SAML Integration

SAML Integration

ScoutID supports SAML 2.0 via Keycloak. OIDC is the recommended protocol for new integrations, but SAML is fully supported for services that require it — for example when integrating with platforms that do not support OIDC.

Before you start, make sure you have requested a client and indicated that you need a SAML client. You will need to provide your SP metadata or ACS URL, and you will receive the IdP metadata in return.

IdP metadata

Import the ScoutID SAML metadata into your service provider from:

Environment	Metadata URL
Development	https://dev1.id.scouterna.se/realms/scoutid/protocol/saml/descriptor
Production	https://id.scouterna.se/realms/scoutid/protocol/saml/descriptor

This document contains the entity ID, signing certificate, SSO endpoint, and SLO endpoints. Most SAML libraries and platforms accept a metadata URL directly.

Key endpoints

Endpoint	URL
SSO (HTTP-POST)	https://id.scouterna.se/realms/scoutid/protocol/saml
SSO (HTTP-Redirect)	https://id.scouterna.se/realms/scoutid/protocol/saml
SLO	https://id.scouterna.se/realms/scoutid/protocol/saml
Entity ID	https://id.scouterna.se/realms/scoutid

AuthnRequests must be signed (WantAuthnRequestsSigned is set to true in the IdP metadata).

NameID formats

The following NameID formats are supported:

Format	Notes
username	By default this will be on format [memberno]@scoutnet. See Advanced Topics if you want just [memberno].
email	ScoutID does not use email as a primary identifier — a user may have multiple addresses and they can change. In some cases, it might be useful to overwrite this with a specific scout group (scoutkår) email address. See Advanced Topics.
transient	A temporary, randomly generated identifier that changes with every single authentication session. Useful for access control not binding to client users.
persistent	A semi-persistent identifier randomly generated per user. Can be overwritten with member number on request. Note: traditional identity providers offer this as truly persistent. We do not promise this, the member number is the only persistent variable.

Available attributes

The following user attributes can be mapped to SAML assertions. Specify which ones you need when requesting a client.

Attribute	Source scope	Notes
given_name	profile
family_name	profile
name	profile	Full name
birthdate	profile	YYYY-MM-DD
locale	profile	e.g. sv
picture	profile	URL
scoutnet_member_no	profile
email	email	See note in ScoutID Data Reference
scouterna_email	email	Only present for some users
group_email_XXX	email	If created for the scoutgroup
alt_email	email	Only present for some users
phone_number	phone

The scoutnet-memberships scope is not supported for SAML clients. The membership data is complex nested JSON that does not map well to SAML attributes. If you need membership and role data, use OIDC instead.