{"id":9138,"date":"2026-08-28T14:33:31","date_gmt":"2026-08-28T05:33:31","guid":{"rendered":"https:\/\/hasu0707.duckdns.org\/blog\/?p=9138"},"modified":"2026-09-09T09:39:18","modified_gmt":"2026-09-09T00:39:18","slug":"aikido-saml-sso-integration","status":"publish","type":"post","link":"https:\/\/hasu0707.duckdns.org\/blog\/?p=9138","title":{"rendered":"Aikido SAML SSO integration"},"content":{"rendered":"\n

Aikido Security SAML \uc124\uc815 \ubc29\ubc95<\/h1>\n

\uc0ac\uc804 \uc900\ube44<\/h2>\n
    \n
  1. SAML \uc9c0\uc6d0\uc740 \uae30\ubcf8\uc801\uc73c\ub85c Disable \uc0c1\ud0dc\uc774\ub2e4.<\/li>\n
  2. SAML \uc9c0\uc6d0\uc744 \uc704\ud574\uc11c\ub294 \uba3c\uc800 \ucc44\ud305\uc73c\ub85c Aikido\uc5d0 SAML \uc9c0\uc6d0\uc744 \uc694\uccad\ud574\uc57c \ud55c\ub2e4.<\/li>\n
  3. \uc9c0\uc6d0\uc744 \uc694\uccad\ud560\ub54c SAML \ud65c\uc131\ud654\uc640 \ud568\uaed8 \uc6b0\ub9ac \ub3c4\uba54\uc778(example.com)\uc758 SAML \uc5f0\ub3d9\uc744 \ud5c8\uc6a9\ud574 \ub2ec\ub77c\uace0 \uc694\uccad\ud574\uc57c \ud55c\ub2e4.<\/li>\n
  4. \uc694\uccad\uc774 \uc218\uc6a9\ub418\uba74 SAML Setup \uba54\ub274\uac00 \ubcf4\uc5ec\uc9c4\ub2e4.<\/li>\n<\/ol>\n
    \n

    Aikido SAML \uc124\uc815 \ud655\uc778<\/h2>\n
      \n
    • \n

      \u2699\ufe0f > General > SAML Setup > Enable SAML Authentication<\/p>\n<\/li>\n

    • \n

      Setup SAML Authentication<\/p>\n<\/li>\n

    • \n

      Copy following details to your identity provider.<\/p>\n

        \n
      • Single Sign-On URL \/ ACS URL:\n
          \n
        • https:\/\/app.aikido.dev\/api\/saml\/saml_auth?samlClientId=68638323<\/strong><\/li>\n<\/ul>\n<\/li>\n
        • Audience URI \/ Entity ID:\n
            \n
          • https:\/\/app.aikido.dev\/saml<\/strong><\/li>\n<\/ul>\n<\/li>\n
          • Name ID Format:\n
              \n
            • EmailAddress<\/strong><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n
            • \n

              Aikido\uac00 \uc81c\uacf5\ud55c \uac12\uc740 Aikido\uac00 SAML \uc11c\ube44\uc2a4 \uc81c\uacf5\uc790(SP)\ub77c\ub294 \ub73b.<\/p>\n<\/li>\n

            • \n

              \uc774\ub97c Keycloak\uc758 SAML Client\uc5d0 \ub4f1\ub85d\ud55c \ub4a4, \ubc18\ub300\ub85c Keycloak\uc758 Issuer\u00b7SSO URL\u00b7\uc778\uc99d\uc11c\ub97c Aikido\uc5d0 \uc785\ub825\ud574\uc57c \ud55c\ub2e4.<\/p>\n<\/li>\n

            • \n

              Aikido\uac00 \uc81c\uacf5\ud55c \uac12\uc740 \ud655\uc778\ub9cc\ud558\uc5ec \ub2e4\uc74c Keyclock Client \uc124\uc815\uc5d0 \uc0ac\uc6a9\ud55c\ub2e4.<\/p>\n<\/li>\n<\/ul>\n

              \n

              Keycloak\uc5d0 Aikido SAML Client \uc0dd\uc131<\/h2>\n
                \n
              • Manage realms > myrealm \uc120\ud0dd\ud574\uc11c \ud65c\uc131\ud654<\/li>\n
              • Clients > Create client<\/strong>\n
                  \n
                • General settings\n
                    \n
                  • Client type: SAML<\/strong><\/li>\n
                  • Client ID:\n
                      \n
                    • https:\/\/app.aikido.dev\/saml<\/strong><\/li>\n<\/ul>\n<\/li>\n
                    • Name: Aikido SAML<\/strong><\/li>\n
                    • Description: Aikido SAML SSO integration<\/strong><\/li>\n<\/ul>\n<\/li>\n
                    • <Next><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n
                      \n
                        \n
                      • [Settings \ud0ed]<\/strong>\n
                          \n
                        • \n

                          Access settings<\/p>\n

                            \n
                          • Root URL: \ube44\uc6cc \ub460<\/strong><\/li>\n
                          • Home URL: \ube44\uc6cc \ub460<\/strong><\/li>\n
                          • Valid Redirect URIs:\n
                              \n
                            • https:\/\/app.aikido.dev\/api\/saml\/saml_auth?samlClientId=68638323<\/strong><\/li>\n<\/ul>\n<\/li>\n
                            • IDP-Initiated SSO URL name: \ube44\uc6cc \ub460<\/strong><\/li>\n
                            • IDP-Initiated SSO Relay State: \ube44\uc6cc \ub460<\/strong><\/li>\n
                            • Master SAML Processing URL:\n
                                \n
                              • https:\/\/app.aikido.dev\/api\/saml\/saml_auth?samlClientId=68638323<\/strong><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n
                              • \n

                                SAML capabilities<\/p>\n

                                  \n
                                • Name ID Format: email<\/strong><\/li>\n
                                • Force Name ID Format: On<\/strong><\/li>\n
                                • Force POST Binding: On<\/strong><\/li>\n
                                • Include AuthnStatement: On<\/strong><\/li>\n
                                • Include OneTimeUse Condition: Off<\/strong><\/li>\n
                                • Optimize REDIRECT signing key lookup: Off<\/strong><\/li>\n
                                • Allow ECP flow: Off<\/strong><\/li>\n<\/ul>\n<\/li>\n
                                • \n

                                  Signature and Encryption<\/p>\n

                                    \n
                                  • Sign Documents: On<\/strong><\/li>\n
                                  • Sign Assertions: On<\/strong><\/li>\n
                                  • Signature Algorithm: RSA_SHA256<\/strong><\/li>\n
                                  • SAML Signature Key Name: KEY_ID<\/strong><\/li>\n
                                  • Canonicalization method: EXCLUSIVE<\/strong><\/li>\n
                                  • Metadata descriptor URL: \ube44\uc6cc \ub460<\/strong><\/li>\n
                                  • Use metadata descriptor URL: Off<\/strong><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n
                                    \n
                                      \n
                                    • [Keys \ud0ed]<\/strong>\n
                                        \n
                                      • Client Signature Required: Off<\/strong><\/li>\n
                                      • Encrypt Assertions: Off<\/strong><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n
                                        \n
                                          \n
                                        • [Client scopes \ud0ed]<\/strong>\n
                                            \n
                                          • role_list\ub97c \uc0ad\uc81c\ud55c\ub2e4. (\uc911\uc694!!)<\/strong><\/li>\n
                                          • https:\/\/app.aikido.dev\/saml-dedicated: No mappers \uc0c1\ud0dc\uc5ec\uc57c \ud55c\ub2e4.<\/strong><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n
                                            \n
                                              \n
                                            • [Advanced \ud0ed]<\/strong>\n
                                                \n
                                              • Fine Grain SAML Endpoint Configuration\n
                                                  \n
                                                • Assertion Consumer Service POST Binding URL:\n
                                                    \n
                                                  • https:\/\/app.aikido.dev\/api\/saml\/saml_auth?samlClientId=68638323<\/strong><\/li>\n<\/ul>\n<\/li>\n
                                                  • Assertion Consumer Service Redirect Binding: URL \ube44\uc6cc\ub460<\/strong><\/li>\n
                                                  • Logout Service URL: \ube44\uc6cc \ub460<\/strong><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n
                                                    \n

                                                    Aikido\uc5d0 SAML \uc785\ub825 \uc591\uc2dd \uc120 \uc870\uc0ac \ubc0f \uc785\ub825<\/h2>\n

                                                    \uc544\ub798 URL\uc744 \ud655\uc778\ud558\uc5ec XML \ud615\ud0dc\uc758 \uc815\ubcf4\ub97c \ud655\uc778\ud55c\ub2e4. SAML \uc785\ub825\uc591\uc2dd\uc5d0 \ub300\ud55c \uc815\ubcf4\ub294 \uc774 XML\uc5d0 \ud3ec\ud568\ub418\uc5b4 \uc788\ub2e4.<\/p>\n

                                                      \n
                                                    • \n

                                                      https:\/\/sso.example.com\/realms\/myrealm\/protocol\/saml\/descriptor<\/strong><\/p>\n<\/li>\n

                                                    • \n

                                                      Setup SAML Authentication<\/p>\n<\/li>\n

                                                    • \n

                                                      Fill in details provided by the identity provider.<\/p>\n<\/li>\n

                                                    • \n

                                                      Entity ID \/ Issuer<\/p>\n

                                                        \n
                                                      • entityID=\u201chttps:\/\/sso.example.com\/realms\/myrealm\u201d \ub97c \uac80\uc0c9\ud558\uc5ec \uc774 \uc911 \uc544\ub798\ubd80\ubd84\uc744 \ucde8\ud558\uc5ec \uc785\ub825\ud55c\ub2e4.\n
                                                          \n
                                                        • https:\/\/sso.example.com\/realms\/myrealm<\/strong><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n
                                                        • \n

                                                          Single Sign-On URL<\/p>\n

                                                            \n
                                                          • <md:SingleSignOnService Binding=\u201curn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect\u201d Location=\u201chttps:\/\/sso.example.com\/realms\/myrealm\/protocol\/saml\u201d\/> \ub97c \uac80\uc0c9\ud558\uc5ec \uc774 \uc911 \uc544\ub798\ubd80\ubd84\uc744 \ucde8\ud558\uc5ec \uc785\ub825\ud55c\ub2e4.\n
                                                              \n
                                                            • https:\/\/sso.example.com\/realms\/myrealm\/protocol\/saml<\/strong><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n
                                                            • \n

                                                              X.509 Certificate<\/p>\n

                                                                \n
                                                              • X509Certificate entity\uc758 MIIC\u2026= \uae4c\uc9c0 \uac12\uc744 \uc785\ub825\ud55c\ub2e4.<\/li>\n<\/ul>\n
                                                                \n

                                                                <X509Certificate>\nMIIC\u2026=<\/strong>\n<\/X509Certificate><\/p>\n<\/blockquote>\n<\/li>\n

                                                              • \n

                                                                Company Email Domain<\/p>\n

                                                                  \n
                                                                • example.com (\uc774 \ub3c4\uba54\uc778\uc740 \uc0ac\uc804\uc5d0 Aikido\uc5d0 \uc2b9\uc778\uc774 \ub418\uc5b4 \uc788\uc5b4\uc57c \ud55c\ub2e4)<\/strong><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/div>\n","protected":false},"excerpt":{"rendered":"","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"set","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[12],"tags":[],"class_list":["post-9138","post","type-post","status-publish","format-standard","hentry","category-computing_security"],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/hasu0707.duckdns.org\/blog\/index.php?rest_route=\/wp\/v2\/posts\/9138","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/hasu0707.duckdns.org\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/hasu0707.duckdns.org\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/hasu0707.duckdns.org\/blog\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/hasu0707.duckdns.org\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=9138"}],"version-history":[{"count":0,"href":"https:\/\/hasu0707.duckdns.org\/blog\/index.php?rest_route=\/wp\/v2\/posts\/9138\/revisions"}],"wp:attachment":[{"href":"https:\/\/hasu0707.duckdns.org\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=9138"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/hasu0707.duckdns.org\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=9138"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/hasu0707.duckdns.org\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=9138"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}