CreateSSOConfig

On success, this API returns the following response structure.

• uuid

  String

  Unique identifier of the SSO configuration.

  Example: sso-cfg-001

• tenantUuid

  String

  Deprecated and ignored. SSO configurations are global.

  Example: deprecated-tenant-uuid

• issuer

  String

  Issuer URL that uniquely identifies this SSO configuration.

  Example: https://idp.example.com

• displayName

  String

  Human-readable display name for this SSO configuration.

  Example: Corporate SSO

• providerType

  String

  Type of identity provider, e.g. OIDC, SAML, or LDAP.

  Example: OIDC

• protocol

  String

  Authentication protocol used by this SSO configuration.

  Example: oidc

• oidcConfig

  Object

  Oidc config

  Show child properties
  • clientId

    String

    OAuth 2.0 client identifier issued by the OIDC provider.

    Example: my-client-id

  • clientSecret

    String

    OAuth 2.0 client secret issued by the OIDC provider.

    Example: s3cr3t

  • wellKnownUrl

    String

    URL of the OIDC provider well-known discovery document.

    Example: https://idp.example.com/.well-known/openid-configuration

  • redirectUri

    String

    Redirect URI registered with the OIDC provider for the callback.

    Example: https://zcf.example.com/sso/callback

  • scope

    String

    Space-separated OAuth 2.0 scopes requested during authentication.

    Example: openid profile email

  • configName

    String

    Human-readable name identifying this OIDC configuration.

    Example: Corporate OIDC

• samlConfig

  Object

  SAML config

  Show child properties
  • idpEntityId

    String

    Entity ID of the SAML Identity Provider.

    Example: https://idp.example.com/saml/metadata

  • idpSsoUrl

    String

    Single Sign-On service URL of the Identity Provider.

    Example: https://idp.example.com/saml/sso

  • idpSloUrl

    String

    Single Logout service URL of the Identity Provider.

    Example: https://idp.example.com/saml/slo

  • idpCertificate

    String

    PEM-encoded X.509 certificate of the Identity Provider.

    Example: -----BEGIN CERTIFICATE----- ...

  • idpMetadataUrl

    String

    URL to fetch the Identity Provider metadata XML document.

    Example: https://idp.example.com/saml/metadata.xml

  • spEntityId

    String

    Entity ID of the SAML Service Provider (this application).

    Example: https://zcf.example.com/saml/sp

  • nameIdFormat

    String

    NameID format used to identify the subject in SAML assertions.

    Example: urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress

  • signRequests

    Boolean

    Whether to cryptographically sign outgoing SAML AuthnRequests.

    Example: true

  • forceAuthn

    Boolean

    Whether to force re-authentication even if a valid IDP session exists.

    Example: false

  • spCertificatePem

    String

    PEM-encoded X.509 certificate used by the Service Provider for request signing.

    Example: -----BEGIN CERTIFICATE----- ...

• ldapConfig

  Object

  LDAP config

  Show child properties
  • serverAddress

    String

    Hostname or IP address of the LDAP server.

    Example: ldap.example.com

  • port

    Integer

    TCP port on which the LDAP server is listening.

    Example: 389

  • baseDn

    String

    Base Distinguished Name used as the root for LDAP searches.

    Example: dc=example,dc=com

  • bindDn

    String

    Distinguished Name of the service account used to bind to LDAP.

    Example: cn=admin,dc=example,dc=com

  • bindPassword

    String

    Password for the LDAP bind account.

    Example: bindP@ssw0rd

  • userSearchBase

    String

    Base DN under which user entries are searched.

    Example: ou=users,dc=example,dc=com

  • userSearchFilter

    String

    LDAP search filter expression used to locate user entries.

    Example: (uid=%s)

  • useSsl

    Boolean

    Whether to use SSL/TLS when connecting to the LDAP server.

    Example: true

• userProvisioning

  String

  User provisioning strategy applied when a user logs in for the first time.

  Example: auto

• groupProvisioning

  String

  Group provisioning strategy for synchronizing IDP groups to ZCF.

  Example: sync

• attributeMappings

  LinkedHashMap

  Attribute mapping rules between identity provider and local fields

  Example: (nested object)

• groupMappings

  List

  Group mappings

  Example: (nested array)

  Show child properties
  • idpGroup

    String

    Name of the group as defined in the Identity Provider.

    Example: idp-admins

  • zcfRole

    String

    ZCF role that members of the IDP group are assigned.

    Example: admin

• source

  String

  Source system that created or manages this SSO configuration.

  Example: manual

• status

  String

  Current lifecycle status of this SSO configuration.

  Example: active

• enabled

  Boolean

  Whether this SSO configuration is enabled and accepting logins.

  Example: true

• lastTestAt

  String

  Last test at

  Example: 2026-01-15T08:00:00Z

• lastTestResult

  String

  Result of the most recent connectivity test for this configuration.

  Example: success

• createdAt

  String

  Created at

  Example: 2026-01-15T08:00:00Z

• updatedAt

  String

  Updated at

  Example: 2026-01-15T08:00:00Z

• description

  String

  Human-readable description of this SSO configuration.

  Example: Corporate identity provider with SCIM provisioning

• provisioningModes

  List

  Unified provisioning modes enabled for this SSO configuration.

  Example: item1,item2

• builtIn

  Boolean

  Whether this SSO configuration is managed by the system and cannot be deleted.

  Example: true

• associatedPlatformCount

  Integer

  Number of downstream platforms currently associated with this SSO configuration.

  Example: 2