Configure SAML with Authentik

This page explains how to integrate Authentik as a SAML Identity Provider to authenticate your users on Reemo.

Note

Depending on your deployment mode, SAML can be enabled at the instance level (Private Cloud / On-Prem) or at the organization level (Public Cloud).

Screenshots and labels may vary slightly depending on your interface version.

Configure SAML in Reemo

Case 1: Instance level (Private Cloud / On-Prem)

From verified_user Admin Area > dashboard General > passkey SSO Connectors, configure SAML for the instance.

Access SSO Connectors in the instance Admin Area.

Case 2: Organization level (Public Cloud)

From domain Organization > dashboard General > passkey SSO Connectors, configure SAML for that organization.

Configure SAML in Organization > SSO Connectors.

Create the SAML connector in Reemo

1. From verified_user Admin Area > domain Organizations, select your organization, then go to dashboard General > passkey SSO Connectors and click New Connector > New SAML Connector.

2. Fill in the basic fields:

   • Friendly Name: name displayed to your users (e.g. Authentik).

   • Issuer / App URI ID: reemo.

   • Attributes Mapping: attribute names Reemo expects in the SAML assertion (email, username, fullname by default) — you will reuse these exact names in the Property Mappings you create in Authentik.

   • The other fields (e.g. Entry Point, Certificate) will be filled in after the Authentik configuration.

Fill in the basic fields of the SAML connector.

Enter the friendly name and the Issuer (reemo), then save.

3. Click Create to generate the connector’s callback URL. You will need it in Authentik.

Copy the callback URL generated by the SAML connector.

Configure the SAML application in Authentik

Log in to the Authentik admin interface (https://[authentik_url]/if/admin/).

1. Create the attribute mappings (Property Mappings)

Reemo reads, from the assertion, the attributes defined in the connector’s Attributes Mapping (email, username and fullname by default). Authentik does not expose these short names by default: you must create three dedicated Property Mappings.

In the Customization > Property Mappings menu, click Create > SAML Provider Property Mapping, then create the following three mappings:

Name	SAML Attribute Name	Expression
reemo email	email	return request.user.email
reemo username	username	return request.user.username
reemo fullname	fullname	return request.user.name

Warning

The SAML Attribute Name field must match the connector’s attribute names in Reemo exactly (email, username, fullname). Without this match, attributes arrive under a different name in the assertion and Reemo ignores them.

Set the SAML Attribute Name and the mapping expression.

The three email, username and fullname mappings once created.

2. Create the application and the SAML provider

In the Applications > Applications menu, click Create with Wizard.

Start the application creation wizard.

Follow the wizard:

• Application: Name = reemo, Slug = reemo.

• Provider Type: SAML Provider.

• Protocol settings:

  • ACS URL: paste the callback URL from the Reemo connector.

  • Audience: reemo (same value as the connector’s Issuer / App URI ID in Reemo).

• Advanced protocol settings:

  • Signing Certificate: select a certificate (e.g. authentik Self-signed Certificate).

  • Sign assertions: ON.

  • Sign responses: ON.

  • Verification Certificate: leave empty.

  • Property Mappings: select reemo email, reemo username and reemo fullname.

  • NameID Property Mapping: authentik default SAML Mapping: Email.

  • Service Provider Binding: Post.

Warning

Leave the Verification Certificate field empty. Reemo does not sign its outgoing SAML requests; if a verification certificate is set, Authentik will reject the authentication requests.

Signing certificate, Sign assertions/responses, Property Mappings and NameID of the provider.

3. Retrieve the certificate and the Entry Point

Open the provider (Applications > Providers > reemo). The Overview tab provides everything Reemo needs:

• Certificate: Download signing certificate button (or System > Certificates). Open the file and copy the raw base64 content.

• Entry Point: the SAML Endpoint field, in the format:

  https://[authentik_url]/application/saml/[slug]/
  

Warning

Paste only the raw base64 of the signing certificate, otherwise Reemo will not be able to validate the signed assertions.

Retrieve the signing certificate, the SAML Endpoint and the ACS URL.

Complete the Reemo SAML connector with this information (Entry Point and Certificate). Enable the connector (check Enabled) then click Update to save.

Declare users

Two approaches are available to grant SSO access to users.

Approach A: Explicit provisioning from the organization

From verified_user Admin Area > domain Organizations, select your organization, then go to inventory_2 Inventory > person Users and click New User > Provision SAML User to add users by entering their email.

Select Provision SAML User from the New User menu.

Add users by email via the provisioning popup.

Approach B: Just-In-Time (JIT) Provisioning

From verified_user Admin Area > domain Organizations, select your organization, then go to dashboard General > passkey SSO Connectors, click the connector then enable Just In Time Provisioning: accounts are created automatically on the first successful SSO login.

Enable Just In Time Provisioning to create accounts on first login.

Manage rights dynamically from the directory

This configuration lets Reemo read each user’s group membership from your corporate directory and automatically assign access to the corresponding collections — without manually provisioning rights in Reemo.

In Authentik

1. Create a dedicated SAML Property Mapping (Customization > Property Mappings > Create > SAML Provider Property Mapping):

   • Name: reemo groups

   • SAML Attribute Name: groups

   • Expression:

     for group in request.user.groups.all():
         yield group.name
     

2. Add this reemo groups mapping to the Property Mappings of the reemo provider (Advanced protocol settings).

3. Create your groups under Directory > Groups and add users to them. The group name is the value sent in the groups attribute.

Warning

Do not use the managed authentik default SAML Mapping: Groups mapping: it emits the attribute under the name http://schemas.xmlsoap.org/claims/Group, which Reemo does not recognize via the short name groups. Use the custom mapping above.

In Reemo

1. Open the SSO connector form by going to Admin Area > General > SSO Connectors.

2. In the connector settings, open the Extra mapping section.

3. In the Collection field, enter the group attribute name configured in Authentik (e.g. groups), then click Update.

Enter the group attribute name in the Collection field of Extra Mapping.

4. In Inventory > Collections, select a collection and click Edit. In the SSO Mapping Identifier field, enter the corresponding group name from your directory.

When a user logs in via SAML, Reemo reads the groups sent by Authentik and applies collection rights automatically.

Log in via SAML

Once the connector is active and users are declared (or JIT is enabled), your users can log in:

• General access to your portal (Private Cloud / On-Prem):

  https://[portal_url]/
  

• Direct access to the organization (Public Cloud):

  https://[portal_url]/login/[organization_shortname]
  

On the login screen, select the SSO tab, then click Login to be redirected to the identity provider.

Select the SSO tab, then click Login.