Settings - NanoIDP

IdP Settings

OAuth2 / OIDC Settings

Issuer URL

Base URL used in JWT "iss" claim

Audience

Default audience for JWT "aud" claim

Token Expiry (minutes)

How long tokens are valid (default: 60 minutes)

Require PKCE

Reject /authorize requests without a PKCE code_challenge (on by default in stricter-dev and implied by oauth21).

Refresh Token Rotation

Each refresh invalidates the used refresh token; reuse revokes its rotation family (forced on by oauth21).

SAML Settings

Entity ID

SAML IdP Entity ID

SSO URL

SAML Single Sign-On endpoint

Default ACS URL

Default Assertion Consumer Service URL

Sign SAML Responses

Enable XML signature on SAML responses. Disable for testing unsigned flows.

Strict SAML Binding

Enforce SAML 2.0 binding compliance. When enabled, rejects GET requests with uncompressed data.

Require Signed AuthnRequests

Verify AuthnRequest signatures (both bindings) against the registered SP certificates; advertised as WantAuthnRequestsSigned in metadata.

SP Certificates

PEM certificate files of SPs whose AuthnRequest signatures are accepted.

Canonicalization Algorithm

XML canonicalization algorithm for SAML signatures

Allowed Identity Classes

Identity Classes

One identity class per line (e.g., INTERNAL, EXTERNAL, PARTNER, SERVICE)

Preview Changes

Click "Refresh" to preview changes

IdP Endpoints

OIDC Discovery	/.well-known/openid-configuration
JWKS Endpoint	/.well-known/jwks.json
Token Endpoint	`/token`
SAML Metadata	/saml/metadata
SAML SSO	`/saml/sso`