}
    }

    /**
     * SSO metadata endpoint.
     *
     * This method handles requests for SSO metadata, typically used by SAML or
     * other SSO protocols that require metadata exchange. The actual metadata
     * content is generated by the configured SSO authenticator.
     *
     * @return ActionResponse containing the SSO metadata or error page
     */
    @Execute

            copyBeanToBean(form, entity, op -> op.exclude(Constants.COMMON_CONVERSION_RULE));
            return entity;
        });
    }

    /**
     * Registers protocol scheme items for the dropdown list.
     *
     * @param data the render data
     */
    protected void registerProtocolSchemeItems(final RenderData data) {

[(label)\]\((.*?)\)/).replace("label",D).getRegex(),reflink:k(/^!?\[(label)\]\s*\[([^\]]*)\]/).replace("label",D).getRegex()},N={...X,emStrongRDelimAst:Ve,emStrongLDelim:Xe,delLDelim:et,delRDelim:nt,url:k(/^((?:protocol):\/\/|www\.)(?:[a-zA-Z0-9\-]+\.?)+[^\s<]*|^email/).replace("protocol",re).replace("email",/[A-Za-z0-9._+-]+(@)[a-zA-Z0-9-_]+(?:\.[a-zA-Z0-9-_]*[a-zA-Z0-9])+(?![-_])/).getRegex(),_backpedal:/(?:[^?!.,:;*_'"~()&]+|\([^)]*\)|&(?![a-zA-Z0-9]+;$)|[?!.,:;*_'"~)]+(?!$))+/,del:/^(~~?)(?=...

            <option value="$PROJECT_DIR$/platforms/core-runtime/daemon-main" />
            <option value="$PROJECT_DIR$/platforms/core-runtime/daemon-messaging" />
            <option value="$PROJECT_DIR$/platforms/core-runtime/daemon-protocol" />
            <option value="$PROJECT_DIR$/platforms/core-runtime/daemon-server" />
            <option value="$PROJECT_DIR$/platforms/core-runtime/daemon-services" />

            final CrawlerClient client = crawlerClientFactory.getClient(url);
            if (client == null) {
                logger.warn("CrawlerClient not available for url='{}'. Protocol may not be supported.", url);
                return;
            }

            final StatsKeyObject keyObj = paramMap.get(Constants.CRAWLER_STATS_KEY) instanceof final StatsKeyObject sko ? sko : null;

this},abort:function(e){var t=e||u;return c&&c.abort(t),l(0,t),this}};if(x.promise(T),v.url=((e||v.url||Et.href)+"").replace($t,Et.protocol+"//"),v.type=t.method||t.type||v.method||v.type,v.dataTypes=(v.dataType||"*").toLowerCase().match(D)||[""],null==v.crossDomain){r=C.createElement("a");try{r.href=v.url,r.href=r.href,v.crossDomain=Xt.protocol+"//"+Xt.host!=r.protocol+"//"+r.host}catch(e){v.crossDomain=!0}}if(v.data&&v.processData&&"string"!=typeof v.data&&(v.data=ce.param(v.data,v.traditional))...

import jakarta.servlet.http.HttpServletResponse;
import jakarta.servlet.http.HttpSession;

/**
 * Authenticator for SAML 2.0.
 *
 * <p>This authenticator enables Single Sign-On (SSO) using SAML 2.0 protocol
 * with Identity Providers such as Okta, Azure AD, OneLogin, etc.</p>
 *
 * <h2>Required Configuration</h2>
 * <p>Add the following properties to {@code system.properties}:</p>
 * <pre>
 * # Enable SAML SSO

# GSA API compatibility
web.api.gsa=true

# JSON API
web.api.json=true

# Search page size
page.search.default.size=20

# Crawler settings
crawler.document.max.size=10000000
crawler.web.protocols=http,https

# Authentication
security.remember_me.enabled=true
```

After editing `system.properties`, restart Fess.

---

## API Reference

### Search APIs

crawler.document.fullstop.chars=u002eu06d4u2e3cu3002
# Encoding for crawling data.
crawler.crawling.data.encoding=UTF-8
# Supported web protocols for crawling.
crawler.web.protocols=http,https
# Supported file protocols for crawling.
crawler.file.protocols=file,smb,smb1,ftp,storage,s3,gcs
# Pattern for environment variable keys in crawling data.
crawler.data.env.param.key.pattern=^FESS_ENV_.*

this},abort:function(e){var t=e||u;return c&&c.abort(t),l(0,t),this}};if(x.promise(T),v.url=((e||v.url||Et.href)+"").replace($t,Et.protocol+"//"),v.type=t.method||t.type||v.method||v.type,v.dataTypes=(v.dataType||"*").toLowerCase().match(D)||[""],null==v.crossDomain){r=C.createElement("a");try{r.href=v.url,r.href=r.href,v.crossDomain=Xt.protocol+"//"+Xt.host!=r.protocol+"//"+r.host}catch(e){v.crossDomain=!0}}if(v.data&&v.processData&&"string"!=typeof v.data&&(v.data=ce.param(v.data,v.traditional))...