# UserPoolIdentityProviderSamlProps

Properties to initialize UserPoolIdentityProviderSaml.

Extends: UserPoolIdentityProviderSamlProps
Extends: UserPoolIdentityProviderProps
Used as props by: UserPoolIdentityProviderSaml

- Source: [`aws-cognito/lib/user-pool-idps/saml.ts`](https://github.com/aws/aws-cdk/blob/v2.274.0/packages/aws-cdk-lib/aws-cognito/lib/user-pool-idps/saml.ts#L14)
- Type last changed: v2.138.0 · 18 Apr 2024

## Example

```ts
const userpool = new cognito.UserPool(this, 'Pool');

// specify the metadata as a file content
new cognito.UserPoolIdentityProviderSaml(this, 'userpoolIdpFile', {
  userPool: userpool,
  metadata: cognito.UserPoolIdentityProviderSamlMetadata.file('my-file-contents'),
  // Whether to require encrypted SAML assertions from IdP
  encryptedResponses: true,
  // The signing algorithm for the SAML requests
  requestSigningAlgorithm: cognito.SigningAlgorithm.RSA_SHA256,
  // Enable IdP initiated SAML auth flow
  idpInitiated: true,
});

// specify the metadata as a URL
new cognito.UserPoolIdentityProviderSaml(this, 'userpoolidpUrl', {
  userPool: userpool,
  metadata: cognito.UserPoolIdentityProviderSamlMetadata.url('https://my-metadata-url.com'),
});
```

## Properties

- `attributeMapping`: [AttributeMapping](/cdk/api/v2/docs/aws-cdk-lib.aws_cognito.AttributeMapping.html) — Mapping attributes from the identity provider to standard and custom attributes of the user pool.

  **Default:** no attribute mapping

- `encryptedResponses`: boolean = false — Whether to require encrypted SAML assertions from IdP.

- `identifiers`: string[] — Identifiers.

  **Default:** no identifiers used

  Identifiers can be used to redirect users to the correct IdP in multitenant apps.

- `idpInitiated`: boolean = false — Whether to enable IdP-initiated SAML auth flows.

- `idpSignout`: boolean = false — Whether to enable the "Sign-out flow" feature.

- `metadata`: [UserPoolIdentityProviderSamlMetadata](/cdk/api/v2/docs/aws-cdk-lib.aws_cognito.UserPoolIdentityProviderSamlMetadata.html) (required) — The SAML metadata.

- `name`: string — The name of the provider.

  **Default:** the unique ID of the construct

  Must be between 3 and 32 characters.

- `requestSigningAlgorithm`: [SigningAlgorithm](/cdk/api/v2/docs/aws-cdk-lib.aws_cognito.SigningAlgorithm.html) — The signing algorithm for SAML requests.

  **Default:** don't sign requests

- `userPool`: [IUserPool](/cdk/api/v2/docs/aws-cdk-lib.aws_cognito.IUserPool.html) (required) — The user pool to which this construct provides identities.