SAML Integration

SAML Integration

ScoutID supports SAML 2.0 via Keycloak. OIDC is the recommended protocol for new integrations, but SAML is fully supported for services that require it — for example when integrating with platforms that do not support OIDC.

Before you start, make sure you have requested a client and indicated that you need a SAML client. You will need to provide your SP metadata or ACS URL, and you will receive the IdP metadata in return.

IdP metadata

Import the ScoutID SAML metadata into your service provider from:

https://dev.id.scouterna.se/realms/scoutnet/protocol/saml/descriptor

This document contains the entity ID, signing certificate, SSO endpoint, and SLO endpoints. Most SAML libraries and platforms accept a metadata URL directly.

When production goes live the base URL changes to https://id.scouterna.se — the path stays the same.

Key endpoints

Endpoint	URL
SSO (HTTP-POST)	https://dev.id.scouterna.se/realms/scoutnet/protocol/saml
SSO (HTTP-Redirect)	https://dev.id.scouterna.se/realms/scoutnet/protocol/saml
SLO	https://dev.id.scouterna.se/realms/scoutnet/protocol/saml
Entity ID	https://dev.id.scouterna.se/realms/scoutnet

AuthnRequests must be signed (WantAuthnRequestsSigned is set to true in the IdP metadata).

NameID formats

The following NameID formats are supported:

Format	Notes
persistent	A stable opaque identifier for the user. Consistent across sessions.
transient	A temporary identifier, different each session. Use when you do not need to recognise returning users.
unspecified	Let the IdP choose.
emailAddress	Not recommended. ScoutID does not use email as a primary identifier — a user may have multiple addresses and they can change.

For most integrations, persistent is the right choice. If your application needs to identify users by their Scoutnet member number (for example to pre-populate records or correlate with other Scoutnet-based systems), request this via Advanced Topics — a mapper can be configured to use the member number as the NameID value instead of the default opaque ID.

Available attributes

The following user attributes can be mapped to SAML assertions. Specify which ones you need when requesting a client.

Attribute	Source scope	Notes
given_name	profile
family_name	profile
name	profile	Full name
birthdate	profile	YYYY-MM-DD
locale	profile	e.g. sv
picture	profile	URL
scoutnet_member_no	profile
email	email	See note in ScoutID Data Reference
scouterna_email	email	Only present for some users
alt_email	email	Only present for some users
phone_number	phone

The scoutnet-memberships scope is not supported for SAML clients. The membership data is complex nested JSON that does not map well to SAML attributes. If you need membership and role data, use OIDC instead.