraints Description
    rawConfig Boolean Optional (defaults to false) UAA 3.4.0 Flag indicating whether the response should use raw, unescaped JSON for the config field of the IDP, rather than the default behavior of encoding the JSON as a string.

    Request and Response Fields

    Path Type Constraints Description
    name String Required Human-readable name for this provider
    config.providerDescription String Optional Human readable name/description of this provider
    config.emailDomain Array Optional List of email domains associated with the provider for the purpose of associating users to the correct origin upon invitation. If empty list, no invitations are accepted. Wildcards supported.
    active Boolean Optional Defaults to true.
    config.addShadowUserOnLogin Boolean Optional (defaults to true) Determines whether users should be allowed to authenticate without having a user pre-populated in the users database (if true), or whether shadow users must be created before login by an administrator (if false).
    config.storeCustomAttributes Boolean Optional (defaults to true) Set to true, to store custom user attributes to be fetched from the /userinfo endpoint
    type String Required uaa
    originKey String Required A unique identifier for the IDP. Cannot be updated.
    version Number Required Version of the identity provider data. Clients can use this to protect against conflicting updates
    config.passwordPolicy.minLength Number Required when passwordPolicy in the config is not null Minimum number of characters required for password to be considered valid (defaults to 0).
    config.passwordPolicy.maxLength Number Required when passwordPolicy in the config is not null Maximum number of characters required for password to be considered valid (defaults to 255).
    config.passwordPolicy.requireUpperCaseCharacter Number Required when passwordPolicy in the config is not null Minimum number of uppercase characters required for password to be considered valid (defaults to 0).
    config.passwordPolicy.requireLowerCaseCharacter Number Required when passwordPolicy in the config is not null Minimum number of lowercase characters required for password to be considered valid (defaults to 0).
    config.passwordPolicy.requireDigit Number Required when passwordPolicy in the config is not null Minimum number of digits required for password to be considered valid (defaults to 0).
    config.passwordPolicy.requireSpecialCharacter Number Required when passwordPolicy in the config is not null Minimum number of special characters required for password to be considered valid (defaults to 0).
    config.passwordPolicy.expireInMonths Number Required when passwordPolicy in the config is not null Number of months after which current password expires (defaults to 0).
    config.passwordPolicy.passwordNewerThan Number Required when passwordPolicy in the config is not null This timestamp value can be used to force change password for every user. If the user's passwordLastModified is older than this value, the password is expired (defaults to null).
    config.lockoutPolicy.lockoutPeriodSeconds Number Required when LockoutPolicy in the config is not null Number of seconds in which lockoutAfterFailures failures must occur in order for account to be locked (defaults to 3600).
    config.lockoutPolicy.lockoutAfterFailures Number Required when LockoutPolicy in the config is not null Number of allowed failures before account is locked (defaults to 5).
    config.lockoutPolicy.countFailuresWithin Number Required when LockoutPolicy in the config is not null Number of seconds to lock out an account when lockoutAfterFailures failures is exceeded (defaults to 300).
    config.disableInternalUserManagement Boolean Optional When set to true, user management is disabled for this provider, defaults to false

    Error Codes

    Error Code Description
    403 Forbidden - Insufficient scope
    422 Unprocessable Entity - Invalid config

    Delete

    $ curl 'http://localhost/identity-providers/cbe0e347-8faf-4ae6-b08b-34c55aab1499' -i -X DELETE \
        -H 'Content-Type: application/json' \
        -H 'Authorization: Bearer 182bc2846f3c4abeb9228bc067c4d3c3'
    
    DELETE /identity-providers/cbe0e347-8faf-4ae6-b08b-34c55aab1499 HTTP/1.1
    Content-Type: application/json
    Authorization: Bearer 182bc2846f3c4abeb9228bc067c4d3c3
    Host: localhost
    
    
    HTTP/1.1 200 OK
    X-B3-TraceId: 1cc22cec-6f4f-4478-aa6d-909cddfdbb23
    Cache-Control: no-cache, no-store, max-age=0, must-revalidate
    Pragma: no-cache
    Expires: 0
    X-XSS-Protection: 1; mode=block
    X-Frame-Options: DENY
    X-Content-Type-Options: nosniff
    Content-Type: application/json;charset=UTF-8
    Content-Length: 3185
    
    {
      "type" : "saml",
      "config" : "{\"emailDomain\":null,\"additionalConfiguration\":null,\"providerDescription\":null,\"externalGroupsWhitelist\":[],\"attributeMappings\":{\"external_groups\":[\"roles\"],\"user.attribute.department\":\"department\",\"phone_number\":\"telephone\",\"given_name\":\"first_name\",\"family_name\":\"last_name\",\"email\":\"emailAddress\"},\"addShadowUserOnLogin\":true,\"storeCustomAttributes\":true,\"metaDataLocation\":\"<?xml version=\\\"1.0\\\" encoding=\\\"UTF-8\\\"?><md:EntityDescriptor xmlns:md=\\\"urn:oasis:names:tc:SAML:2.0:metadata\\\" entityID=\\\"http://www.okta.com/saml-for-delete\\\"><md:IDPSSODescriptor WantAuthnRequestsSigned=\\\"true\\\" protocolSupportEnumeration=\\\"urn:oasis:names:tc:SAML:2.0:protocol\\\"><md:KeyDescriptor use=\\\"signing\\\"><ds:KeyInfo xmlns:ds=\\\"http://www.w3.org/2000/09/xmldsig#\\\"><ds:X509Data><ds:X509Certificate>MIICmTCCAgKgAwIBAgIGAUPATqmEMA0GCSqGSIb3DQEBBQUAMIGPMQswCQYDVQQGEwJVUzETMBEG\\nA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzENMAsGA1UECgwET2t0YTEU\\nMBIGA1UECwwLU1NPUHJvdmlkZXIxEDAOBgNVBAMMB1Bpdm90YWwxHDAaBgkqhkiG9w0BCQEWDWlu\\nZm9Ab2t0YS5jb20wHhcNMTQwMTIzMTgxMjM3WhcNNDQwMTIzMTgxMzM3WjCBjzELMAkGA1UEBhMC\\nVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xDTALBgNVBAoM\\nBE9rdGExFDASBgNVBAsMC1NTT1Byb3ZpZGVyMRAwDgYDVQQDDAdQaXZvdGFsMRwwGgYJKoZIhvcN\\nAQkBFg1pbmZvQG9rdGEuY29tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCeil67/TLOiTZU\\nWWgW2XEGgFZ94bVO90v5J1XmcHMwL8v5Z/8qjdZLpGdwI7Ph0CyXMMNklpaR/Ljb8fsls3amdT5O\\nBw92Zo8ulcpjw2wuezTwL0eC0wY/GQDAZiXL59npE6U+fH1lbJIq92hx0HJSru/0O1q3+A/+jjZL\\n3tL/SwIDAQABMA0GCSqGSIb3DQEBBQUAA4GBAI5BoWZoH6Mz9vhypZPOJCEKa/K+biZQsA4Zqsuk\\nvvphhSERhqk/Nv76Vkl8uvJwwHbQrR9KJx4L3PRkGCG24rix71jEuXVGZUsDNM3CUKnARx4MEab6\\nGFHNkZ6DmoT/PFagngecHu+EwmuDtaG0rEkFrARwe+d8Ru0BN558abFb</ds:X509Certificate></ds:X509Data></ds:KeyInfo></md:KeyDescriptor><md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</md:NameIDFormat><md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</md:NameIDFormat><md:SingleSignOnService Binding=\\\"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST\\\" Location=\\\"https://pivotal.oktapreview.com/app/pivotal_pivotalcfstaging_1/k2lw4l5bPODCMIIDBRYZ/sso/saml\\\"/><md:SingleSignOnService Binding=\\\"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect\\\" Location=\\\"https://pivotal.oktapreview.com/app/pivotal_pivotalcfstaging_1/k2lw4l5bPODCMIIDBRYZ/sso/saml\\\"/></md:IDPSSODescriptor></md:EntityDescriptor>\\n\",\"idpEntityAlias\":\"saml-for-delete\",\"zoneId\":\"uaa\",\"nameID\":\"urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress\",\"assertionConsumerIndex\":0,\"metadataTrustCheck\":false,\"showSamlLink\":false,\"linkText\":\"IDPEndpointsMockTests Saml Provider:saml-for-delete\",\"iconUrl\":null,\"groupMappingMode\":\"EXPLICITLY_MAPPED\",\"skipSslValidation\":false,\"authnContext\":null,\"socketFactoryClassName\":null}",
      "id" : "cbe0e347-8faf-4ae6-b08b-34c55aab1499",
      "originKey" : "saml-for-delete",
      "name" : "saml-for-delete name",
      "version" : 0,
      "created" : 1525217097321,
      "last_modified" : 1525217097321,
      "active" : true,
      "identityZoneId" : "uaa"
    }
    

    Path Parameters

    /identity-providers/{id}

    Parameter Description
    id Unique identifier for this provider - GUID generated by the UAA

    Request Headers

    Name Description
    Authorization Bearer token containing zones.<zone id>.admin or uaa.admin or idps.write (only in the same zone that you are a user of)
    X-Identity-Zone-Id May include this header to administer another zone if using zones.<zoneId>.admin or uaa.admin scope against the default UAA zone.
    X-Identity-Zone-Subdomain If using a zones.<zoneId>.admin scope/token, indicates what Identity Zone this request goes to by supplying a subdomain.

    Request Parameters

    Parameter Type Constraints Description
    rawConfig Boolean Optional (defaults to false) UAA 3.4.0 Flag indicating whether the response should use raw, unescaped JSON for the config field of the IDP, rather than the default behavior of encoding the JSON as a string.

    Response Fields

    Path Type Description
    name String Human-readable name for this provider
    config.providerDescription String Human readable name/description of this provider
    config.emailDomain Array List of email domains associated with the provider for the purpose of associating users to the correct origin upon invitation. If empty list, no invitations are accepted. Wildcards supported.
    active Boolean Defaults to true.
    config.addShadowUserOnLogin Boolean Determines whether users should be allowed to authenticate without having a user pre-populated in the users database (if true), or whether shadow users must be created before login by an administrator (if false).
    config.storeCustomAttributes Boolean Set to true, to store custom user attributes to be fetched from the /userinfo endpoint
    type String Type of the identity provider.
    originKey String Unique identifier for the identity provider.
    config String Various configuration properties for the identity provider.
    config.additionalConfiguration Object (Unused.)
    version Number Version of the identity provider data. Clients can use this to protect against conflicting updates
    id String Unique identifier for this provider - GUID generated by the UAA
    identityZoneId String Set to the zone that this provider will be active in. Determined either by the Host header or the zone switch header.
    created Number UAA sets the creation date
    last_modified Number UAA sets the modification date

    Error Codes

    Error Code Description
    403 Forbidden - Insufficient scope
    422 Unprocessable Entity

    Force password change for Users

    $ curl 'http://localhost/identity-providers/92d4eeff-905e-4064-abe5-19840d2eb892/status' -i -X PATCH \
        -H 'Content-Type: application/json' \
        -H 'Authorization: Bearer 58983561a6194006b20021d5af0ab9f7' \
        -d '{"requirePasswordChange":true}'
    
    PATCH /identity-providers/92d4eeff-905e-4064-abe5-19840d2eb892/status HTTP/1.1
    Content-Type: application/json
    Authorization: Bearer 58983561a6194006b20021d5af0ab9f7
    Host: localhost
    Content-Length: 30
    
    {"requirePasswordChange":true}
    
    HTTP/1.1 200 OK
    X-B3-TraceId: a50f667d-cb28-41d6-9993-b77e295ef186
    Cache-Control: no-cache, no-store, max-age=0, must-revalidate
    Pragma: no-cache
    Expires: 0
    X-XSS-Protection: 1; mode=block
    X-Frame-Options: DENY
    X-Content-Type-Options: nosniff
    Content-Type: application/json;charset=UTF-8
    Content-Length: 36
    
    {
      "requirePasswordChange" : true
    }
    

    Path Parameters

    /identity-providers/{id}/status

    Parameter Description
    id Unique identifier for this provider - GUID generated by the UAA

    Request Headers

    Name Description
    Authorization Bearer token containing zones.<zone id>.admin or uaa.admin or idps.write (only in the same zone that you are a user of)
    X-Identity-Zone-Id May include this header to administer another zone if using zones.<zoneId>.admin or uaa.admin scope against the default UAA zone.
    X-Identity-Zone-Subdomain If using a zones.<zoneId>.admin scope/token, indicates what Identity Zone this request goes to by supplying a subdomain.

    Request and Response Fields

    Path Type Constraints Description
    requirePasswordChange Boolean Required Set to true in order to force password change for all users. The passwordNewerThan property in PasswordPolicy of the IdentityProvider will be updated with current system time. If the user's passwordLastModified is older than this value, the password is expired.

    Error Codes

    Error Code Description
    403 Forbidden - Insufficient scope
    422 Unprocessable Entity - Invalid config

    Service Providers

    UAA is capable of acting as a SAML Identity Provider (IdP). When UAA receives a SAML authentication request from a recognized SAML Service Provider (SP), UAA will authenticate the user then send a SAML authentication response back to the SAML SP. If UAA succesfully authenticated the user the SAML authentication response will contain a SAML assertion as per specification.

    Obtaining the UAA SAML IdP metadata:

    In order to establish trust, a SAML IdP and SAML SP exchange SAML metadata which contains pulbic certificates as well as the endpoints used to communicate amongst each other. Your SAML SP will likely require the UAA SAML IdP metadata in order to make authentication requests to UAA. You can obtain this metadata by making a GET request to the /saml/idp/metadata endpoint.

    GET http://localhost:8080/uaa/saml/idp/metadata

    Initiate IDP Login Flow

    When the UAA is an IdP, you can initiate the login flow to the Service Provider, SP, by using the initiate endpoint This is a browser flow.

    $ curl 'http://o9asn6gq7yqqmgk1pylealx0.localhost/saml/idp/initiate?sp=rQvgPAvSgC.cloudfoundry-saml-login' -i
    
    GET /saml/idp/initiate?sp=rQvgPAvSgC.cloudfoundry-saml-login HTTP/1.1
    Host: o9asn6gq7yqqmgk1pylealx0.localhost
    
    
    
    <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
        <head>
        </head>
        <body onload="document.forms[0].submit()">
            <noscript>
                <p>
                    <strong>Note:</strong> Since your browser does not support JavaScript,
                    you must press the Continue button once to proceed.
                </p>
            </noscript>
    
            <form action="http&#x3a;&#x2f;&#x2f;rQvgPAvSgC.localhost&#x3a;8080&#x2f;uaa&#x2f;saml&#x2f;SSO&#x2f;alias&#x2f;rQvgPAvSgC.cloudfoundry-saml-login" method="post">
                <div>
    
    
    <input type="hidden" name="SAMLResponse" value="PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48c2FtbDJwOlJlc3BvbnNlIHhtbG5zOnNhbWwycD0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOnByb3RvY29sIiBEZXN0aW5hdGlvbj0iaHR0cDovL3JRdmdQQXZTZ0MubG9jYWxob3N0OjgwODAvdWFhL3NhbWwvU1NPL2FsaWFzL3JRdmdQQXZTZ0MuY2xvdWRmb3VuZHJ5LXNhbWwtbG9naW4iIElEPSJhMTY3NWNoZjI4NmVqaWYxMmYxNWNhNGJnZGozMzIzIiBJc3N1ZUluc3RhbnQ9IjIwMTgtMDUtMDFUMjM6MjU6MjIuOTE1WiIgVmVyc2lvbj0iMi4wIj48c2FtbDI6SXNzdWVyIHhtbG5zOnNhbWwyPSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6YXNzZXJ0aW9uIj5vOWFzbjZncTd5cXFtZ2sxcHlsZWFseDAuY2xvdWRmb3VuZHJ5LXNhbWwtbG9naW48L3NhbWwyOklzc3Vlcj48c2FtbDJwOlN0YXR1cz48c2FtbDJwOlN0YXR1c0NvZGUgVmFsdWU9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDpzdGF0dXM6U3VjY2VzcyIvPjwvc2FtbDJwOlN0YXR1cz48c2FtbDI6QXNzZXJ0aW9uIHhtbG5zOnNhbWwyPSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6YXNzZXJ0aW9uIiBJRD0iYTQ5ampjODYzN2lnZzQ0ajRpZ2g4NWM3NzY2NzM1NiIgSXNzdWVJbnN0YW50PSIyMDE4LTA1LTAxVDIzOjI1OjIyLjkwM1oiIFZlcnNpb249IjIuMCIgeG1sbnM6eHM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDEvWE1MU2NoZW1hIj48c2FtbDI6SXNzdWVyPm85YXNuNmdxN3lxcW1nazFweWxlYWx4MC5jbG91ZGZvdW5kcnktc2FtbC1sb2dpbjwvc2FtbDI6SXNzdWVyPjxkczpTaWduYXR1cmUgeG1sbnM6ZHM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvMDkveG1sZHNpZyMiPjxkczpTaWduZWRJbmZvPjxkczpDYW5vbmljYWxpemF0aW9uTWV0aG9kIEFsZ29yaXRobT0iaHR0cDovL3d3dy53My5vcmcvMjAwMS8xMC94bWwtZXhjLWMxNG4jIi8+PGRzOlNpZ25hdHVyZU1ldGhvZCBBbGdvcml0aG09Imh0dHA6Ly93d3cudzMub3JnLzIwMDEvMDQveG1sZHNpZy1tb3JlI3JzYS1zaGEyNTYiLz48ZHM6UmVmZXJlbmNlIFVSST0iI2E0OWpqYzg2MzdpZ2c0NGo0aWdoODVjNzc2NjczNTYiPjxkczpUcmFuc2Zvcm1zPjxkczpUcmFuc2Zvcm0gQWxnb3JpdGhtPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwLzA5L3htbGRzaWcjZW52ZWxvcGVkLXNpZ25hdHVyZSIvPjxkczpUcmFuc2Zvcm0gQWxnb3JpdGhtPSJodHRwOi8vd3d3LnczLm9yZy8yMDAxLzEwL3htbC1leGMtYzE0biMiPjxlYzpJbmNsdXNpdmVOYW1lc3BhY2VzIHhtbG5zOmVjPSJodHRwOi8vd3d3LnczLm9yZy8yMDAxLzEwL3htbC1leGMtYzE0biMiIFByZWZpeExpc3Q9InhzIi8+PC9kczpUcmFuc2Zvcm0+PC9kczpUcmFuc2Zvcm1zPjxkczpEaWdlc3RNZXRob2QgQWxnb3JpdGhtPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwLzA5L3htbGRzaWcjc2hhMSIvPjxkczpEaWdlc3RWYWx1ZT45TzJVUWxUZmpzNUdQSVFNek1wZld0TTVQbkE9PC9kczpEaWdlc3RWYWx1ZT48L2RzOlJlZmVyZW5jZT48L2RzOlNpZ25lZEluZm8+PGRzOlNpZ25hdHVyZVZhbHVlPkFFUlRkbGpmU2tidnVqYnVONi9TRGt6Zk1RMDJNWm1zYmwvRVRVV2lMMUl2U3gzZitQK1VLMXoxZFVuL2NHd3AxWkNzcEwrVVBveHJ3TmNjRUJrZ2pRNFlhcGZXenpiMkpKenZ0Wkx4RkRxczRkUUw2SVVhS25wUU9QSUQwUkVBSnhpUkZPUHZMMk5PbUdCSUFqNkdiZ3NYcmdJMW1vT0N6TTl1ZXN0NlNsTT08L2RzOlNpZ25hdHVyZVZhbHVlPjwvZHM6U2lnbmF0dXJlPjxzYW1sMjpTdWJqZWN0PjxzYW1sMjpOYW1lSUQgRm9ybWF0PSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoxLjE6bmFtZWlkLWZvcm1hdDp1bnNwZWNpZmllZCI+bWFyaXNzYTwvc2FtbDI6TmFtZUlEPjxzYW1sMjpTdWJqZWN0Q29uZmlybWF0aW9uIE1ldGhvZD0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOmNtOmJlYXJlciI+PHNhbWwyOlN1YmplY3RDb25maXJtYXRpb25EYXRhIE5vdE9uT3JBZnRlcj0iMjAxOC0wNS0wMVQyMzoyNToyMi45MDNaIiBSZWNpcGllbnQ9Imh0dHA6Ly9yUXZnUEF2U2dDLmxvY2FsaG9zdDo4MDgwL3VhYS9zYW1sL1NTTy9hbGlhcy9yUXZnUEF2U2dDLmNsb3VkZm91bmRyeS1zYW1sLWxvZ2luIi8+PC9zYW1sMjpTdWJqZWN0Q29uZmlybWF0aW9uPjwvc2FtbDI6U3ViamVjdD48c2FtbDI6Q29uZGl0aW9ucyBOb3RCZWZvcmU9IjIwMTgtMDUtMDFUMjM6MjU6MjIuOTAzWiIgTm90T25PckFmdGVyPSIyMDE4LTA1LTAxVDIzOjI1OjIyLjkwM1oiPjxzYW1sMjpBdWRpZW5jZVJlc3RyaWN0aW9uPjxzYW1sMjpBdWRpZW5jZT5yUXZnUEF2U2dDLmNsb3VkZm91bmRyeS1zYW1sLWxvZ2luPC9zYW1sMjpBdWRpZW5jZT48L3NhbWwyOkF1ZGllbmNlUmVzdHJpY3Rpb24+PC9zYW1sMjpDb25kaXRpb25zPjxzYW1sMjpBdXRoblN0YXRlbWVudCBBdXRobkluc3RhbnQ9IjIwMTgtMDUtMDFUMjM6MjU6MjIuOTAzWiIgU2Vzc2lvbkluZGV4PSJhNDcwZTRlaWM4MTNnOWU1YzBoaTAyYWVnaTgwZzMiPjxzYW1sMjpBdXRobkNvbnRleHQ+PHNhbWwyOkF1dGhuQ29udGV4dENsYXNzUmVmPnVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDphYzpjbGFzc2VzOlBhc3N3b3JkPC9zYW1sMjpBdXRobkNvbnRleHRDbGFzc1JlZj48L3NhbWwyOkF1dGhuQ29udGV4dD48L3NhbWwyOkF1dGhuU3RhdGVtZW50PjxzYW1sMjpBdHRyaWJ1dGVTdGF0ZW1lbnQ+PHNhbWwyOkF0dHJpYnV0ZSBOYW1lPSJhdXRob3JpdGllcyI+PHNhbWwyOkF0dHJpYnV0ZVZhbHVlIHhtbG5zOnhzaT0iaHR0cDovL3d3dy53My5vcmcvMjAwMS9YTUxTY2hlbWEtaW5zdGFuY2UiIHhzaTp0eXBlPSJ4czpzdHJpbmciPnVhYS51c2VyPC9zYW1sMjpBdHRyaWJ1dGVWYWx1ZT48L3NhbWwyOkF0dHJpYnV0ZT48c2FtbDI6QXR0cmlidXRlIE5hbWU9ImVtYWlsIj48c2FtbDI6QXR0cmlidXRlVmFsdWUgeG1sbnM6eHNpPSJodHRwOi8vd3d3LnczLm9yZy8yMDAxL1hNTFNjaGVtYS1pbnN0YW5jZSIgeHNpOnR5cGU9InhzOnN0cmluZyI+bWFyaXNzYUB0ZXN0Lm9yZzwvc2FtbDI6QXR0cmlidXRlVmFsdWU+PC9zYW1sMjpBdHRyaWJ1dGU+PHNhbWwyOkF0dHJpYnV0ZSBOYW1lPSJpZCI+PHNhbWwyOkF0dHJpYnV0ZVZhbHVlIHhtbG5zOnhzaT0iaHR0cDovL3d3dy53My5vcmcvMjAwMS9YTUxTY2hlbWEtaW5zdGFuY2UiIHhzaTp0eXBlPSJ4czpzdHJpbmciPmZkZGU2NmFiLTZmOGUtNGZjYy04Zjc2LWMzNTRjNTcyMzE0ODwvc2FtbDI6QXR0cmlidXRlVmFsdWU+PC9zYW1sMjpBdHRyaWJ1dGU+PHNhbWwyOkF0dHJpYnV0ZSBOYW1lPSJuYW1lIj48c2FtbDI6QXR0cmlidXRlVmFsdWUgeG1sbnM6eHNpPSJodHRwOi8vd3d3LnczLm9yZy8yMDAxL1hNTFNjaGVtYS1pbnN0YW5jZSIgeHNpOnR5cGU9InhzOnN0cmluZyI+bWFyaXNzYTwvc2FtbDI6QXR0cmlidXRlVmFsdWU+PC9zYW1sMjpBdHRyaWJ1dGU+PHNhbWwyOkF0dHJpYnV0ZSBOYW1lPSJvcmlnaW4iPjxzYW1sMjpBdHRyaWJ1dGVWYWx1ZSB4bWxuczp4c2k9Imh0dHA6Ly93d3cudzMub3JnLzIwMDEvWE1MU2NoZW1hLWluc3RhbmNlIiB4c2k6dHlwZT0ieHM6c3RyaW5nIj51YWE8L3NhbWwyOkF0dHJpYnV0ZVZhbHVlPjwvc2FtbDI6QXR0cmlidXRlPjxzYW1sMjpBdHRyaWJ1dGUgTmFtZT0iem9uZUlkIj48c2FtbDI6QXR0cmlidXRlVmFsdWUgeG1sbnM6eHNpPSJodHRwOi8vd3d3LnczLm9yZy8yMDAxL1hNTFNjaGVtYS1pbnN0YW5jZSIgeHNpOnR5cGU9InhzOnN0cmluZyI+bzlhc242Z3E3eXFxbWdrMXB5bGVhbHgwPC9zYW1sMjpBdHRyaWJ1dGVWYWx1ZT48L3NhbWwyOkF0dHJpYnV0ZT48c2FtbDI6QXR0cmlidXRlIE5hbWU9Im9yZ2FuaXphdGlvbi1lbWFpbHMiPjxzYW1sMjpBdHRyaWJ1dGVWYWx1ZSB4bWxuczp4c2k9Imh0dHA6Ly93d3cudzMub3JnLzIwMDEvWE1MU2NoZW1hLWluc3RhbmNlIiB4c2k6dHlwZT0ieHM6c3RyaW5nIj5jb250YWN0QGRlbW9vcmcuY29tPC9zYW1sMjpBdHRyaWJ1dGVWYWx1ZT48c2FtbDI6QXR0cmlidXRlVmFsdWUgeG1sbnM6eHNpPSJodHRwOi8vd3d3LnczLm9yZy8yMDAxL1hNTFNjaGVtYS1pbnN0YW5jZSIgeHNpOnR5cGU9InhzOnN0cmluZyI+aW5mb0BkZW1vLm9yZzwvc2FtbDI6QXR0cmlidXRlVmFsdWU+PC9zYW1sMjpBdHRyaWJ1dGU+PHNhbWwyOkF0dHJpYnV0ZSBOYW1lPSJvcmdhbml6YXRpb24tbmFtZSI+PHNhbWwyOkF0dHJpYnV0ZVZhbHVlIHhtbG5zOnhzaT0iaHR0cDovL3d3dy53My5vcmcvMjAwMS9YTUxTY2hlbWEtaW5zdGFuY2UiIHhzaTp0eXBlPSJ4czpzdHJpbmciPlRoZSBEZW1vIE9yZzwvc2FtbDI6QXR0cmlidXRlVmFsdWU+PC9zYW1sMjpBdHRyaWJ1dGU+PC9zYW1sMjpBdHRyaWJ1dGVTdGF0ZW1lbnQ+PC9zYW1sMjpBc3NlcnRpb24+PC9zYW1sMnA6UmVzcG9uc2U+"/>                
                </div>
                <noscript>
                    <div>
                        <input type="submit" value="Continue"/>
                    </div>
                </noscript>
            </form>
        </body>
    </html>
    

    Request Parameters

    Parameter Type Constraints Description
    sp String required The entity ID of a configured and active the service provider.

    Error Codes

    Error Code Description
    400 If IDP initiated login is not enabled, the SP parameter is incorrect or SP is disabled.

    List

    $ curl 'http://localhost/saml/service-providers' -i \
        -H 'Authorization: Bearer f415db87d971480f970bbba28562ebdd'
    
    GET /saml/service-providers HTTP/1.1
    Authorization: Bearer f415db87d971480f970bbba28562ebdd
    Host: localhost
    
    
    HTTP/1.1 200 OK
    X-B3-TraceId: 85c703e8-9729-40a4-b487-f1eebd9d150d
    Cache-Control: no-cache, no-store, max-age=0, must-revalidate
    Pragma: no-cache
    Expires: 0
    X-XSS-Protection: 1; mode=block
    X-Frame-Options: DENY
    X-Content-Type-Options: nosniff
    Content-Type: application/json;charset=UTF-8
    Content-Length: 7298
    
    [ {
      "config" : "{\"metaDataLocation\":\"<?xml version=\\\"1.0\\\" encoding=\\\"UTF-8\\\"?><md:EntityDescriptor xmlns:md=\\\"urn:oasis:names:tc:SAML:2.0:metadata\\\" ID=\\\"FfQu4Oyk3i.cloudfoundry-saml-login\\\" entityID=\\\"FfQu4Oyk3i.cloudfoundry-saml-login\\\"><ds:Signature xmlns:ds=\\\"http://www.w3.org/2000/09/xmldsig#\\\"><ds:SignedInfo><ds:CanonicalizationMethod Algorithm=\\\"http://www.w3.org/2001/10/xml-exc-c14n#\\\"/><ds:SignatureMethod Algorithm=\\\"http://www.w3.org/2000/09/xmldsig#rsa-sha1\\\"/><ds:Reference URI=\\\"#FfQu4Oyk3i.cloudfoundry-saml-login\\\"><ds:Transforms><ds:Transform Algorithm=\\\"http://www.w3.org/2000/09/xmldsig#enveloped-signature\\\"/><ds:Transform Algorithm=\\\"http://www.w3.org/2001/10/xml-exc-c14n#\\\"/></ds:Transforms><ds:DigestMethod Algorithm=\\\"http://www.w3.org/2000/09/xmldsig#sha1\\\"/><ds:DigestValue>zALgjEFJ7jJSwn2AOBH5H8CX93U=</ds:DigestValue></ds:Reference></ds:SignedInfo><ds:SignatureValue>Rp5XH8eT0ek/vlFGzHgIFOeESchOwSYZ9oh4JA9WqQ0jJtvNQ9IttY2QY9XK3n6TbbtPcEKVgljyTfwD5ymp+oMKfIYQC9JsN8mPADN5rjLFgC+xGceWLbcjoNsCJ7x2ZjyWRblSxoOU5qnzxEA3k3Bu+OkV+ZXcSbmgMWoQACg=</ds:SignatureValue><ds:KeyInfo><ds:X509Data><ds:X509Certificate>MIIDSTCCArKgAwIBAgIBADANBgkqhkiG9w0BAQQFADB8MQswCQYDVQQGEwJhdzEOMAwGA1UECBMF\\nYXJ1YmExDjAMBgNVBAoTBWFydWJhMQ4wDAYDVQQHEwVhcnViYTEOMAwGA1UECxMFYXJ1YmExDjAM\\nBgNVBAMTBWFydWJhMR0wGwYJKoZIhvcNAQkBFg5hcnViYUBhcnViYS5hcjAeFw0xNTExMjAyMjI2\\nMjdaFw0xNjExMTkyMjI2MjdaMHwxCzAJBgNVBAYTAmF3MQ4wDAYDVQQIEwVhcnViYTEOMAwGA1UE\\nChMFYXJ1YmExDjAMBgNVBAcTBWFydWJhMQ4wDAYDVQQLEwVhcnViYTEOMAwGA1UEAxMFYXJ1YmEx\\nHTAbBgkqhkiG9w0BCQEWDmFydWJhQGFydWJhLmFyMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKB\\ngQDHtC5gUXxBKpEqZTLkNvFwNGnNIkggNOwOQVNbpO0WVHIivig5L39WqS9u0hnA+O7MCA/KlrAR\\n4bXaeVVhwfUPYBKIpaaTWFQR5cTR1UFZJL/OF9vAfpOwznoD66DDCnQVpbCjtDYWX+x6imxn8HCY\\nxhMol6ZnTbSsFW6VZjFMjQIDAQABo4HaMIHXMB0GA1UdDgQWBBTx0lDzjH/iOBnOSQaSEWQLx1sy\\nGDCBpwYDVR0jBIGfMIGcgBTx0lDzjH/iOBnOSQaSEWQLx1syGKGBgKR+MHwxCzAJBgNVBAYTAmF3\\nMQ4wDAYDVQQIEwVhcnViYTEOMAwGA1UEChMFYXJ1YmExDjAMBgNVBAcTBWFydWJhMQ4wDAYDVQQL\\nEwVhcnViYTEOMAwGA1UEAxMFYXJ1YmExHTAbBgkqhkiG9w0BCQEWDmFydWJhQGFydWJhLmFyggEA\\nMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEEBQADgYEAYvBJ0HOZbbHClXmGUjGs+GS+xC1FO/am\\n2suCSYqNB9dyMXfOWiJ1+TLJk+o/YZt8vuxCKdcZYgl4l/L6PxJ982SRhc83ZW2dkAZI4M0/Ud3o\\nePe84k8jm3A7EvH5wi5hvCkKRpuRBwn3Ei+jCRouxTbzKPsuCVB+1sNyxMTXzf0=</ds:X509Certificate></ds:X509Data></ds:KeyInfo></ds:Signature><md:SPSSODescriptor AuthnRequestsSigned=\\\"true\\\" WantAssertionsSigned=\\\"true\\\" protocolSupportEnumeration=\\\"urn:oasis:names:tc:SAML:2.0:protocol\\\"><md:KeyDescriptor use=\\\"signing\\\"><ds:KeyInfo xmlns:ds=\\\"http://www.w3.org/2000/09/xmldsig#\\\"><ds:X509Data><ds:X509Certificate>MIIDSTCCArKgAwIBAgIBADANBgkqhkiG9w0BAQQFADB8MQswCQYDVQQGEwJhdzEOMAwGA1UECBMF\\nYXJ1YmExDjAMBgNVBAoTBWFydWJhMQ4wDAYDVQQHEwVhcnViYTEOMAwGA1UECxMFYXJ1YmExDjAM\\nBgNVBAMTBWFydWJhMR0wGwYJKoZIhvcNAQkBFg5hcnViYUBhcnViYS5hcjAeFw0xNTExMjAyMjI2\\nMjdaFw0xNjExMTkyMjI2MjdaMHwxCzAJBgNVBAYTAmF3MQ4wDAYDVQQIEwVhcnViYTEOMAwGA1UE\\nChMFYXJ1YmExDjAMBgNVBAcTBWFydWJhMQ4wDAYDVQQLEwVhcnViYTEOMAwGA1UEAxMFYXJ1YmEx\\nHTAbBgkqhkiG9w0BCQEWDmFydWJhQGFydWJhLmFyMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKB\\ngQDHtC5gUXxBKpEqZTLkNvFwNGnNIkggNOwOQVNbpO0WVHIivig5L39WqS9u0hnA+O7MCA/KlrAR\\n4bXaeVVhwfUPYBKIpaaTWFQR5cTR1UFZJL/OF9vAfpOwznoD66DDCnQVpbCjtDYWX+x6imxn8HCY\\nxhMol6ZnTbSsFW6VZjFMjQIDAQABo4HaMIHXMB0GA1UdDgQWBBTx0lDzjH/iOBnOSQaSEWQLx1sy\\nGDCBpwYDVR0jBIGfMIGcgBTx0lDzjH/iOBnOSQaSEWQLx1syGKGBgKR+MHwxCzAJBgNVBAYTAmF3\\nMQ4wDAYDVQQIEwVhcnViYTEOMAwGA1UEChMFYXJ1YmExDjAMBgNVBAcTBWFydWJhMQ4wDAYDVQQL\\nEwVhcnViYTEOMAwGA1UEAxMFYXJ1YmExHTAbBgkqhkiG9w0BCQEWDmFydWJhQGFydWJhLmFyggEA\\nMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEEBQADgYEAYvBJ0HOZbbHClXmGUjGs+GS+xC1FO/am\\n2suCSYqNB9dyMXfOWiJ1+TLJk+o/YZt8vuxCKdcZYgl4l/L6PxJ982SRhc83ZW2dkAZI4M0/Ud3o\\nePe84k8jm3A7EvH5wi5hvCkKRpuRBwn3Ei+jCRouxTbzKPsuCVB+1sNyxMTXzf0=</ds:X509Certificate></ds:X509Data></ds:KeyInfo></md:KeyDescriptor><md:KeyDescriptor use=\\\"encryption\\\"><ds:KeyInfo xmlns:ds=\\\"http://www.w3.org/2000/09/xmldsig#\\\"><ds:X509Data><ds:X509Certificate>MIIDSTCCArKgAwIBAgIBADANBgkqhkiG9w0BAQQFADB8MQswCQYDVQQGEwJhdzEOMAwGA1UECBMF\\nYXJ1YmExDjAMBgNVBAoTBWFydWJhMQ4wDAYDVQQHEwVhcnViYTEOMAwGA1UECxMFYXJ1YmExDjAM\\nBgNVBAMTBWFydWJhMR0wGwYJKoZIhvcNAQkBFg5hcnViYUBhcnViYS5hcjAeFw0xNTExMjAyMjI2\\nMjdaFw0xNjExMTkyMjI2MjdaMHwxCzAJBgNVBAYTAmF3MQ4wDAYDVQQIEwVhcnViYTEOMAwGA1UE\\nChMFYXJ1YmExDjAMBgNVBAcTBWFydWJhMQ4wDAYDVQQLEwVhcnViYTEOMAwGA1UEAxMFYXJ1YmEx\\nHTAbBgkqhkiG9w0BCQEWDmFydWJhQGFydWJhLmFyMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKB\\ngQDHtC5gUXxBKpEqZTLkNvFwNGnNIkggNOwOQVNbpO0WVHIivig5L39WqS9u0hnA+O7MCA/KlrAR\\n4bXaeVVhwfUPYBKIpaaTWFQR5cTR1UFZJL/OF9vAfpOwznoD66DDCnQVpbCjtDYWX+x6imxn8HCY\\nxhMol6ZnTbSsFW6VZjFMjQIDAQABo4HaMIHXMB0GA1UdDgQWBBTx0lDzjH/iOBnOSQaSEWQLx1sy\\nGDCBpwYDVR0jBIGfMIGcgBTx0lDzjH/iOBnOSQaSEWQLx1syGKGBgKR+MHwxCzAJBgNVBAYTAmF3\\nMQ4wDAYDVQQIEwVhcnViYTEOMAwGA1UEChMFYXJ1YmExDjAMBgNVBAcTBWFydWJhMQ4wDAYDVQQL\\nEwVhcnViYTEOMAwGA1UEAxMFYXJ1YmExHTAbBgkqhkiG9w0BCQEWDmFydWJhQGFydWJhLmFyggEA\\nMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEEBQADgYEAYvBJ0HOZbbHClXmGUjGs+GS+xC1FO/am\\n2suCSYqNB9dyMXfOWiJ1+TLJk+o/YZt8vuxCKdcZYgl4l/L6PxJ982SRhc83ZW2dkAZI4M0/Ud3o\\nePe84k8jm3A7EvH5wi5hvCkKRpuRBwn3Ei+jCRouxTbzKPsuCVB+1sNyxMTXzf0=</ds:X509Certificate></ds:X509Data></ds:KeyInfo></md:KeyDescriptor><md:SingleLogoutService Binding=\\\"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST\\\" Location=\\\"http://FfQu4Oyk3i.localhost:8080/uaa/saml/SingleLogout/alias/FfQu4Oyk3i.cloudfoundry-saml-login\\\"/><md:SingleLogoutService Binding=\\\"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect\\\" Location=\\\"http://FfQu4Oyk3i.localhost:8080/uaa/saml/SingleLogout/alias/FfQu4Oyk3i.cloudfoundry-saml-login\\\"/><md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</md:NameIDFormat><md:NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</md:NameIDFormat><md:NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</md:NameIDFormat><md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</md:NameIDFormat><md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName</md:NameIDFormat><md:AssertionConsumerService Binding=\\\"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST\\\" Location=\\\"http://FfQu4Oyk3i.localhost:8080/uaa/saml/SSO/alias/FfQu4Oyk3i.cloudfoundry-saml-login\\\" index=\\\"0\\\" isDefault=\\\"true\\\"/><md:AssertionConsumerService Binding=\\\"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact\\\" Location=\\\"http://FfQu4Oyk3i.localhost:8080/uaa/saml/SSO/alias/FfQu4Oyk3i.cloudfoundry-saml-login\\\" index=\\\"1\\\"/></md:SPSSODescriptor></md:EntityDescriptor>\",\"singleSignOnServiceIndex\":0,\"metadataTrustCheck\":true,\"skipSslValidation\":false,\"attributeMappings\":{\"given_name\":\"firstname\",\"family_name\":\"lastname\",\"phone_number\":\"phone\"},\"enableIdpInitiatedSso\":true,\"staticCustomAttributes\":{\"organization-emails\":[\"contact@demoorg.com\",\"info@demo.org\"],\"organization-name\":\"The Demo Org\"}}",
      "id" : "ee7fabde-65ae-4dea-b004-291f46f16892",
      "entityId" : "FfQu4Oyk3i.cloudfoundry-saml-login",
      "name" : "FfQu4Oyk3i",
      "version" : 0,
      "created" : 1525217123058,
      "lastModified" : 1525217123058,
      "active" : true,
      "identityZoneId" : "uaa"
    } ]
    

    Request Headers

    Name Description
    Authorization Bearer token containing sps.read
    X-Identity-Zone-Id If using a zones.<zoneId>.admin scope/token, indicates what zone this request goes to by supplying a zone_id.
    X-Identity-Zone-Subdomain If using a zones.<zoneId>.admin scope/token, indicates what zone this request goes to by supplying a subdomain.

    Response Fields

    Path Type Description
    [].id String Unique identifier for this provider - GUID generated by the UAA.
    [].name String Human readable name for the SAML SP.
    [].entityId String The entity id of the SAML SP.
    [].active Boolean Defaults to true.
    [].created Number UAA sets this to the UTC creation date.
    [].identityZoneId String Set to the zone that this provider will be active in. Determined by either.
    [].lastModified Number UAA sets this to the UTC last date of modification.
    [].version Number Version of the identity provider data. Clients can use this.
    [].config String Contains metaDataLocation and metadataTrustCheck fields as json fields.
    [].config.metaDataLocation String The SAML SP Metadata - either an XML string or a URL that.
    [].config.metadataTrustCheck Boolean Determines whether UAA should validate the SAML SP metadata.

    Error Codes

    Error Code Description
    403 Forbidden - Insufficient scope

    Get

    $ curl 'http://localhost/saml/service-providers/04688cb2-df66-48e4-a98b-68d77854689e' -i \
        -H 'Authorization: Bearer 4697dec8ec4042d1a875f6c2ecb06229'
    
    GET /saml/service-providers/04688cb2-df66-48e4-a98b-68d77854689e HTTP/1.1
    Authorization: Bearer 4697dec8ec4042d1a875f6c2ecb06229
    Host: localhost
    
    
    HTTP/1.1 200 OK
    X-B3-TraceId: 9de3261f-4ae4-4595-b72f-644b8dbc8763
    Cache-Control: no-cache, no-store, max-age=0, must-revalidate
    Pragma: no-cache
    Expires: 0
    X-XSS-Protection: 1; mode=block
    X-Frame-Options: DENY
    X-Content-Type-Options: nosniff
    Content-Type: application/json;charset=UTF-8
    Content-Length: 7294
    
    {
      "config" : "{\"metaDataLocation\":\"<?xml version=\\\"1.0\\\" encoding=\\\"UTF-8\\\"?><md:EntityDescriptor xmlns:md=\\\"urn:oasis:names:tc:SAML:2.0:metadata\\\" ID=\\\"XubnPRQ5pj.cloudfoundry-saml-login\\\" entityID=\\\"XubnPRQ5pj.cloudfoundry-saml-login\\\"><ds:Signature xmlns:ds=\\\"http://www.w3.org/2000/09/xmldsig#\\\"><ds:SignedInfo><ds:CanonicalizationMethod Algorithm=\\\"http://www.w3.org/2001/10/xml-exc-c14n#\\\"/><ds:SignatureMethod Algorithm=\\\"http://www.w3.org/2000/09/xmldsig#rsa-sha1\\\"/><ds:Reference URI=\\\"#XubnPRQ5pj.cloudfoundry-saml-login\\\"><ds:Transforms><ds:Transform Algorithm=\\\"http://www.w3.org/2000/09/xmldsig#enveloped-signature\\\"/><ds:Transform Algorithm=\\\"http://www.w3.org/2001/10/xml-exc-c14n#\\\"/></ds:Transforms><ds:DigestMethod Algorithm=\\\"http://www.w3.org/2000/09/xmldsig#sha1\\\"/><ds:DigestValue>zALgjEFJ7jJSwn2AOBH5H8CX93U=</ds:DigestValue></ds:Reference></ds:SignedInfo><ds:SignatureValue>Rp5XH8eT0ek/vlFGzHgIFOeESchOwSYZ9oh4JA9WqQ0jJtvNQ9IttY2QY9XK3n6TbbtPcEKVgljyTfwD5ymp+oMKfIYQC9JsN8mPADN5rjLFgC+xGceWLbcjoNsCJ7x2ZjyWRblSxoOU5qnzxEA3k3Bu+OkV+ZXcSbmgMWoQACg=</ds:SignatureValue><ds:KeyInfo><ds:X509Data><ds:X509Certificate>MIIDSTCCArKgAwIBAgIBADANBgkqhkiG9w0BAQQFADB8MQswCQYDVQQGEwJhdzEOMAwGA1UECBMF\\nYXJ1YmExDjAMBgNVBAoTBWFydWJhMQ4wDAYDVQQHEwVhcnViYTEOMAwGA1UECxMFYXJ1YmExDjAM\\nBgNVBAMTBWFydWJhMR0wGwYJKoZIhvcNAQkBFg5hcnViYUBhcnViYS5hcjAeFw0xNTExMjAyMjI2\\nMjdaFw0xNjExMTkyMjI2MjdaMHwxCzAJBgNVBAYTAmF3MQ4wDAYDVQQIEwVhcnViYTEOMAwGA1UE\\nChMFYXJ1YmExDjAMBgNVBAcTBWFydWJhMQ4wDAYDVQQLEwVhcnViYTEOMAwGA1UEAxMFYXJ1YmEx\\nHTAbBgkqhkiG9w0BCQEWDmFydWJhQGFydWJhLmFyMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKB\\ngQDHtC5gUXxBKpEqZTLkNvFwNGnNIkggNOwOQVNbpO0WVHIivig5L39WqS9u0hnA+O7MCA/KlrAR\\n4bXaeVVhwfUPYBKIpaaTWFQR5cTR1UFZJL/OF9vAfpOwznoD66DDCnQVpbCjtDYWX+x6imxn8HCY\\nxhMol6ZnTbSsFW6VZjFMjQIDAQABo4HaMIHXMB0GA1UdDgQWBBTx0lDzjH/iOBnOSQaSEWQLx1sy\\nGDCBpwYDVR0jBIGfMIGcgBTx0lDzjH/iOBnOSQaSEWQLx1syGKGBgKR+MHwxCzAJBgNVBAYTAmF3\\nMQ4wDAYDVQQIEwVhcnViYTEOMAwGA1UEChMFYXJ1YmExDjAMBgNVBAcTBWFydWJhMQ4wDAYDVQQL\\nEwVhcnViYTEOMAwGA1UEAxMFYXJ1YmExHTAbBgkqhkiG9w0BCQEWDmFydWJhQGFydWJhLmFyggEA\\nMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEEBQADgYEAYvBJ0HOZbbHClXmGUjGs+GS+xC1FO/am\\n2suCSYqNB9dyMXfOWiJ1+TLJk+o/YZt8vuxCKdcZYgl4l/L6PxJ982SRhc83ZW2dkAZI4M0/Ud3o\\nePe84k8jm3A7EvH5wi5hvCkKRpuRBwn3Ei+jCRouxTbzKPsuCVB+1sNyxMTXzf0=</ds:X509Certificate></ds:X509Data></ds:KeyInfo></ds:Signature><md:SPSSODescriptor AuthnRequestsSigned=\\\"true\\\" WantAssertionsSigned=\\\"true\\\" protocolSupportEnumeration=\\\"urn:oasis:names:tc:SAML:2.0:protocol\\\"><md:KeyDescriptor use=\\\"signing\\\"><ds:KeyInfo xmlns:ds=\\\"http://www.w3.org/2000/09/xmldsig#\\\"><ds:X509Data><ds:X509Certificate>MIIDSTCCArKgAwIBAgIBADANBgkqhkiG9w0BAQQFADB8MQswCQYDVQQGEwJhdzEOMAwGA1UECBMF\\nYXJ1YmExDjAMBgNVBAoTBWFydWJhMQ4wDAYDVQQHEwVhcnViYTEOMAwGA1UECxMFYXJ1YmExDjAM\\nBgNVBAMTBWFydWJhMR0wGwYJKoZIhvcNAQkBFg5hcnViYUBhcnViYS5hcjAeFw0xNTExMjAyMjI2\\nMjdaFw0xNjExMTkyMjI2MjdaMHwxCzAJBgNVBAYTAmF3MQ4wDAYDVQQIEwVhcnViYTEOMAwGA1UE\\nChMFYXJ1YmExDjAMBgNVBAcTBWFydWJhMQ4wDAYDVQQLEwVhcnViYTEOMAwGA1UEAxMFYXJ1YmEx\\nHTAbBgkqhkiG9w0BCQEWDmFydWJhQGFydWJhLmFyMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKB\\ngQDHtC5gUXxBKpEqZTLkNvFwNGnNIkggNOwOQVNbpO0WVHIivig5L39WqS9u0hnA+O7MCA/KlrAR\\n4bXaeVVhwfUPYBKIpaaTWFQR5cTR1UFZJL/OF9vAfpOwznoD66DDCnQVpbCjtDYWX+x6imxn8HCY\\nxhMol6ZnTbSsFW6VZjFMjQIDAQABo4HaMIHXMB0GA1UdDgQWBBTx0lDzjH/iOBnOSQaSEWQLx1sy\\nGDCBpwYDVR0jBIGfMIGcgBTx0lDzjH/iOBnOSQaSEWQLx1syGKGBgKR+MHwxCzAJBgNVBAYTAmF3\\nMQ4wDAYDVQQIEwVhcnViYTEOMAwGA1UEChMFYXJ1YmExDjAMBgNVBAcTBWFydWJhMQ4wDAYDVQQL\\nEwVhcnViYTEOMAwGA1UEAxMFYXJ1YmExHTAbBgkqhkiG9w0BCQEWDmFydWJhQGFydWJhLmFyggEA\\nMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEEBQADgYEAYvBJ0HOZbbHClXmGUjGs+GS+xC1FO/am\\n2suCSYqNB9dyMXfOWiJ1+TLJk+o/YZt8vuxCKdcZYgl4l/L6PxJ982SRhc83ZW2dkAZI4M0/Ud3o\\nePe84k8jm3A7EvH5wi5hvCkKRpuRBwn3Ei+jCRouxTbzKPsuCVB+1sNyxMTXzf0=</ds:X509Certificate></ds:X509Data></ds:KeyInfo></md:KeyDescriptor><md:KeyDescriptor use=\\\"encryption\\\"><ds:KeyInfo xmlns:ds=\\\"http://www.w3.org/2000/09/xmldsig#\\\"><ds:X509Data><ds:X509Certificate>MIIDSTCCArKgAwIBAgIBADANBgkqhkiG9w0BAQQFADB8MQswCQYDVQQGEwJhdzEOMAwGA1UECBMF\\nYXJ1YmExDjAMBgNVBAoTBWFydWJhMQ4wDAYDVQQHEwVhcnViYTEOMAwGA1UECxMFYXJ1YmExDjAM\\nBgNVBAMTBWFydWJhMR0wGwYJKoZIhvcNAQkBFg5hcnViYUBhcnViYS5hcjAeFw0xNTExMjAyMjI2\\nMjdaFw0xNjExMTkyMjI2MjdaMHwxCzAJBgNVBAYTAmF3MQ4wDAYDVQQIEwVhcnViYTEOMAwGA1UE\\nChMFYXJ1YmExDjAMBgNVBAcTBWFydWJhMQ4wDAYDVQQLEwVhcnViYTEOMAwGA1UEAxMFYXJ1YmEx\\nHTAbBgkqhkiG9w0BCQEWDmFydWJhQGFydWJhLmFyMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKB\\ngQDHtC5gUXxBKpEqZTLkNvFwNGnNIkggNOwOQVNbpO0WVHIivig5L39WqS9u0hnA+O7MCA/KlrAR\\n4bXaeVVhwfUPYBKIpaaTWFQR5cTR1UFZJL/OF9vAfpOwznoD66DDCnQVpbCjtDYWX+x6imxn8HCY\\nxhMol6ZnTbSsFW6VZjFMjQIDAQABo4HaMIHXMB0GA1UdDgQWBBTx0lDzjH/iOBnOSQaSEWQLx1sy\\nGDCBpwYDVR0jBIGfMIGcgBTx0lDzjH/iOBnOSQaSEWQLx1syGKGBgKR+MHwxCzAJBgNVBAYTAmF3\\nMQ4wDAYDVQQIEwVhcnViYTEOMAwGA1UEChMFYXJ1YmExDjAMBgNVBAcTBWFydWJhMQ4wDAYDVQQL\\nEwVhcnViYTEOMAwGA1UEAxMFYXJ1YmExHTAbBgkqhkiG9w0BCQEWDmFydWJhQGFydWJhLmFyggEA\\nMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEEBQADgYEAYvBJ0HOZbbHClXmGUjGs+GS+xC1FO/am\\n2suCSYqNB9dyMXfOWiJ1+TLJk+o/YZt8vuxCKdcZYgl4l/L6PxJ982SRhc83ZW2dkAZI4M0/Ud3o\\nePe84k8jm3A7EvH5wi5hvCkKRpuRBwn3Ei+jCRouxTbzKPsuCVB+1sNyxMTXzf0=</ds:X509Certificate></ds:X509Data></ds:KeyInfo></md:KeyDescriptor><md:SingleLogoutService Binding=\\\"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST\\\" Location=\\\"http://XubnPRQ5pj.localhost:8080/uaa/saml/SingleLogout/alias/XubnPRQ5pj.cloudfoundry-saml-login\\\"/><md:SingleLogoutService Binding=\\\"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect\\\" Location=\\\"http://XubnPRQ5pj.localhost:8080/uaa/saml/SingleLogout/alias/XubnPRQ5pj.cloudfoundry-saml-login\\\"/><md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</md:NameIDFormat><md:NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</md:NameIDFormat><md:NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</md:NameIDFormat><md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</md:NameIDFormat><md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName</md:NameIDFormat><md:AssertionConsumerService Binding=\\\"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST\\\" Location=\\\"http://XubnPRQ5pj.localhost:8080/uaa/saml/SSO/alias/XubnPRQ5pj.cloudfoundry-saml-login\\\" index=\\\"0\\\" isDefault=\\\"true\\\"/><md:AssertionConsumerService Binding=\\\"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact\\\" Location=\\\"http://XubnPRQ5pj.localhost:8080/uaa/saml/SSO/alias/XubnPRQ5pj.cloudfoundry-saml-login\\\" index=\\\"1\\\"/></md:SPSSODescriptor></md:EntityDescriptor>\",\"singleSignOnServiceIndex\":0,\"metadataTrustCheck\":true,\"skipSslValidation\":false,\"attributeMappings\":{\"given_name\":\"firstname\",\"family_name\":\"lastname\",\"phone_number\":\"phone\"},\"enableIdpInitiatedSso\":true,\"staticCustomAttributes\":{\"organization-emails\":[\"contact@demoorg.com\",\"info@demo.org\"],\"organization-name\":\"The Demo Org\"}}",
      "id" : "04688cb2-df66-48e4-a98b-68d77854689e",
      "entityId" : "XubnPRQ5pj.cloudfoundry-saml-login",
      "name" : "XubnPRQ5pj",
      "version" : 0,
      "created" : 1525217123136,
      "lastModified" : 1525217123136,
      "active" : true,
      "identityZoneId" : "uaa"
    }
    

    Request Headers

    Name Description
    Authorization Bearer token containing sps.read
    X-Identity-Zone-Id If using a zones.<zoneId>.admin scope/token, indicates what zone this request goes to by supplying a zone_id.
    X-Identity-Zone-Subdomain If using a zones.<zoneId>.admin scope/token, indicates what zone this request goes to by supplying a subdomain.

    Path Parameters

    /saml/service-providers/{id}

    Parameter Description
    id Unique ID of the service provider

    Response Fields

    Path Type Description
    id String Unique identifier for this provider - GUID generated by the UAA.
    name String Human readable name for the SAML SP.
    entityId String The entity id of the SAML SP.
    active Boolean Defaults to true.
    created Number UAA sets this to the UTC creation date.
    identityZoneId String Set to the zone that this provider will be active in. Determined by either.
    lastModified Number UAA sets this to the UTC last date of modification.
    version Number Version of the identity provider data. Clients can use this.
    config String Contains metaDataLocation and metadataTrustCheck fields as json fields.
    config.metaDataLocation String The SAML SP Metadata - either an XML string or a URL that.
    config.metadataTrustCheck Boolean Determines whether UAA should validate the SAML SP metadata.
    config.attributeMappings.given_name String Map given_name value within UAA to a specified assertion in the SAML response.
    config.attributeMappings.family_name String Map family_name value within UAA to a specified assertion in the SAML response
    config.attributeMappings.phone_number String Map phone_number value within UAA to a specified assertion in the SAML response.
    config.enableIdpInitiatedSso Boolean When set to true, default is false, the service provider supports IDP initiated SSO at the endpoint /saml/idp/initiate?sp=sp_entity_id
    config.staticCustomAttributes Object A map of static attributes that will be sent with every assertion.

    The key is the name of the attribute and the value is the attribute value. If the value is a list, multiple attribute values will be sent with the same named attribute. Currently only xs:string type values are supported.

    Error Codes

    Error Code Description
    403 Forbidden - Insufficient scope

    Create

    $ curl 'http://localhost/saml/service-providers' -i -X POST \
        -H 'Content-Type: application/json' \
        -H 'Authorization: Bearer 16756e75c2b24852943b5e4486b29052' \
        -d '{
      "config" : "{\"metaDataLocation\":\"<?xml version=\\\"1.0\\\" encoding=\\\"UTF-8\\\"?><md:EntityDescriptor xmlns:md=\\\"urn:oasis:names:tc:SAML:2.0:metadata\\\" ID=\\\"k6Od5TmA5Y.cloudfoundry-saml-login\\\" entityID=\\\"k6Od5TmA5Y.cloudfoundry-saml-login\\\"><ds:Signature xmlns:ds=\\\"http://www.w3.org/2000/09/xmldsig#\\\"><ds:SignedInfo><ds:CanonicalizationMethod Algorithm=\\\"http://www.w3.org/2001/10/xml-exc-c14n#\\\"/><ds:SignatureMethod Algorithm=\\\"http://www.w3.org/2000/09/xmldsig#rsa-sha1\\\"/><ds:Reference URI=\\\"#k6Od5TmA5Y.cloudfoundry-saml-login\\\"><ds:Transforms><ds:Transform Algorithm=\\\"http://www.w3.org/2000/09/xmldsig#enveloped-signature\\\"/><ds:Transform Algorithm=\\\"http://www.w3.org/2001/10/xml-exc-c14n#\\\"/></ds:Transforms><ds:DigestMethod Algorithm=\\\"http://www.w3.org/2000/09/xmldsig#sha1\\\"/><ds:DigestValue>zALgjEFJ7jJSwn2AOBH5H8CX93U=</ds:DigestValue></ds:Reference></ds:SignedInfo><ds:SignatureValue>Rp5XH8eT0ek/vlFGzHgIFOeESchOwSYZ9oh4JA9WqQ0jJtvNQ9IttY2QY9XK3n6TbbtPcEKVgljyTfwD5ymp+oMKfIYQC9JsN8mPADN5rjLFgC+xGceWLbcjoNsCJ7x2ZjyWRblSxoOU5qnzxEA3k3Bu+OkV+ZXcSbmgMWoQACg=</ds:SignatureValue><ds:KeyInfo><ds:X509Data><ds:X509Certificate>MIIDSTCCArKgAwIBAgIBADANBgkqhkiG9w0BAQQFADB8MQswCQYDVQQGEwJhdzEOMAwGA1UECBMF\\nYXJ1YmExDjAMBgNVBAoTBWFydWJhMQ4wDAYDVQQHEwVhcnViYTEOMAwGA1UECxMFYXJ1YmExDjAM\\nBgNVBAMTBWFydWJhMR0wGwYJKoZIhvcNAQkBFg5hcnViYUBhcnViYS5hcjAeFw0xNTExMjAyMjI2\\nMjdaFw0xNjExMTkyMjI2MjdaMHwxCzAJBgNVBAYTAmF3MQ4wDAYDVQQIEwVhcnViYTEOMAwGA1UE\\nChMFYXJ1YmExDjAMBgNVBAcTBWFydWJhMQ4wDAYDVQQLEwVhcnViYTEOMAwGA1UEAxMFYXJ1YmEx\\nHTAbBgkqhkiG9w0BCQEWDmFydWJhQGFydWJhLmFyMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKB\\ngQDHtC5gUXxBKpEqZTLkNvFwNGnNIkggNOwOQVNbpO0WVHIivig5L39WqS9u0hnA+O7MCA/KlrAR\\n4bXaeVVhwfUPYBKIpaaTWFQR5cTR1UFZJL/OF9vAfpOwznoD66DDCnQVpbCjtDYWX+x6imxn8HCY\\nxhMol6ZnTbSsFW6VZjFMjQIDAQABo4HaMIHXMB0GA1UdDgQWBBTx0lDzjH/iOBnOSQaSEWQLx1sy\\nGDCBpwYDVR0jBIGfMIGcgBTx0lDzjH/iOBnOSQaSEWQLx1syGKGBgKR+MHwxCzAJBgNVBAYTAmF3\\nMQ4wDAYDVQQIEwVhcnViYTEOMAwGA1UEChMFYXJ1YmExDjAMBgNVBAcTBWFydWJhMQ4wDAYDVQQL\\nEwVhcnViYTEOMAwGA1UEAxMFYXJ1YmExHTAbBgkqhkiG9w0BCQEWDmFydWJhQGFydWJhLmFyggEA\\nMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEEBQADgYEAYvBJ0HOZbbHClXmGUjGs+GS+xC1FO/am\\n2suCSYqNB9dyMXfOWiJ1+TLJk+o/YZt8vuxCKdcZYgl4l/L6PxJ982SRhc83ZW2dkAZI4M0/Ud3o\\nePe84k8jm3A7EvH5wi5hvCkKRpuRBwn3Ei+jCRouxTbzKPsuCVB+1sNyxMTXzf0=</ds:X509Certificate></ds:X509Data></ds:KeyInfo></ds:Signature><md:SPSSODescriptor AuthnRequestsSigned=\\\"true\\\" WantAssertionsSigned=\\\"true\\\" protocolSupportEnumeration=\\\"urn:oasis:names:tc:SAML:2.0:protocol\\\"><md:KeyDescriptor use=\\\"signing\\\"><ds:KeyInfo xmlns:ds=\\\"http://www.w3.org/2000/09/xmldsig#\\\"><ds:X509Data><ds:X509Certificate>MIIDSTCCArKgAwIBAgIBADANBgkqhkiG9w0BAQQFADB8MQswCQYDVQQGEwJhdzEOMAwGA1UECBMF\\nYXJ1YmExDjAMBgNVBAoTBWFydWJhMQ4wDAYDVQQHEwVhcnViYTEOMAwGA1UECxMFYXJ1YmExDjAM\\nBgNVBAMTBWFydWJhMR0wGwYJKoZIhvcNAQkBFg5hcnViYUBhcnViYS5hcjAeFw0xNTExMjAyMjI2\\nMjdaFw0xNjExMTkyMjI2MjdaMHwxCzAJBgNVBAYTAmF3MQ4wDAYDVQQIEwVhcnViYTEOMAwGA1UE\\nChMFYXJ1YmExDjAMBgNVBAcTBWFydWJhMQ4wDAYDVQQLEwVhcnViYTEOMAwGA1UEAxMFYXJ1YmEx\\nHTAbBgkqhkiG9w0BCQEWDmFydWJhQGFydWJhLmFyMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKB\\ngQDHtC5gUXxBKpEqZTLkNvFwNGnNIkggNOwOQVNbpO0WVHIivig5L39WqS9u0hnA+O7MCA/KlrAR\\n4bXaeVVhwfUPYBKIpaaTWFQR5cTR1UFZJL/OF9vAfpOwznoD66DDCnQVpbCjtDYWX+x6imxn8HCY\\nxhMol6ZnTbSsFW6VZjFMjQIDAQABo4HaMIHXMB0GA1UdDgQWBBTx0lDzjH/iOBnOSQaSEWQLx1sy\\nGDCBpwYDVR0jBIGfMIGcgBTx0lDzjH/iOBnOSQaSEWQLx1syGKGBgKR+MHwxCzAJBgNVBAYTAmF3\\nMQ4wDAYDVQQIEwVhcnViYTEOMAwGA1UEChMFYXJ1YmExDjAMBgNVBAcTBWFydWJhMQ4wDAYDVQQL\\nEwVhcnViYTEOMAwGA1UEAxMFYXJ1YmExHTAbBgkqhkiG9w0BCQEWDmFydWJhQGFydWJhLmFyggEA\\nMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEEBQADgYEAYvBJ0HOZbbHClXmGUjGs+GS+xC1FO/am\\n2suCSYqNB9dyMXfOWiJ1+TLJk+o/YZt8vuxCKdcZYgl4l/L6PxJ982SRhc83ZW2dkAZI4M0/Ud3o\\nePe84k8jm3A7EvH5wi5hvCkKRpuRBwn3Ei+jCRouxTbzKPsuCVB+1sNyxMTXzf0=</ds:X509Certificate></ds:X509Data></ds:KeyInfo></md:KeyDescriptor><md:KeyDescriptor use=\\\"encryption\\\"><ds:KeyInfo xmlns:ds=\\\"http://www.w3.org/2000/09/xmldsig#\\\"><ds:X509Data><ds:X509Certificate>MIIDSTCCArKgAwIBAgIBADANBgkqhkiG9w0BAQQFADB8MQswCQYDVQQGEwJhdzEOMAwGA1UECBMF\\nYXJ1YmExDjAMBgNVBAoTBWFydWJhMQ4wDAYDVQQHEwVhcnViYTEOMAwGA1UECxMFYXJ1YmExDjAM\\nBgNVBAMTBWFydWJhMR0wGwYJKoZIhvcNAQkBFg5hcnViYUBhcnViYS5hcjAeFw0xNTExMjAyMjI2\\nMjdaFw0xNjExMTkyMjI2MjdaMHwxCzAJBgNVBAYTAmF3MQ4wDAYDVQQIEwVhcnViYTEOMAwGA1UE\\nChMFYXJ1YmExDjAMBgNVBAcTBWFydWJhMQ4wDAYDVQQLEwVhcnViYTEOMAwGA1UEAxMFYXJ1YmEx\\nHTAbBgkqhkiG9w0BCQEWDmFydWJhQGFydWJhLmFyMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKB\\ngQDHtC5gUXxBKpEqZTLkNvFwNGnNIkggNOwOQVNbpO0WVHIivig5L39WqS9u0hnA+O7MCA/KlrAR\\n4bXaeVVhwfUPYBKIpaaTWFQR5cTR1UFZJL/OF9vAfpOwznoD66DDCnQVpbCjtDYWX+x6imxn8HCY\\nxhMol6ZnTbSsFW6VZjFMjQIDAQABo4HaMIHXMB0GA1UdDgQWBBTx0lDzjH/iOBnOSQaSEWQLx1sy\\nGDCBpwYDVR0jBIGfMIGcgBTx0lDzjH/iOBnOSQaSEWQLx1syGKGBgKR+MHwxCzAJBgNVBAYTAmF3\\nMQ4wDAYDVQQIEwVhcnViYTEOMAwGA1UEChMFYXJ1YmExDjAMBgNVBAcTBWFydWJhMQ4wDAYDVQQL\\nEwVhcnViYTEOMAwGA1UEAxMFYXJ1YmExHTAbBgkqhkiG9w0BCQEWDmFydWJhQGFydWJhLmFyggEA\\nMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEEBQADgYEAYvBJ0HOZbbHClXmGUjGs+GS+xC1FO/am\\n2suCSYqNB9dyMXfOWiJ1+TLJk+o/YZt8vuxCKdcZYgl4l/L6PxJ982SRhc83ZW2dkAZI4M0/Ud3o\\nePe84k8jm3A7EvH5wi5hvCkKRpuRBwn3Ei+jCRouxTbzKPsuCVB+1sNyxMTXzf0=</ds:X509Certificate></ds:X509Data></ds:KeyInfo></md:KeyDescriptor><md:SingleLogoutService Binding=\\\"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST\\\" Location=\\\"http://k6Od5TmA5Y.localhost:8080/uaa/saml/SingleLogout/alias/k6Od5TmA5Y.cloudfoundry-saml-login\\\"/><md:SingleLogoutService Binding=\\\"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect\\\" Location=\\\"http://k6Od5TmA5Y.localhost:8080/uaa/saml/SingleLogout/alias/k6Od5TmA5Y.cloudfoundry-saml-login\\\"/><md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</md:NameIDFormat><md:NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</md:NameIDFormat><md:NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</md:NameIDFormat><md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</md:NameIDFormat><md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName</md:NameIDFormat><md:AssertionConsumerService Binding=\\\"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST\\\" Location=\\\"http://k6Od5TmA5Y.localhost:8080/uaa/saml/SSO/alias/k6Od5TmA5Y.cloudfoundry-saml-login\\\" index=\\\"0\\\" isDefault=\\\"true\\\"/><md:AssertionConsumerService Binding=\\\"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact\\\" Location=\\\"http://k6Od5TmA5Y.localhost:8080/uaa/saml/SSO/alias/k6Od5TmA5Y.cloudfoundry-saml-login\\\" index=\\\"1\\\"/></md:SPSSODescriptor></md:EntityDescriptor>\",\"singleSignOnServiceIndex\":0,\"metadataTrustCheck\":true,\"skipSslValidation\":false,\"attributeMappings\":{\"given_name\":\"firstname\",\"family_name\":\"lastname\",\"phone_number\":\"phone\"},\"enableIdpInitiatedSso\":true,\"staticCustomAttributes\":{\"organization-emails\":[\"contact@demoorg.com\",\"info@demo.org\"],\"organization-name\":\"The Demo Org\"}}",
      "id" : null,
      "entityId" : "k6Od5TmA5Y.cloudfoundry-saml-login",
      "name" : "k6Od5TmA5Y",
      "version" : 0,
      "created" : null,
      "lastModified" : null,
      "active" : true,
      "identityZoneId" : null
    }'
    
    POST /saml/service-providers HTTP/1.1
    Content-Type: application/json
    Authorization: Bearer 16756e75c2b24852943b5e4486b29052
    Host: localhost
    Content-Length: 7241
    
    {
      "config" : "{\"metaDataLocation\":\"<?xml version=\\\"1.0\\\" encoding=\\\"UTF-8\\\"?><md:EntityDescriptor xmlns:md=\\\"urn:oasis:names:tc:SAML:2.0:metadata\\\" ID=\\\"k6Od5TmA5Y.cloudfoundry-saml-login\\\" entityID=\\\"k6Od5TmA5Y.cloudfoundry-saml-login\\\"><ds:Signature xmlns:ds=\\\"http://www.w3.org/2000/09/xmldsig#\\\"><ds:SignedInfo><ds:CanonicalizationMethod Algorithm=\\\"http://www.w3.org/2001/10/xml-exc-c14n#\\\"/><ds:SignatureMethod Algorithm=\\\"http://www.w3.org/2000/09/xmldsig#rsa-sha1\\\"/><ds:Reference URI=\\\"#k6Od5TmA5Y.cloudfoundry-saml-login\\\"><ds:Transforms><ds:Transform Algorithm=\\\"http://www.w3.org/2000/09/xmldsig#enveloped-signature\\\"/><ds:Transform Algorithm=\\\"http://www.w3.org/2001/10/xml-exc-c14n#\\\"/></ds:Transforms><ds:DigestMethod Algorithm=\\\"http://www.w3.org/2000/09/xmldsig#sha1\\\"/><ds:DigestValue>zALgjEFJ7jJSwn2AOBH5H8CX93U=</ds:DigestValue></ds:Reference></ds:SignedInfo><ds:SignatureValue>Rp5XH8eT0ek/vlFGzHgIFOeESchOwSYZ9oh4JA9WqQ0jJtvNQ9IttY2QY9XK3n6TbbtPcEKVgljyTfwD5ymp+oMKfIYQC9JsN8mPADN5rjLFgC+xGceWLbcjoNsCJ7x2ZjyWRblSxoOU5qnzxEA3k3Bu+OkV+ZXcSbmgMWoQACg=</ds:SignatureValue><ds:KeyInfo><ds:X509Data><ds:X509Certificate>MIIDSTCCArKgAwIBAgIBADANBgkqhkiG9w0BAQQFADB8MQswCQYDVQQGEwJhdzEOMAwGA1UECBMF\\nYXJ1YmExDjAMBgNVBAoTBWFydWJhMQ4wDAYDVQQHEwVhcnViYTEOMAwGA1UECxMFYXJ1YmExDjAM\\nBgNVBAMTBWFydWJhMR0wGwYJKoZIhvcNAQkBFg5hcnViYUBhcnViYS5hcjAeFw0xNTExMjAyMjI2\\nMjdaFw0xNjExMTkyMjI2MjdaMHwxCzAJBgNVBAYTAmF3MQ4wDAYDVQQIEwVhcnViYTEOMAwGA1UE\\nChMFYXJ1YmExDjAMBgNVBAcTBWFydWJhMQ4wDAYDVQQLEwVhcnViYTEOMAwGA1UEAxMFYXJ1YmEx\\nHTAbBgkqhkiG9w0BCQEWDmFydWJhQGFydWJhLmFyMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKB\\ngQDHtC5gUXxBKpEqZTLkNvFwNGnNIkggNOwOQVNbpO0WVHIivig5L39WqS9u0hnA+O7MCA/KlrAR\\n4bXaeVVhwfUPYBKIpaaTWFQR5cTR1UFZJL/OF9vAfpOwznoD66DDCnQVpbCjtDYWX+x6imxn8HCY\\nxhMol6ZnTbSsFW6VZjFMjQIDAQABo4HaMIHXMB0GA1UdDgQWBBTx0lDzjH/iOBnOSQaSEWQLx1sy\\nGDCBpwYDVR0jBIGfMIGcgBTx0lDzjH/iOBnOSQaSEWQLx1syGKGBgKR+MHwxCzAJBgNVBAYTAmF3\\nMQ4wDAYDVQQIEwVhcnViYTEOMAwGA1UEChMFYXJ1YmExDjAMBgNVBAcTBWFydWJhMQ4wDAYDVQQL\\nEwVhcnViYTEOMAwGA1UEAxMFYXJ1YmExHTAbBgkqhkiG9w0BCQEWDmFydWJhQGFydWJhLmFyggEA\\nMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEEBQADgYEAYvBJ0HOZbbHClXmGUjGs+GS+xC1FO/am\\n2suCSYqNB9dyMXfOWiJ1+TLJk+o/YZt8vuxCKdcZYgl4l/L6PxJ982SRhc83ZW2dkAZI4M0/Ud3o\\nePe84k8jm3A7EvH5wi5hvCkKRpuRBwn3Ei+jCRouxTbzKPsuCVB+1sNyxMTXzf0=</ds:X509Certificate></ds:X509Data></ds:KeyInfo></ds:Signature><md:SPSSODescriptor AuthnRequestsSigned=\\\"true\\\" WantAssertionsSigned=\\\"true\\\" protocolSupportEnumeration=\\\"urn:oasis:names:tc:SAML:2.0:protocol\\\"><md:KeyDescriptor use=\\\"signing\\\"><ds:KeyInfo xmlns:ds=\\\"http://www.w3.org/2000/09/xmldsig#\\\"><ds:X509Data><ds:X509Certificate>MIIDSTCCArKgAwIBAgIBADANBgkqhkiG9w0BAQQFADB8MQswCQYDVQQGEwJhdzEOMAwGA1UECBMF\\nYXJ1YmExDjAMBgNVBAoTBWFydWJhMQ4wDAYDVQQHEwVhcnViYTEOMAwGA1UECxMFYXJ1YmExDjAM\\nBgNVBAMTBWFydWJhMR0wGwYJKoZIhvcNAQkBFg5hcnViYUBhcnViYS5hcjAeFw0xNTExMjAyMjI2\\nMjdaFw0xNjExMTkyMjI2MjdaMHwxCzAJBgNVBAYTAmF3MQ4wDAYDVQQIEwVhcnViYTEOMAwGA1UE\\nChMFYXJ1YmExDjAMBgNVBAcTBWFydWJhMQ4wDAYDVQQLEwVhcnViYTEOMAwGA1UEAxMFYXJ1YmEx\\nHTAbBgkqhkiG9w0BCQEWDmFydWJhQGFydWJhLmFyMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKB\\ngQDHtC5gUXxBKpEqZTLkNvFwNGnNIkggNOwOQVNbpO0WVHIivig5L39WqS9u0hnA+O7MCA/KlrAR\\n4bXaeVVhwfUPYBKIpaaTWFQR5cTR1UFZJL/OF9vAfpOwznoD66DDCnQVpbCjtDYWX+x6imxn8HCY\\nxhMol6ZnTbSsFW6VZjFMjQIDAQABo4HaMIHXMB0GA1UdDgQWBBTx0lDzjH/iOBnOSQaSEWQLx1sy\\nGDCBpwYDVR0jBIGfMIGcgBTx0lDzjH/iOBnOSQaSEWQLx1syGKGBgKR+MHwxCzAJBgNVBAYTAmF3\\nMQ4wDAYDVQQIEwVhcnViYTEOMAwGA1UEChMFYXJ1YmExDjAMBgNVBAcTBWFydWJhMQ4wDAYDVQQL\\nEwVhcnViYTEOMAwGA1UEAxMFYXJ1YmExHTAbBgkqhkiG9w0BCQEWDmFydWJhQGFydWJhLmFyggEA\\nMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEEBQADgYEAYvBJ0HOZbbHClXmGUjGs+GS+xC1FO/am\\n2suCSYqNB9dyMXfOWiJ1+TLJk+o/YZt8vuxCKdcZYgl4l/L6PxJ982SRhc83ZW2dkAZI4M0/Ud3o\\nePe84k8jm3A7EvH5wi5hvCkKRpuRBwn3Ei+jCRouxTbzKPsuCVB+1sNyxMTXzf0=</ds:X509Certificate></ds:X509Data></ds:KeyInfo></md:KeyDescriptor><md:KeyDescriptor use=\\\"encryption\\\"><ds:KeyInfo xmlns:ds=\\\"http://www.w3.org/2000/09/xmldsig#\\\"><ds:X509Data><ds:X509Certificate>MIIDSTCCArKgAwIBAgIBADANBgkqhkiG9w0BAQQFADB8MQswCQYDVQQGEwJhdzEOMAwGA1UECBMF\\nYXJ1YmExDjAMBgNVBAoTBWFydWJhMQ4wDAYDVQQHEwVhcnViYTEOMAwGA1UECxMFYXJ1YmExDjAM\\nBgNVBAMTBWFydWJhMR0wGwYJKoZIhvcNAQkBFg5hcnViYUBhcnViYS5hcjAeFw0xNTExMjAyMjI2\\nMjdaFw0xNjExMTkyMjI2MjdaMHwxCzAJBgNVBAYTAmF3MQ4wDAYDVQQIEwVhcnViYTEOMAwGA1UE\\nChMFYXJ1YmExDjAMBgNVBAcTBWFydWJhMQ4wDAYDVQQLEwVhcnViYTEOMAwGA1UEAxMFYXJ1YmEx\\nHTAbBgkqhkiG9w0BCQEWDmFydWJhQGFydWJhLmFyMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKB\\ngQDHtC5gUXxBKpEqZTLkNvFwNGnNIkggNOwOQVNbpO0WVHIivig5L39WqS9u0hnA+O7MCA/KlrAR\\n4bXaeVVhwfUPYBKIpaaTWFQR5cTR1UFZJL/OF9vAfpOwznoD66DDCnQVpbCjtDYWX+x6imxn8HCY\\nxhMol6ZnTbSsFW6VZjFMjQIDAQABo4HaMIHXMB0GA1UdDgQWBBTx0lDzjH/iOBnOSQaSEWQLx1sy\\nGDCBpwYDVR0jBIGfMIGcgBTx0lDzjH/iOBnOSQaSEWQLx1syGKGBgKR+MHwxCzAJBgNVBAYTAmF3\\nMQ4wDAYDVQQIEwVhcnViYTEOMAwGA1UEChMFYXJ1YmExDjAMBgNVBAcTBWFydWJhMQ4wDAYDVQQL\\nEwVhcnViYTEOMAwGA1UEAxMFYXJ1YmExHTAbBgkqhkiG9w0BCQEWDmFydWJhQGFydWJhLmFyggEA\\nMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEEBQADgYEAYvBJ0HOZbbHClXmGUjGs+GS+xC1FO/am\\n2suCSYqNB9dyMXfOWiJ1+TLJk+o/YZt8vuxCKdcZYgl4l/L6PxJ982SRhc83ZW2dkAZI4M0/Ud3o\\nePe84k8jm3A7EvH5wi5hvCkKRpuRBwn3Ei+jCRouxTbzKPsuCVB+1sNyxMTXzf0=</ds:X509Certificate></ds:X509Data></ds:KeyInfo></md:KeyDescriptor><md:SingleLogoutService Binding=\\\"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST\\\" Location=\\\"http://k6Od5TmA5Y.localhost:8080/uaa/saml/SingleLogout/alias/k6Od5TmA5Y.cloudfoundry-saml-login\\\"/><md:SingleLogoutService Binding=\\\"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect\\\" Location=\\\"http://k6Od5TmA5Y.localhost:8080/uaa/saml/SingleLogout/alias/k6Od5TmA5Y.cloudfoundry-saml-login\\\"/><md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</md:NameIDFormat><md:NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</md:NameIDFormat><md:NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</md:NameIDFormat><md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</md:NameIDFormat><md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName</md:NameIDFormat><md:AssertionConsumerService Binding=\\\"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST\\\" Location=\\\"http://k6Od5TmA5Y.localhost:8080/uaa/saml/SSO/alias/k6Od5TmA5Y.cloudfoundry-saml-login\\\" index=\\\"0\\\" isDefault=\\\"true\\\"/><md:AssertionConsumerService Binding=\\\"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact\\\" Location=\\\"http://k6Od5TmA5Y.localhost:8080/uaa/saml/SSO/alias/k6Od5TmA5Y.cloudfoundry-saml-login\\\" index=\\\"1\\\"/></md:SPSSODescriptor></md:EntityDescriptor>\",\"singleSignOnServiceIndex\":0,\"metadataTrustCheck\":true,\"skipSslValidation\":false,\"attributeMappings\":{\"given_name\":\"firstname\",\"family_name\":\"lastname\",\"phone_number\":\"phone\"},\"enableIdpInitiatedSso\":true,\"staticCustomAttributes\":{\"organization-emails\":[\"contact@demoorg.com\",\"info@demo.org\"],\"organization-name\":\"The Demo Org\"}}",
      "id" : null,
      "entityId" : "k6Od5TmA5Y.cloudfoundry-saml-login",
      "name" : "k6Od5TmA5Y",
      "version" : 0,
      "created" : null,
      "lastModified" : null,
      "active" : true,
      "identityZoneId" : null
    }
    
    HTTP/1.1 201 Created
    X-B3-TraceId: a149e220-847c-444f-83ce-530e6ffe1bd1
    Cache-Control: no-cache, no-store, max-age=0, must-revalidate
    Pragma: no-cache
    Expires: 0
    X-XSS-Protection: 1; mode=block
    X-Frame-Options: DENY
    X-Content-Type-Options: nosniff
    Content-Type: application/json;charset=UTF-8
    Content-Length: 7294
    
    {
      "config" : "{\"metaDataLocation\":\"<?xml version=\\\"1.0\\\" encoding=\\\"UTF-8\\\"?><md:EntityDescriptor xmlns:md=\\\"urn:oasis:names:tc:SAML:2.0:metadata\\\" ID=\\\"k6Od5TmA5Y.cloudfoundry-saml-login\\\" entityID=\\\"k6Od5TmA5Y.cloudfoundry-saml-login\\\"><ds:Signature xmlns:ds=\\\"http://www.w3.org/2000/09/xmldsig#\\\"><ds:SignedInfo><ds:CanonicalizationMethod Algorithm=\\\"http://www.w3.org/2001/10/xml-exc-c14n#\\\"/><ds:SignatureMethod Algorithm=\\\"http://www.w3.org/2000/09/xmldsig#rsa-sha1\\\"/><ds:Reference URI=\\\"#k6Od5TmA5Y.cloudfoundry-saml-login\\\"><ds:Transforms><ds:Transform Algorithm=\\\"http://www.w3.org/2000/09/xmldsig#enveloped-signature\\\"/><ds:Transform Algorithm=\\\"http://www.w3.org/2001/10/xml-exc-c14n#\\\"/></ds:Transforms><ds:DigestMethod Algorithm=\\\"http://www.w3.org/2000/09/xmldsig#sha1\\\"/><ds:DigestValue>zALgjEFJ7jJSwn2AOBH5H8CX93U=</ds:DigestValue></ds:Reference></ds:SignedInfo><ds:SignatureValue>Rp5XH8eT0ek/vlFGzHgIFOeESchOwSYZ9oh4JA9WqQ0jJtvNQ9IttY2QY9XK3n6TbbtPcEKVgljyTfwD5ymp+oMKfIYQC9JsN8mPADN5rjLFgC+xGceWLbcjoNsCJ7x2ZjyWRblSxoOU5qnzxEA3k3Bu+OkV+ZXcSbmgMWoQACg=</ds:SignatureValue><ds:KeyInfo><ds:X509Data><ds:X509Certificate>MIIDSTCCArKgAwIBAgIBADANBgkqhkiG9w0BAQQFADB8MQswCQYDVQQGEwJhdzEOMAwGA1UECBMF\\nYXJ1YmExDjAMBgNVBAoTBWFydWJhMQ4wDAYDVQQHEwVhcnViYTEOMAwGA1UECxMFYXJ1YmExDjAM\\nBgNVBAMTBWFydWJhMR0wGwYJKoZIhvcNAQkBFg5hcnViYUBhcnViYS5hcjAeFw0xNTExMjAyMjI2\\nMjdaFw0xNjExMTkyMjI2MjdaMHwxCzAJBgNVBAYTAmF3MQ4wDAYDVQQIEwVhcnViYTEOMAwGA1UE\\nChMFYXJ1YmExDjAMBgNVBAcTBWFydWJhMQ4wDAYDVQQLEwVhcnViYTEOMAwGA1UEAxMFYXJ1YmEx\\nHTAbBgkqhkiG9w0BCQEWDmFydWJhQGFydWJhLmFyMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKB\\ngQDHtC5gUXxBKpEqZTLkNvFwNGnNIkggNOwOQVNbpO0WVHIivig5L39WqS9u0hnA+O7MCA/KlrAR\\n4bXaeVVhwfUPYBKIpaaTWFQR5cTR1UFZJL/OF9vAfpOwznoD66DDCnQVpbCjtDYWX+x6imxn8HCY\\nxhMol6ZnTbSsFW6VZjFMjQIDAQABo4HaMIHXMB0GA1UdDgQWBBTx0lDzjH/iOBnOSQaSEWQLx1sy\\nGDCBpwYDVR0jBIGfMIGcgBTx0lDzjH/iOBnOSQaSEWQLx1syGKGBgKR+MHwxCzAJBgNVBAYTAmF3\\nMQ4wDAYDVQQIEwVhcnViYTEOMAwGA1UEChMFYXJ1YmExDjAMBgNVBAcTBWFydWJhMQ4wDAYDVQQL\\nEwVhcnViYTEOMAwGA1UEAxMFYXJ1YmExHTAbBgkqhkiG9w0BCQEWDmFydWJhQGFydWJhLmFyggEA\\nMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEEBQADgYEAYvBJ0HOZbbHClXmGUjGs+GS+xC1FO/am\\n2suCSYqNB9dyMXfOWiJ1+TLJk+o/YZt8vuxCKdcZYgl4l/L6PxJ982SRhc83ZW2dkAZI4M0/Ud3o\\nePe84k8jm3A7EvH5wi5hvCkKRpuRBwn3Ei+jCRouxTbzKPsuCVB+1sNyxMTXzf0=</ds:X509Certificate></ds:X509Data></ds:KeyInfo></ds:Signature><md:SPSSODescriptor AuthnRequestsSigned=\\\"true\\\" WantAssertionsSigned=\\\"true\\\" protocolSupportEnumeration=\\\"urn:oasis:names:tc:SAML:2.0:protocol\\\"><md:KeyDescriptor use=\\\"signing\\\"><ds:KeyInfo xmlns:ds=\\\"http://www.w3.org/2000/09/xmldsig#\\\"><ds:X509Data><ds:X509Certificate>MIIDSTCCArKgAwIBAgIBADANBgkqhkiG9w0BAQQFADB8MQswCQYDVQQGEwJhdzEOMAwGA1UECBMF\\nYXJ1YmExDjAMBgNVBAoTBWFydWJhMQ4wDAYDVQQHEwVhcnViYTEOMAwGA1UECxMFYXJ1YmExDjAM\\nBgNVBAMTBWFydWJhMR0wGwYJKoZIhvcNAQkBFg5hcnViYUBhcnViYS5hcjAeFw0xNTExMjAyMjI2\\nMjdaFw0xNjExMTkyMjI2MjdaMHwxCzAJBgNVBAYTAmF3MQ4wDAYDVQQIEwVhcnViYTEOMAwGA1UE\\nChMFYXJ1YmExDjAMBgNVBAcTBWFydWJhMQ4wDAYDVQQLEwVhcnViYTEOMAwGA1UEAxMFYXJ1YmEx\\nHTAbBgkqhkiG9w0BCQEWDmFydWJhQGFydWJhLmFyMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKB\\ngQDHtC5gUXxBKpEqZTLkNvFwNGnNIkggNOwOQVNbpO0WVHIivig5L39WqS9u0hnA+O7MCA/KlrAR\\n4bXaeVVhwfUPYBKIpaaTWFQR5cTR1UFZJL/OF9vAfpOwznoD66DDCnQVpbCjtDYWX+x6imxn8HCY\\nxhMol6ZnTbSsFW6VZjFMjQIDAQABo4HaMIHXMB0GA1UdDgQWBBTx0lDzjH/iOBnOSQaSEWQLx1sy\\nGDCBpwYDVR0jBIGfMIGcgBTx0lDzjH/iOBnOSQaSEWQLx1syGKGBgKR+MHwxCzAJBgNVBAYTAmF3\\nMQ4wDAYDVQQIEwVhcnViYTEOMAwGA1UEChMFYXJ1YmExDjAMBgNVBAcTBWFydWJhMQ4wDAYDVQQL\\nEwVhcnViYTEOMAwGA1UEAxMFYXJ1YmExHTAbBgkqhkiG9w0BCQEWDmFydWJhQGFydWJhLmFyggEA\\nMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEEBQADgYEAYvBJ0HOZbbHClXmGUjGs+GS+xC1FO/am\\n2suCSYqNB9dyMXfOWiJ1+TLJk+o/YZt8vuxCKdcZYgl4l/L6PxJ982SRhc83ZW2dkAZI4M0/Ud3o\\nePe84k8jm3A7EvH5wi5hvCkKRpuRBwn3Ei+jCRouxTbzKPsuCVB+1sNyxMTXzf0=</ds:X509Certificate></ds:X509Data></ds:KeyInfo></md:KeyDescriptor><md:KeyDescriptor use=\\\"encryption\\\"><ds:KeyInfo xmlns:ds=\\\"http://www.w3.org/2000/09/xmldsig#\\\"><ds:X509Data><ds:X509Certificate>MIIDSTCCArKgAwIBAgIBADANBgkqhkiG9w0BAQQFADB8MQswCQYDVQQGEwJhdzEOMAwGA1UECBMF\\nYXJ1YmExDjAMBgNVBAoTBWFydWJhMQ4wDAYDVQQHEwVhcnViYTEOMAwGA1UECxMFYXJ1YmExDjAM\\nBgNVBAMTBWFydWJhMR0wGwYJKoZIhvcNAQkBFg5hcnViYUBhcnViYS5hcjAeFw0xNTExMjAyMjI2\\nMjdaFw0xNjExMTkyMjI2MjdaMHwxCzAJBgNVBAYTAmF3MQ4wDAYDVQQIEwVhcnViYTEOMAwGA1UE\\nChMFYXJ1YmExDjAMBgNVBAcTBWFydWJhMQ4wDAYDVQQLEwVhcnViYTEOMAwGA1UEAxMFYXJ1YmEx\\nHTAbBgkqhkiG9w0BCQEWDmFydWJhQGFydWJhLmFyMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKB\\ngQDHtC5gUXxBKpEqZTLkNvFwNGnNIkggNOwOQVNbpO0WVHIivig5L39WqS9u0hnA+O7MCA/KlrAR\\n4bXaeVVhwfUPYBKIpaaTWFQR5cTR1UFZJL/OF9vAfpOwznoD66DDCnQVpbCjtDYWX+x6imxn8HCY\\nxhMol6ZnTbSsFW6VZjFMjQIDAQABo4HaMIHXMB0GA1UdDgQWBBTx0lDzjH/iOBnOSQaSEWQLx1sy\\nGDCBpwYDVR0jBIGfMIGcgBTx0lDzjH/iOBnOSQaSEWQLx1syGKGBgKR+MHwxCzAJBgNVBAYTAmF3\\nMQ4wDAYDVQQIEwVhcnViYTEOMAwGA1UEChMFYXJ1YmExDjAMBgNVBAcTBWFydWJhMQ4wDAYDVQQL\\nEwVhcnViYTEOMAwGA1UEAxMFYXJ1YmExHTAbBgkqhkiG9w0BCQEWDmFydWJhQGFydWJhLmFyggEA\\nMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEEBQADgYEAYvBJ0HOZbbHClXmGUjGs+GS+xC1FO/am\\n2suCSYqNB9dyMXfOWiJ1+TLJk+o/YZt8vuxCKdcZYgl4l/L6PxJ982SRhc83ZW2dkAZI4M0/Ud3o\\nePe84k8jm3A7EvH5wi5hvCkKRpuRBwn3Ei+jCRouxTbzKPsuCVB+1sNyxMTXzf0=</ds:X509Certificate></ds:X509Data></ds:KeyInfo></md:KeyDescriptor><md:SingleLogoutService Binding=\\\"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST\\\" Location=\\\"http://k6Od5TmA5Y.localhost:8080/uaa/saml/SingleLogout/alias/k6Od5TmA5Y.cloudfoundry-saml-login\\\"/><md:SingleLogoutService Binding=\\\"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect\\\" Location=\\\"http://k6Od5TmA5Y.localhost:8080/uaa/saml/SingleLogout/alias/k6Od5TmA5Y.cloudfoundry-saml-login\\\"/><md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</md:NameIDFormat><md:NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</md:NameIDFormat><md:NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</md:NameIDFormat><md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</md:NameIDFormat><md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName</md:NameIDFormat><md:AssertionConsumerService Binding=\\\"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST\\\" Location=\\\"http://k6Od5TmA5Y.localhost:8080/uaa/saml/SSO/alias/k6Od5TmA5Y.cloudfoundry-saml-login\\\" index=\\\"0\\\" isDefault=\\\"true\\\"/><md:AssertionConsumerService Binding=\\\"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact\\\" Location=\\\"http://k6Od5TmA5Y.localhost:8080/uaa/saml/SSO/alias/k6Od5TmA5Y.cloudfoundry-saml-login\\\" index=\\\"1\\\"/></md:SPSSODescriptor></md:EntityDescriptor>\",\"singleSignOnServiceIndex\":0,\"metadataTrustCheck\":true,\"skipSslValidation\":false,\"attributeMappings\":{\"given_name\":\"firstname\",\"family_name\":\"lastname\",\"phone_number\":\"phone\"},\"enableIdpInitiatedSso\":true,\"staticCustomAttributes\":{\"organization-emails\":[\"contact@demoorg.com\",\"info@demo.org\"],\"organization-name\":\"The Demo Org\"}}",
      "id" : "129741d8-651f-4d45-9f5d-e2437f2cc8d0",
      "entityId" : "k6Od5TmA5Y.cloudfoundry-saml-login",
      "name" : "k6Od5TmA5Y",
      "version" : 0,
      "created" : 1525217123302,
      "lastModified" : 1525217123302,
      "active" : true,
      "identityZoneId" : "uaa"
    }
    

    Request Headers

    Name Description
    Authorization Bearer token containing sps.write
    X-Identity-Zone-Id If using a zones.<zoneId>.admin scope/token, indicates what zone this request goes to by supplying a zone_id.
    X-Identity-Zone-Subdomain If using a zones.<zoneId>.admin scope/token, indicates what zone this request goes to by supplying a subdomain.

    Request Fields

    Path Type Constraints Description
    name String Required Human readable name for the SAML SP.
    entityId String Optional If provided, it should match the entityId in the SP metadata.
    active Boolean Optional Defaults to true
    config String Required Contains metaDataLocation and metadataTrustCheck fields as json fields.
    config.metaDataLocation String Required The SAML SP Metadata - either an XML string or a URL that
    config.attributeMappings.given_name String Optional Map given_name value within UAA to a specified assertion in the SAML response.
    config.attributeMappings.family_name String Optional Map family_name value within UAA to a specified assertion in the SAML response
    config.attributeMappings.phone_number String Optional Map phone_number value within UAA to a specified assertion in the SAML response.
    config.metadataTrustCheck Boolean Optional Determines whether UAA should validate the SAML SP metadata.
    config.enableIdpInitiatedSso Boolean Optional When set to true, default is false, the service provider supports IDP initiated SSO at the endpoint /saml/idp/initiate?sp=sp_entity_id
    config.staticCustomAttributes Object Optional A map of static attributes that will be sent with every assertion.

    The key is the name of the attribute and the value is the attribute value. If the value is a list, multiple attribute values will be sent with the same named attribute. Currently only xs:string type values are supported.

    Response Fields

    Path Type Description
    id String Unique identifier for this provider - GUID generated by the UAA.
    name String Human readable name for the SAML SP.
    entityId String The entity id of the SAML SP.
    active Boolean Defaults to true.
    created Number UAA sets this to the UTC creation date.
    identityZoneId String Set to the zone that this provider will be active in. Determined by either.
    lastModified Number UAA sets this to the UTC last date of modification.
    version Number Version of the identity provider data. Clients can use this.
    config String Contains metaDataLocation and metadataTrustCheck fields as json fields.
    config.metaDataLocation String The SAML SP Metadata - either an XML string or a URL that.
    config.metadataTrustCheck Boolean Determines whether UAA should validate the SAML SP metadata.
    config.attributeMappings.given_name String Map given_name value within UAA to a specified assertion in the SAML response.
    config.attributeMappings.family_name String Map family_name value within UAA to a specified assertion in the SAML response
    config.attributeMappings.phone_number String Map phone_number value within UAA to a specified assertion in the SAML response.
    config.enableIdpInitiatedSso Boolean When set to true, default is false, the service provider supports IDP initiated SSO at the endpoint /saml/idp/initiate?sp=sp_entity_id
    config.staticCustomAttributes Object A map of static attributes that will be sent with every assertion.

    The key is the name of the attribute and the value is the attribute value. If the value is a list, multiple attribute values will be sent with the same named attribute. Currently only xs:string type values are supported.

    Error Codes

    Error Code Description
    403 Forbidden - Insufficient scope
    422 Unprocessable Entity
    409 Conflict - A provider with the same entity id and zone id exists.

    Update

    $ curl 'http://localhost/saml/service-providers/716c76a7-d23b-41b4-bb46-f8aac554aa7f' -i -X PUT \
        -H 'Content-Type: application/json' \
        -H 'Authorization: Bearer afe2a24605a24059a591ab21d72a4c32' \
        -d '{
      "config" : "{\"metaDataLocation\":\"<?xml version=\\\"1.0\\\" encoding=\\\"UTF-8\\\"?><md:EntityDescriptor xmlns:md=\\\"urn:oasis:names:tc:SAML:2.0:metadata\\\" ID=\\\"k1OaREzwh1.cloudfoundry-saml-login\\\" entityID=\\\"k1OaREzwh1.cloudfoundry-saml-login\\\"><ds:Signature xmlns:ds=\\\"http://www.w3.org/2000/09/xmldsig#\\\"><ds:SignedInfo><ds:CanonicalizationMethod Algorithm=\\\"http://www.w3.org/2001/10/xml-exc-c14n#\\\"/><ds:SignatureMethod Algorithm=\\\"http://www.w3.org/2000/09/xmldsig#rsa-sha1\\\"/><ds:Reference URI=\\\"#k1OaREzwh1.cloudfoundry-saml-login\\\"><ds:Transforms><ds:Transform Algorithm=\\\"http://www.w3.org/2000/09/xmldsig#enveloped-signature\\\"/><ds:Transform Algorithm=\\\"http://www.w3.org/2001/10/xml-exc-c14n#\\\"/></ds:Transforms><ds:DigestMethod Algorithm=\\\"http://www.w3.org/2000/09/xmldsig#sha1\\\"/><ds:DigestValue>zALgjEFJ7jJSwn2AOBH5H8CX93U=</ds:DigestValue></ds:Reference></ds:SignedInfo><ds:SignatureValue>Rp5XH8eT0ek/vlFGzHgIFOeESchOwSYZ9oh4JA9WqQ0jJtvNQ9IttY2QY9XK3n6TbbtPcEKVgljyTfwD5ymp+oMKfIYQC9JsN8mPADN5rjLFgC+xGceWLbcjoNsCJ7x2ZjyWRblSxoOU5qnzxEA3k3Bu+OkV+ZXcSbmgMWoQACg=</ds:SignatureValue><ds:KeyInfo><ds:X509Data><ds:X509Certificate>MIIDSTCCArKgAwIBAgIBADANBgkqhkiG9w0BAQQFADB8MQswCQYDVQQGEwJhdzEOMAwGA1UECBMF\\nYXJ1YmExDjAMBgNVBAoTBWFydWJhMQ4wDAYDVQQHEwVhcnViYTEOMAwGA1UECxMFYXJ1YmExDjAM\\nBgNVBAMTBWFydWJhMR0wGwYJKoZIhvcNAQkBFg5hcnViYUBhcnViYS5hcjAeFw0xNTExMjAyMjI2\\nMjdaFw0xNjExMTkyMjI2MjdaMHwxCzAJBgNVBAYTAmF3MQ4wDAYDVQQIEwVhcnViYTEOMAwGA1UE\\nChMFYXJ1YmExDjAMBgNVBAcTBWFydWJhMQ4wDAYDVQQLEwVhcnViYTEOMAwGA1UEAxMFYXJ1YmEx\\nHTAbBgkqhkiG9w0BCQEWDmFydWJhQGFydWJhLmFyMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKB\\ngQDHtC5gUXxBKpEqZTLkNvFwNGnNIkggNOwOQVNbpO0WVHIivig5L39WqS9u0hnA+O7MCA/KlrAR\\n4bXaeVVhwfUPYBKIpaaTWFQR5cTR1UFZJL/OF9vAfpOwznoD66DDCnQVpbCjtDYWX+x6imxn8HCY\\nxhMol6ZnTbSsFW6VZjFMjQIDAQABo4HaMIHXMB0GA1UdDgQWBBTx0lDzjH/iOBnOSQaSEWQLx1sy\\nGDCBpwYDVR0jBIGfMIGcgBTx0lDzjH/iOBnOSQaSEWQLx1syGKGBgKR+MHwxCzAJBgNVBAYTAmF3\\nMQ4wDAYDVQQIEwVhcnViYTEOMAwGA1UEChMFYXJ1YmExDjAMBgNVBAcTBWFydWJhMQ4wDAYDVQQL\\nEwVhcnViYTEOMAwGA1UEAxMFYXJ1YmExHTAbBgkqhkiG9w0BCQEWDmFydWJhQGFydWJhLmFyggEA\\nMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEEBQADgYEAYvBJ0HOZbbHClXmGUjGs+GS+xC1FO/am\\n2suCSYqNB9dyMXfOWiJ1+TLJk+o/YZt8vuxCKdcZYgl4l/L6PxJ982SRhc83ZW2dkAZI4M0/Ud3o\\nePe84k8jm3A7EvH5wi5hvCkKRpuRBwn3Ei+jCRouxTbzKPsuCVB+1sNyxMTXzf0=</ds:X509Certificate></ds:X509Data></ds:KeyInfo></ds:Signature><md:SPSSODescriptor AuthnRequestsSigned=\\\"true\\\" WantAssertionsSigned=\\\"true\\\" protocolSupportEnumeration=\\\"urn:oasis:names:tc:SAML:2.0:protocol\\\"><md:KeyDescriptor use=\\\"signing\\\"><ds:KeyInfo xmlns:ds=\\\"http://www.w3.org/2000/09/xmldsig#\\\"><ds:X509Data><ds:X509Certificate>MIIDSTCCArKgAwIBAgIBADANBgkqhkiG9w0BAQQFADB8MQswCQYDVQQGEwJhdzEOMAwGA1UECBMF\\nYXJ1YmExDjAMBgNVBAoTBWFydWJhMQ4wDAYDVQQHEwVhcnViYTEOMAwGA1UECxMFYXJ1YmExDjAM\\nBgNVBAMTBWFydWJhMR0wGwYJKoZIhvcNAQkBFg5hcnViYUBhcnViYS5hcjAeFw0xNTExMjAyMjI2\\nMjdaFw0xNjExMTkyMjI2MjdaMHwxCzAJBgNVBAYTAmF3MQ4wDAYDVQQIEwVhcnViYTEOMAwGA1UE\\nChMFYXJ1YmExDjAMBgNVBAcTBWFydWJhMQ4wDAYDVQQLEwVhcnViYTEOMAwGA1UEAxMFYXJ1YmEx\\nHTAbBgkqhkiG9w0BCQEWDmFydWJhQGFydWJhLmFyMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKB\\ngQDHtC5gUXxBKpEqZTLkNvFwNGnNIkggNOwOQVNbpO0WVHIivig5L39WqS9u0hnA+O7MCA/KlrAR\\n4bXaeVVhwfUPYBKIpaaTWFQR5cTR1UFZJL/OF9vAfpOwznoD66DDCnQVpbCjtDYWX+x6imxn8HCY\\nxhMol6ZnTbSsFW6VZjFMjQIDAQABo4HaMIHXMB0GA1UdDgQWBBTx0lDzjH/iOBnOSQaSEWQLx1sy\\nGDCBpwYDVR0jBIGfMIGcgBTx0lDzjH/iOBnOSQaSEWQLx1syGKGBgKR+MHwxCzAJBgNVBAYTAmF3\\nMQ4wDAYDVQQIEwVhcnViYTEOMAwGA1UEChMFYXJ1YmExDjAMBgNVBAcTBWFydWJhMQ4wDAYDVQQL\\nEwVhcnViYTEOMAwGA1UEAxMFYXJ1YmExHTAbBgkqhkiG9w0BCQEWDmFydWJhQGFydWJhLmFyggEA\\nMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEEBQADgYEAYvBJ0HOZbbHClXmGUjGs+GS+xC1FO/am\\n2suCSYqNB9dyMXfOWiJ1+TLJk+o/YZt8vuxCKdcZYgl4l/L6PxJ982SRhc83ZW2dkAZI4M0/Ud3o\\nePe84k8jm3A7EvH5wi5hvCkKRpuRBwn3Ei+jCRouxTbzKPsuCVB+1sNyxMTXzf0=</ds:X509Certificate></ds:X509Data></ds:KeyInfo></md:KeyDescriptor><md:KeyDescriptor use=\\\"encryption\\\"><ds:KeyInfo xmlns:ds=\\\"http://www.w3.org/2000/09/xmldsig#\\\"><ds:X509Data><ds:X509Certificate>MIIDSTCCArKgAwIBAgIBADANBgkqhkiG9w0BAQQFADB8MQswCQYDVQQGEwJhdzEOMAwGA1UECBMF\\nYXJ1YmExDjAMBgNVBAoTBWFydWJhMQ4wDAYDVQQHEwVhcnViYTEOMAwGA1UECxMFYXJ1YmExDjAM\\nBgNVBAMTBWFydWJhMR0wGwYJKoZIhvcNAQkBFg5hcnViYUBhcnViYS5hcjAeFw0xNTExMjAyMjI2\\nMjdaFw0xNjExMTkyMjI2MjdaMHwxCzAJBgNVBAYTAmF3MQ4wDAYDVQQIEwVhcnViYTEOMAwGA1UE\\nChMFYXJ1YmExDjAMBgNVBAcTBWFydWJhMQ4wDAYDVQQLEwVhcnViYTEOMAwGA1UEAxMFYXJ1YmEx\\nHTAbBgkqhkiG9w0BCQEWDmFydWJhQGFydWJhLmFyMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKB\\ngQDHtC5gUXxBKpEqZTLkNvFwNGnNIkggNOwOQVNbpO0WVHIivig5L39WqS9u0hnA+O7MCA/KlrAR\\n4bXaeVVhwfUPYBKIpaaTWFQR5cTR1UFZJL/OF9vAfpOwznoD66DDCnQVpbCjtDYWX+x6imxn8HCY\\nxhMol6ZnTbSsFW6VZjFMjQIDAQABo4HaMIHXMB0GA1UdDgQWBBTx0lDzjH/iOBnOSQaSEWQLx1sy\\nGDCBpwYDVR0jBIGfMIGcgBTx0lDzjH/iOBnOSQaSEWQLx1syGKGBgKR+MHwxCzAJBgNVBAYTAmF3\\nMQ4wDAYDVQQIEwVhcnViYTEOMAwGA1UEChMFYXJ1YmExDjAMBgNVBAcTBWFydWJhMQ4wDAYDVQQL\\nEwVhcnViYTEOMAwGA1UEAxMFYXJ1YmExHTAbBgkqhkiG9w0BCQEWDmFydWJhQGFydWJhLmFyggEA\\nMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEEBQADgYEAYvBJ0HOZbbHClXmGUjGs+GS+xC1FO/am\\n2suCSYqNB9dyMXfOWiJ1+TLJk+o/YZt8vuxCKdcZYgl4l/L6PxJ982SRhc83ZW2dkAZI4M0/Ud3o\\nePe84k8jm3A7EvH5wi5hvCkKRpuRBwn3Ei+jCRouxTbzKPsuCVB+1sNyxMTXzf0=</ds:X509Certificate></ds:X509Data></ds:KeyInfo></md:KeyDescriptor><md:SingleLogoutService Binding=\\\"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST\\\" Location=\\\"http://k1OaREzwh1.localhost:8080/uaa/saml/SingleLogout/alias/k1OaREzwh1.cloudfoundry-saml-login\\\"/><md:SingleLogoutService Binding=\\\"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect\\\" Location=\\\"http://k1OaREzwh1.localhost:8080/uaa/saml/SingleLogout/alias/k1OaREzwh1.cloudfoundry-saml-login\\\"/><md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</md:NameIDFormat><md:NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</md:NameIDFormat><md:NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</md:NameIDFormat><md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</md:NameIDFormat><md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName</md:NameIDFormat><md:AssertionConsumerService Binding=\\\"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST\\\" Location=\\\"http://k1OaREzwh1.localhost:8080/uaa/saml/SSO/alias/k1OaREzwh1.cloudfoundry-saml-login\\\" index=\\\"0\\\" isDefault=\\\"true\\\"/><md:AssertionConsumerService Binding=\\\"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact\\\" Location=\\\"http://k1OaREzwh1.localhost:8080/uaa/saml/SSO/alias/k1OaREzwh1.cloudfoundry-saml-login\\\" index=\\\"1\\\"/></md:SPSSODescriptor></md:EntityDescriptor>\",\"singleSignOnServiceIndex\":0,\"metadataTrustCheck\":true,\"skipSslValidation\":false,\"attributeMappings\":{\"given_name\":\"firstname\",\"family_name\":\"lastname\",\"phone_number\":\"phone\"},\"enableIdpInitiatedSso\":true,\"staticCustomAttributes\":{\"organization-emails\":[\"contact@demoorg.com\",\"info@demo.org\"],\"portal-id\":\"346-asd-3412\",\"organization-name\":\"The Demo Org\"}}",
      "id" : null,
      "entityId" : "k1OaREzwh1.cloudfoundry-saml-login",
      "name" : "k1OaREzwh1",
      "version" : 0,
      "created" : null,
      "lastModified" : null,
      "active" : true,
      "identityZoneId" : null
    }'
    
    PUT /saml/service-providers/716c76a7-d23b-41b4-bb46-f8aac554aa7f HTTP/1.1
    Content-Type: application/json
    Authorization: Bearer afe2a24605a24059a591ab21d72a4c32
    Host: localhost
    Content-Length: 7272
    
    {
      "config" : "{\"metaDataLocation\":\"<?xml version=\\\"1.0\\\" encoding=\\\"UTF-8\\\"?><md:EntityDescriptor xmlns:md=\\\"urn:oasis:names:tc:SAML:2.0:metadata\\\" ID=\\\"k1OaREzwh1.cloudfoundry-saml-login\\\" entityID=\\\"k1OaREzwh1.cloudfoundry-saml-login\\\"><ds:Signature xmlns:ds=\\\"http://www.w3.org/2000/09/xmldsig#\\\"><ds:SignedInfo><ds:CanonicalizationMethod Algorithm=\\\"http://www.w3.org/2001/10/xml-exc-c14n#\\\"/><ds:SignatureMethod Algorithm=\\\"http://www.w3.org/2000/09/xmldsig#rsa-sha1\\\"/><ds:Reference URI=\\\"#k1OaREzwh1.cloudfoundry-saml-login\\\"><ds:Transforms><ds:Transform Algorithm=\\\"http://www.w3.org/2000/09/xmldsig#enveloped-signature\\\"/><ds:Transform Algorithm=\\\"http://www.w3.org/2001/10/xml-exc-c14n#\\\"/></ds:Transforms><ds:DigestMethod Algorithm=\\\"http://www.w3.org/2000/09/xmldsig#sha1\\\"/><ds:DigestValue>zALgjEFJ7jJSwn2AOBH5H8CX93U=</ds:DigestValue></ds:Reference></ds:SignedInfo><ds:SignatureValue>Rp5XH8eT0ek/vlFGzHgIFOeESchOwSYZ9oh4JA9WqQ0jJtvNQ9IttY2QY9XK3n6TbbtPcEKVgljyTfwD5ymp+oMKfIYQC9JsN8mPADN5rjLFgC+xGceWLbcjoNsCJ7x2ZjyWRblSxoOU5qnzxEA3k3Bu+OkV+ZXcSbmgMWoQACg=</ds:SignatureValue><ds:KeyInfo><ds:X509Data><ds:X509Certificate>MIIDSTCCArKgAwIBAgIBADANBgkqhkiG9w0BAQQFADB8MQswCQYDVQQGEwJhdzEOMAwGA1UECBMF\\nYXJ1YmExDjAMBgNVBAoTBWFydWJhMQ4wDAYDVQQHEwVhcnViYTEOMAwGA1UECxMFYXJ1YmExDjAM\\nBgNVBAMTBWFydWJhMR0wGwYJKoZIhvcNAQkBFg5hcnViYUBhcnViYS5hcjAeFw0xNTExMjAyMjI2\\nMjdaFw0xNjExMTkyMjI2MjdaMHwxCzAJBgNVBAYTAmF3MQ4wDAYDVQQIEwVhcnViYTEOMAwGA1UE\\nChMFYXJ1YmExDjAMBgNVBAcTBWFydWJhMQ4wDAYDVQQLEwVhcnViYTEOMAwGA1UEAxMFYXJ1YmEx\\nHTAbBgkqhkiG9w0BCQEWDmFydWJhQGFydWJhLmFyMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKB\\ngQDHtC5gUXxBKpEqZTLkNvFwNGnNIkggNOwOQVNbpO0WVHIivig5L39WqS9u0hnA+O7MCA/KlrAR\\n4bXaeVVhwfUPYBKIpaaTWFQR5cTR1UFZJL/OF9vAfpOwznoD66DDCnQVpbCjtDYWX+x6imxn8HCY\\nxhMol6ZnTbSsFW6VZjFMjQIDAQABo4HaMIHXMB0GA1UdDgQWBBTx0lDzjH/iOBnOSQaSEWQLx1sy\\nGDCBpwYDVR0jBIGfMIGcgBTx0lDzjH/iOBnOSQaSEWQLx1syGKGBgKR+MHwxCzAJBgNVBAYTAmF3\\nMQ4wDAYDVQQIEwVhcnViYTEOMAwGA1UEChMFYXJ1YmExDjAMBgNVBAcTBWFydWJhMQ4wDAYDVQQL\\nEwVhcnViYTEOMAwGA1UEAxMFYXJ1YmExHTAbBgkqhkiG9w0BCQEWDmFydWJhQGFydWJhLmFyggEA\\nMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEEBQADgYEAYvBJ0HOZbbHClXmGUjGs+GS+xC1FO/am\\n2suCSYqNB9dyMXfOWiJ1+TLJk+o/YZt8vuxCKdcZYgl4l/L6PxJ982SRhc83ZW2dkAZI4M0/Ud3o\\nePe84k8jm3A7EvH5wi5hvCkKRpuRBwn3Ei+jCRouxTbzKPsuCVB+1sNyxMTXzf0=</ds:X509Certificate></ds:X509Data></ds:KeyInfo></ds:Signature><md:SPSSODescriptor AuthnRequestsSigned=\\\"true\\\" WantAssertionsSigned=\\\"true\\\" protocolSupportEnumeration=\\\"urn:oasis:names:tc:SAML:2.0:protocol\\\"><md:KeyDescriptor use=\\\"signing\\\"><ds:KeyInfo xmlns:ds=\\\"http://www.w3.org/2000/09/xmldsig#\\\"><ds:X509Data><ds:X509Certificate>MIIDSTCCArKgAwIBAgIBADANBgkqhkiG9w0BAQQFADB8MQswCQYDVQQGEwJhdzEOMAwGA1UECBMF\\nYXJ1YmExDjAMBgNVBAoTBWFydWJhMQ4wDAYDVQQHEwVhcnViYTEOMAwGA1UECxMFYXJ1YmExDjAM\\nBgNVBAMTBWFydWJhMR0wGwYJKoZIhvcNAQkBFg5hcnViYUBhcnViYS5hcjAeFw0xNTExMjAyMjI2\\nMjdaFw0xNjExMTkyMjI2MjdaMHwxCzAJBgNVBAYTAmF3MQ4wDAYDVQQIEwVhcnViYTEOMAwGA1UE\\nChMFYXJ1YmExDjAMBgNVBAcTBWFydWJhMQ4wDAYDVQQLEwVhcnViYTEOMAwGA1UEAxMFYXJ1YmEx\\nHTAbBgkqhkiG9w0BCQEWDmFydWJhQGFydWJhLmFyMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKB\\ngQDHtC5gUXxBKpEqZTLkNvFwNGnNIkggNOwOQVNbpO0WVHIivig5L39WqS9u0hnA+O7MCA/KlrAR\\n4bXaeVVhwfUPYBKIpaaTWFQR5cTR1UFZJL/OF9vAfpOwznoD66DDCnQVpbCjtDYWX+x6imxn8HCY\\nxhMol6ZnTbSsFW6VZjFMjQIDAQABo4HaMIHXMB0GA1UdDgQWBBTx0lDzjH/iOBnOSQaSEWQLx1sy\\nGDCBpwYDVR0jBIGfMIGcgBTx0lDzjH/iOBnOSQaSEWQLx1syGKGBgKR+MHwxCzAJBgNVBAYTAmF3\\nMQ4wDAYDVQQIEwVhcnViYTEOMAwGA1UEChMFYXJ1YmExDjAMBgNVBAcTBWFydWJhMQ4wDAYDVQQL\\nEwVhcnViYTEOMAwGA1UEAxMFYXJ1YmExHTAbBgkqhkiG9w0BCQEWDmFydWJhQGFydWJhLmFyggEA\\nMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEEBQADgYEAYvBJ0HOZbbHClXmGUjGs+GS+xC1FO/am\\n2suCSYqNB9dyMXfOWiJ1+TLJk+o/YZt8vuxCKdcZYgl4l/L6PxJ982SRhc83ZW2dkAZI4M0/Ud3o\\nePe84k8jm3A7EvH5wi5hvCkKRpuRBwn3Ei+jCRouxTbzKPsuCVB+1sNyxMTXzf0=</ds:X509Certificate></ds:X509Data></ds:KeyInfo></md:KeyDescriptor><md:KeyDescriptor use=\\\"encryption\\\"><ds:KeyInfo xmlns:ds=\\\"http://www.w3.org/2000/09/xmldsig#\\\"><ds:X509Data><ds:X509Certificate>MIIDSTCCArKgAwIBAgIBADANBgkqhkiG9w0BAQQFADB8MQswCQYDVQQGEwJhdzEOMAwGA1UECBMF\\nYXJ1YmExDjAMBgNVBAoTBWFydWJhMQ4wDAYDVQQHEwVhcnViYTEOMAwGA1UECxMFYXJ1YmExDjAM\\nBgNVBAMTBWFydWJhMR0wGwYJKoZIhvcNAQkBFg5hcnViYUBhcnViYS5hcjAeFw0xNTExMjAyMjI2\\nMjdaFw0xNjExMTkyMjI2MjdaMHwxCzAJBgNVBAYTAmF3MQ4wDAYDVQQIEwVhcnViYTEOMAwGA1UE\\nChMFYXJ1YmExDjAMBgNVBAcTBWFydWJhMQ4wDAYDVQQLEwVhcnViYTEOMAwGA1UEAxMFYXJ1YmEx\\nHTAbBgkqhkiG9w0BCQEWDmFydWJhQGFydWJhLmFyMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKB\\ngQDHtC5gUXxBKpEqZTLkNvFwNGnNIkggNOwOQVNbpO0WVHIivig5L39WqS9u0hnA+O7MCA/KlrAR\\n4bXaeVVhwfUPYBKIpaaTWFQR5cTR1UFZJL/OF9vAfpOwznoD66DDCnQVpbCjtDYWX+x6imxn8HCY\\nxhMol6ZnTbSsFW6VZjFMjQIDAQABo4HaMIHXMB0GA1UdDgQWBBTx0lDzjH/iOBnOSQaSEWQLx1sy\\nGDCBpwYDVR0jBIGfMIGcgBTx0lDzjH/iOBnOSQaSEWQLx1syGKGBgKR+MHwxCzAJBgNVBAYTAmF3\\nMQ4wDAYDVQQIEwVhcnViYTEOMAwGA1UEChMFYXJ1YmExDjAMBgNVBAcTBWFydWJhMQ4wDAYDVQQL\\nEwVhcnViYTEOMAwGA1UEAxMFYXJ1YmExHTAbBgkqhkiG9w0BCQEWDmFydWJhQGFydWJhLmFyggEA\\nMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEEBQADgYEAYvBJ0HOZbbHClXmGUjGs+GS+xC1FO/am\\n2suCSYqNB9dyMXfOWiJ1+TLJk+o/YZt8vuxCKdcZYgl4l/L6PxJ982SRhc83ZW2dkAZI4M0/Ud3o\\nePe84k8jm3A7EvH5wi5hvCkKRpuRBwn3Ei+jCRouxTbzKPsuCVB+1sNyxMTXzf0=</ds:X509Certificate></ds:X509Data></ds:KeyInfo></md:KeyDescriptor><md:SingleLogoutService Binding=\\\"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST\\\" Location=\\\"http://k1OaREzwh1.localhost:8080/uaa/saml/SingleLogout/alias/k1OaREzwh1.cloudfoundry-saml-login\\\"/><md:SingleLogoutService Binding=\\\"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect\\\" Location=\\\"http://k1OaREzwh1.localhost:8080/uaa/saml/SingleLogout/alias/k1OaREzwh1.cloudfoundry-saml-login\\\"/><md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</md:NameIDFormat><md:NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</md:NameIDFormat><md:NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</md:NameIDFormat><md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</md:NameIDFormat><md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName</md:NameIDFormat><md:AssertionConsumerService Binding=\\\"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST\\\" Location=\\\"http://k1OaREzwh1.localhost:8080/uaa/saml/SSO/alias/k1OaREzwh1.cloudfoundry-saml-login\\\" index=\\\"0\\\" isDefault=\\\"true\\\"/><md:AssertionConsumerService Binding=\\\"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact\\\" Location=\\\"http://k1OaREzwh1.localhost:8080/uaa/saml/SSO/alias/k1OaREzwh1.cloudfoundry-saml-login\\\" index=\\\"1\\\"/></md:SPSSODescriptor></md:EntityDescriptor>\",\"singleSignOnServiceIndex\":0,\"metadataTrustCheck\":true,\"skipSslValidation\":false,\"attributeMappings\":{\"given_name\":\"firstname\",\"family_name\":\"lastname\",\"phone_number\":\"phone\"},\"enableIdpInitiatedSso\":true,\"staticCustomAttributes\":{\"organization-emails\":[\"contact@demoorg.com\",\"info@demo.org\"],\"portal-id\":\"346-asd-3412\",\"organization-name\":\"The Demo Org\"}}",
      "id" : null,
      "entityId" : "k1OaREzwh1.cloudfoundry-saml-login",
      "name" : "k1OaREzwh1",
      "version" : 0,
      "created" : null,
      "lastModified" : null,
      "active" : true,
      "identityZoneId" : null
    }
    
    HTTP/1.1 200 OK
    X-B3-TraceId: 8bec3936-ffcc-4691-b5fc-75bc6d63b80f
    Cache-Control: no-cache, no-store, max-age=0, must-revalidate
    Pragma: no-cache
    Expires: 0
    X-XSS-Protection: 1; mode=block
    X-Frame-Options: DENY
    X-Content-Type-Options: nosniff
    Content-Type: application/json;charset=UTF-8
    Content-Length: 7325
    
    {
      "config" : "{\"metaDataLocation\":\"<?xml version=\\\"1.0\\\" encoding=\\\"UTF-8\\\"?><md:EntityDescriptor xmlns:md=\\\"urn:oasis:names:tc:SAML:2.0:metadata\\\" ID=\\\"k1OaREzwh1.cloudfoundry-saml-login\\\" entityID=\\\"k1OaREzwh1.cloudfoundry-saml-login\\\"><ds:Signature xmlns:ds=\\\"http://www.w3.org/2000/09/xmldsig#\\\"><ds:SignedInfo><ds:CanonicalizationMethod Algorithm=\\\"http://www.w3.org/2001/10/xml-exc-c14n#\\\"/><ds:SignatureMethod Algorithm=\\\"http://www.w3.org/2000/09/xmldsig#rsa-sha1\\\"/><ds:Reference URI=\\\"#k1OaREzwh1.cloudfoundry-saml-login\\\"><ds:Transforms><ds:Transform Algorithm=\\\"http://www.w3.org/2000/09/xmldsig#enveloped-signature\\\"/><ds:Transform Algorithm=\\\"http://www.w3.org/2001/10/xml-exc-c14n#\\\"/></ds:Transforms><ds:DigestMethod Algorithm=\\\"http://www.w3.org/2000/09/xmldsig#sha1\\\"/><ds:DigestValue>zALgjEFJ7jJSwn2AOBH5H8CX93U=</ds:DigestValue></ds:Reference></ds:SignedInfo><ds:SignatureValue>Rp5XH8eT0ek/vlFGzHgIFOeESchOwSYZ9oh4JA9WqQ0jJtvNQ9IttY2QY9XK3n6TbbtPcEKVgljyTfwD5ymp+oMKfIYQC9JsN8mPADN5rjLFgC+xGceWLbcjoNsCJ7x2ZjyWRblSxoOU5qnzxEA3k3Bu+OkV+ZXcSbmgMWoQACg=</ds:SignatureValue><ds:KeyInfo><ds:X509Data><ds:X509Certificate>MIIDSTCCArKgAwIBAgIBADANBgkqhkiG9w0BAQQFADB8MQswCQYDVQQGEwJhdzEOMAwGA1UECBMF\\nYXJ1YmExDjAMBgNVBAoTBWFydWJhMQ4wDAYDVQQHEwVhcnViYTEOMAwGA1UECxMFYXJ1YmExDjAM\\nBgNVBAMTBWFydWJhMR0wGwYJKoZIhvcNAQkBFg5hcnViYUBhcnViYS5hcjAeFw0xNTExMjAyMjI2\\nMjdaFw0xNjExMTkyMjI2MjdaMHwxCzAJBgNVBAYTAmF3MQ4wDAYDVQQIEwVhcnViYTEOMAwGA1UE\\nChMFYXJ1YmExDjAMBgNVBAcTBWFydWJhMQ4wDAYDVQQLEwVhcnViYTEOMAwGA1UEAxMFYXJ1YmEx\\nHTAbBgkqhkiG9w0BCQEWDmFydWJhQGFydWJhLmFyMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKB\\ngQDHtC5gUXxBKpEqZTLkNvFwNGnNIkggNOwOQVNbpO0WVHIivig5L39WqS9u0hnA+O7MCA/KlrAR\\n4bXaeVVhwfUPYBKIpaaTWFQR5cTR1UFZJL/OF9vAfpOwznoD66DDCnQVpbCjtDYWX+x6imxn8HCY\\nxhMol6ZnTbSsFW6VZjFMjQIDAQABo4HaMIHXMB0GA1UdDgQWBBTx0lDzjH/iOBnOSQaSEWQLx1sy\\nGDCBpwYDVR0jBIGfMIGcgBTx0lDzjH/iOBnOSQaSEWQLx1syGKGBgKR+MHwxCzAJBgNVBAYTAmF3\\nMQ4wDAYDVQQIEwVhcnViYTEOMAwGA1UEChMFYXJ1YmExDjAMBgNVBAcTBWFydWJhMQ4wDAYDVQQL\\nEwVhcnViYTEOMAwGA1UEAxMFYXJ1YmExHTAbBgkqhkiG9w0BCQEWDmFydWJhQGFydWJhLmFyggEA\\nMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEEBQADgYEAYvBJ0HOZbbHClXmGUjGs+GS+xC1FO/am\\n2suCSYqNB9dyMXfOWiJ1+TLJk+o/YZt8vuxCKdcZYgl4l/L6PxJ982SRhc83ZW2dkAZI4M0/Ud3o\\nePe84k8jm3A7EvH5wi5hvCkKRpuRBwn3Ei+jCRouxTbzKPsuCVB+1sNyxMTXzf0=</ds:X509Certificate></ds:X509Data></ds:KeyInfo></ds:Signature><md:SPSSODescriptor AuthnRequestsSigned=\\\"true\\\" WantAssertionsSigned=\\\"true\\\" protocolSupportEnumeration=\\\"urn:oasis:names:tc:SAML:2.0:protocol\\\"><md:KeyDescriptor use=\\\"signing\\\"><ds:KeyInfo xmlns:ds=\\\"http://www.w3.org/2000/09/xmldsig#\\\"><ds:X509Data><ds:X509Certificate>MIIDSTCCArKgAwIBAgIBADANBgkqhkiG9w0BAQQFADB8MQswCQYDVQQGEwJhdzEOMAwGA1UECBMF\\nYXJ1YmExDjAMBgNVBAoTBWFydWJhMQ4wDAYDVQQHEwVhcnViYTEOMAwGA1UECxMFYXJ1YmExDjAM\\nBgNVBAMTBWFydWJhMR0wGwYJKoZIhvcNAQkBFg5hcnViYUBhcnViYS5hcjAeFw0xNTExMjAyMjI2\\nMjdaFw0xNjExMTkyMjI2MjdaMHwxCzAJBgNVBAYTAmF3MQ4wDAYDVQQIEwVhcnViYTEOMAwGA1UE\\nChMFYXJ1YmExDjAMBgNVBAcTBWFydWJhMQ4wDAYDVQQLEwVhcnViYTEOMAwGA1UEAxMFYXJ1YmEx\\nHTAbBgkqhkiG9w0BCQEWDmFydWJhQGFydWJhLmFyMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKB\\ngQDHtC5gUXxBKpEqZTLkNvFwNGnNIkggNOwOQVNbpO0WVHIivig5L39WqS9u0hnA+O7MCA/KlrAR\\n4bXaeVVhwfUPYBKIpaaTWFQR5cTR1UFZJL/OF9vAfpOwznoD66DDCnQVpbCjtDYWX+x6imxn8HCY\\nxhMol6ZnTbSsFW6VZjFMjQIDAQABo4HaMIHXMB0GA1UdDgQWBBTx0lDzjH/iOBnOSQaSEWQLx1sy\\nGDCBpwYDVR0jBIGfMIGcgBTx0lDzjH/iOBnOSQaSEWQLx1syGKGBgKR+MHwxCzAJBgNVBAYTAmF3\\nMQ4wDAYDVQQIEwVhcnViYTEOMAwGA1UEChMFYXJ1YmExDjAMBgNVBAcTBWFydWJhMQ4wDAYDVQQL\\nEwVhcnViYTEOMAwGA1UEAxMFYXJ1YmExHTAbBgkqhkiG9w0BCQEWDmFydWJhQGFydWJhLmFyggEA\\nMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEEBQADgYEAYvBJ0HOZbbHClXmGUjGs+GS+xC1FO/am\\n2suCSYqNB9dyMXfOWiJ1+TLJk+o/YZt8vuxCKdcZYgl4l/L6PxJ982SRhc83ZW2dkAZI4M0/Ud3o\\nePe84k8jm3A7EvH5wi5hvCkKRpuRBwn3Ei+jCRouxTbzKPsuCVB+1sNyxMTXzf0=</ds:X509Certificate></ds:X509Data></ds:KeyInfo></md:KeyDescriptor><md:KeyDescriptor use=\\\"encryption\\\"><ds:KeyInfo xmlns:ds=\\\"http://www.w3.org/2000/09/xmldsig#\\\"><ds:X509Data><ds:X509Certificate>MIIDSTCCArKgAwIBAgIBADANBgkqhkiG9w0BAQQFADB8MQswCQYDVQQGEwJhdzEOMAwGA1UECBMF\\nYXJ1YmExDjAMBgNVBAoTBWFydWJhMQ4wDAYDVQQHEwVhcnViYTEOMAwGA1UECxMFYXJ1YmExDjAM\\nBgNVBAMTBWFydWJhMR0wGwYJKoZIhvcNAQkBFg5hcnViYUBhcnViYS5hcjAeFw0xNTExMjAyMjI2\\nMjdaFw0xNjExMTkyMjI2MjdaMHwxCzAJBgNVBAYTAmF3MQ4wDAYDVQQIEwVhcnViYTEOMAwGA1UE\\nChMFYXJ1YmExDjAMBgNVBAcTBWFydWJhMQ4wDAYDVQQLEwVhcnViYTEOMAwGA1UEAxMFYXJ1YmEx\\nHTAbBgkqhkiG9w0BCQEWDmFydWJhQGFydWJhLmFyMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKB\\ngQDHtC5gUXxBKpEqZTLkNvFwNGnNIkggNOwOQVNbpO0WVHIivig5L39WqS9u0hnA+O7MCA/KlrAR\\n4bXaeVVhwfUPYBKIpaaTWFQR5cTR1UFZJL/OF9vAfpOwznoD66DDCnQVpbCjtDYWX+x6imxn8HCY\\nxhMol6ZnTbSsFW6VZjFMjQIDAQABo4HaMIHXMB0GA1UdDgQWBBTx0lDzjH/iOBnOSQaSEWQLx1sy\\nGDCBpwYDVR0jBIGfMIGcgBTx0lDzjH/iOBnOSQaSEWQLx1syGKGBgKR+MHwxCzAJBgNVBAYTAmF3\\nMQ4wDAYDVQQIEwVhcnViYTEOMAwGA1UEChMFYXJ1YmExDjAMBgNVBAcTBWFydWJhMQ4wDAYDVQQL\\nEwVhcnViYTEOMAwGA1UEAxMFYXJ1YmExHTAbBgkqhkiG9w0BCQEWDmFydWJhQGFydWJhLmFyggEA\\nMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEEBQADgYEAYvBJ0HOZbbHClXmGUjGs+GS+xC1FO/am\\n2suCSYqNB9dyMXfOWiJ1+TLJk+o/YZt8vuxCKdcZYgl4l/L6PxJ982SRhc83ZW2dkAZI4M0/Ud3o\\nePe84k8jm3A7EvH5wi5hvCkKRpuRBwn3Ei+jCRouxTbzKPsuCVB+1sNyxMTXzf0=</ds:X509Certificate></ds:X509Data></ds:KeyInfo></md:KeyDescriptor><md:SingleLogoutService Binding=\\\"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST\\\" Location=\\\"http://k1OaREzwh1.localhost:8080/uaa/saml/SingleLogout/alias/k1OaREzwh1.cloudfoundry-saml-login\\\"/><md:SingleLogoutService Binding=\\\"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect\\\" Location=\\\"http://k1OaREzwh1.localhost:8080/uaa/saml/SingleLogout/alias/k1OaREzwh1.cloudfoundry-saml-login\\\"/><md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</md:NameIDFormat><md:NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</md:NameIDFormat><md:NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</md:NameIDFormat><md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</md:NameIDFormat><md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName</md:NameIDFormat><md:AssertionConsumerService Binding=\\\"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST\\\" Location=\\\"http://k1OaREzwh1.localhost:8080/uaa/saml/SSO/alias/k1OaREzwh1.cloudfoundry-saml-login\\\" index=\\\"0\\\" isDefault=\\\"true\\\"/><md:AssertionConsumerService Binding=\\\"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact\\\" Location=\\\"http://k1OaREzwh1.localhost:8080/uaa/saml/SSO/alias/k1OaREzwh1.cloudfoundry-saml-login\\\" index=\\\"1\\\"/></md:SPSSODescriptor></md:EntityDescriptor>\",\"singleSignOnServiceIndex\":0,\"metadataTrustCheck\":true,\"skipSslValidation\":false,\"attributeMappings\":{\"given_name\":\"firstname\",\"family_name\":\"lastname\",\"phone_number\":\"phone\"},\"enableIdpInitiatedSso\":true,\"staticCustomAttributes\":{\"organization-emails\":[\"contact@demoorg.com\",\"info@demo.org\"],\"portal-id\":\"346-asd-3412\",\"organization-name\":\"The Demo Org\"}}",
      "id" : "716c76a7-d23b-41b4-bb46-f8aac554aa7f",
      "entityId" : "k1OaREzwh1.cloudfoundry-saml-login",
      "name" : "k1OaREzwh1",
      "version" : 1,
      "created" : 1525217123394,
      "lastModified" : 1525217123431,