* saml.sp.single_logout_service.url=https://your-fess-server.example.com/sso/logout
 * </pre>
 *
 * <h2>Complete Configuration Example (Okta)</h2>
 * <pre>
 * sso.type=saml
 *
 * # IdP settings from Okta SAML setup instructions
 * saml.idp.entityid=http://www.okta.com/your-app-id
 * saml.idp.single_sign_on_service.url=https://your-domain.okta.com/app/your-app/your-app-id/sso/saml

    public String toString() {
        return "{" + getUserId() + "}";
    }

    @Override
    public String getUserId() {
        return nameId;
    }

    /**
     * Gets the SAML user.
     * @return The SAML user.
     */
    public SamlUser getUser() {
        return new SamlUser(nameId, sessionIndex, nameIdFormat, nameidNameQualifier, nameidSPNameQualifier, getDefaultGroupsAsArray(),

    /** SAML service provider base URL. */
    @Size(max = 1000)
    public String samlSpBaseUrl;

    /** SAML attribute name for group membership. */
    @Size(max = 1000)
    public String samlAttributeGroupName;

    /** SAML attribute name for role membership. */
    @Size(max = 1000)
    public String samlAttributeRoleName;

    /** SAML default groups. */
    @Size(max = 1000)

- Full-text search with OpenSearch backend
- Web, file system, and data store crawling
- Multi-format document support (Office, PDF, etc.)
- Admin GUI for configuration
- REST API for programmatic access
- SSO integration (OIDC, SAML, SPNEGO, Entra ID)
- i18n support (20+ languages)

## Tech Stack

| Component | Technology |
|-----------|------------|
| Web Framework | LastaFlute (MVC framework) |
| DI Container | Lasta Di |

        // SAML
        fessConfig.setSystemProperty("saml.sp.base.url", form.samlSpBaseUrl);
        fessConfig.setSystemProperty("saml.attribute.group.name", form.samlAttributeGroupName);
        fessConfig.setSystemProperty("saml.attribute.role.name", form.samlAttributeRoleName);
        fessConfig.setSystemProperty("saml.default.groups", form.samlDefaultGroups);

 * such as metadata requests and logout actions.
 */
public enum SsoResponseType {
    /**
     * Indicates a request for SSO metadata, which is typically used for
     * configuration and discovery in protocols like SAML.
     */
    METADATA,

    /**
     * Indicates a request to perform a logout operation, terminating the
     * user's SSO session.
     */
    LOGOUT;

 * Interface for SSO (Single Sign-On) authenticator implementations.
 *
 * This interface defines the contract for SSO authentication providers that can be
 * integrated with Fess. Implementations handle specific SSO protocols like SAML,
 * OAuth, SPNEGO, or other authentication mechanisms. Each authenticator is responsible
 * for obtaining login credentials, resolving user information, and managing SSO
 * lifecycle operations like logout and metadata exchange.

        defaultSettings.put("onelogin.saml2.sp.x509cert", "");
        defaultSettings.put("onelogin.saml2.sp.privatekey", "");
        defaultSettings.put("onelogin.saml2.idp.single_sign_on_service.binding", "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect");
        defaultSettings.put("onelogin.saml2.idp.single_logout_service.response.url", "");

            @Override
            public String getOsddLinkEnabled() {
                return "auto";
            }

            @Override
            public String getSsoType() {
                return "saml";
            }
        });
        final OsddHelper osddHelper = new OsddHelper();
        osddHelper.setOsddPath("osdd/osdd.xml");
        osddHelper.init();
        assertFalse(osddHelper.hasOpenSearchFile());

    @Test
    public void test_fullScenario_ssoEnabled() {
        currentSsoType = "saml";
        final LoginCredential expectedCredential = new TestLoginCredential("samluser");
        final ActionResponse expectedResponse = HtmlResponse.asEmptyBody();
        final String expectedLogoutUrl = "https://saml.example.com/logout";

        testAuthenticator.setLoginCredential(expectedCredential);