Overview
The FOIAXpress PAL SAML Login and Proof of Identity Configuration manual was created to assist administrators when configuring the SAML Login and Proof of Identity Verification features. This document provides information on how to complete PAL SAML Configuration, as well as Proof of Identity Configuration, and using the PAL SAML Configuration to create a PFX Certificate.
The Public Access Link (PAL) works with forms authentication by default; however, if an agency needs to enable Security Assertion Markup Language (SAML) Authentication for requester login, the system can be configured with your identity provider details following the directions in this section. PAL can also be configured to provide Proof of Identity verification with identity providers such as Login.gov.
Prerequisites
Ensure you have the Personal Exchange Format (PFX) file and its public key ready as well. You will need to provide the PFX file in PAL SAML Configuration, and the corresponding public key in the IDP app/account. Consult the Create PFX Certificate section for information on how to get the PFX Certificate file and its public key.
Authentication Options
Option | Description |
|---|---|
Forms | Allows requesters to sign in using a PAL username and password. Selecting this option displays the OTP Settings panel. |
SAML SSO | Enables federated sign-in. Selecting this option displays the Purpose of SAML Configuration drop-down menu and the SAML configuration wizard. |
Disable SAML SSO for PAL Config | Disables SAML SSO for the PAL Configuration application. No additional settings are displayed. |
.png?sv=2026-02-06&spr=https&st=2026-08-18T12%3A13%3A53Z&se=2026-08-18T12%3A37%3A53Z&sr=c&sp=r&sig=5D16xN1X61VzN0l6R0a7ib9DDTDvZwOUofWHLXyRIFo%3D)
Forms Authentication and OTP Settings
Select Forms to authenticate requesters with a PAL username and password. PAL can additionally send a one-time passcode (OTP) at sign-in. Complete the OTP Settings fields and click Save Configuration.
Option | Description |
|---|---|
OTP Notification Type | Required. Select how the one-time passcode (OTP) is delivered: None or Email. By default, no OTP is sent. |
OTP Expiry Time | Required. Specifies how long the one-time passcode remains valid, in minutes. The default value is 3 minutes. |
Enable PAL Requester Login Using SAML SSO
Follow the steps below to enable PAL requester login using SAML authentication:
NOTE: To configure the SAML SSO from PAL Configuration, the PAL configuration application must have permission to the PAL application folder with full control. If this is not applicable, use the PAL SAML Configuration Tool.
Log in to PAL Configuration and access Authentication in the left-hand menu
In the Authentication Options section, select one of the following radio buttons: Forms, SAML SSO, or Disable SAML SSO for PAL Config.
Select the SAML SSO radio button
Select a Purpose
The Purpose of SAML Configuration drop-down menu stays visible above the wizard at all times. Select the Purpose of SAML Configuration drop-down menu to choose the configuration you are setting up:
PAL Application Sign In — Federated sign-in for the PAL requester portal
Proof of Identity — Identity verification with providers such as Login.gov
PAL Config Sign In — Federated sign-in for the PAL Configuration application
You can select only one purpose at a time. Each purpose keeps its own saved configuration: switching the drop-down loads the settings saved for the newly selected purpose and never overwrites the configuration of another purpose.
NOTE: The Assertion Consumer URL for PAL Requester Login and Proof of Identity are different. The wizard shows the correct Assertion Service URL for the selected purpose.
.png?sv=2026-02-06&spr=https&st=2026-08-18T12%3A13%3A53Z&se=2026-08-18T12%3A37%3A53Z&sr=c&sp=r&sig=5D16xN1X61VzN0l6R0a7ib9DDTDvZwOUofWHLXyRIFo%3D)
Move Through the Wizard
Below the Purpose of SAML Configuration drop-down menu, a step indicator (stepper) guides you through the configuration. The number of steps depends on the selected purpose
PAL Application Sign In and Proof of Identity — four steps: Service Provider, Identity Provider, SAML Field Mapping, and Review & Save.
PAL Config Sign In — three steps: Service Provider, Identity Provider, and Review & Save. The SAML Field Mapping step does not apply and is not displayed.
Use the Next button in the navigation bar at the bottom of each step, and Previous to return to the preceding step. You can also click a step in the stepper to jump directly to it. Completed steps display a checkmark.
NOTE: Each purpose keeps its own saved configuration, including certificates and the advanced checkboxes. Switching the Purpose of SAML Configuration drop-down menu loads that purpose’s settings and never overwrites another purpose.
Configure PAL Application Sign In
Select PAL Application Sign In from the Purpose of SAML Configuration drop-down menu to set up federated sign-in for the PAL requester portal. The wizard has four steps. The field reference below applies to all three purposes; the sections for the other two purposes describe only what differs.
Step 1: Service Provider
Enter the Service Provider details as outlined below:
Field | Description |
|---|---|
Issuer/Entity ID (Name) | Required. Enter the service provider entity ID. This value uniquely identifies the identity provider and is case-sensitive. |
Assertion Service URL | Required. Enter the URL where the identity provider sends SAML responses after user authentication. PAL automatically populates the URL based on the selected purpose. Replace |
Download XML Metadata | Download the service provider metadata XML file for the selected purpose and share it with your identity provider. The file name varies based on the selected purpose. |
Advanced Settings | Select this checkbox to display additional certificate settings. Clear the checkbox to hide the fields. Any saved values are retained. |
Signature Certificate Password | Enter the password for the service provider certificate when a certificate path is specified. PAL uses this password to validate the certificate. |
NOTE: The Signature Certificate path and Encryption Certificate Path fields now support direct file upload using the Select button. You no longer need to manually enter the file path.
Select the Advance Settings checkbox in the Service Provider step to display the Certificate drop-down menu, which offers three options: None, PFX Certificate, and Serial Number. None is the default selection.
None — No service provider certificate is configured. Only the Sign Authentication Request and Want Assertion Encrypted checkboxes are hidden along with the certificate fields.
PFX Certificate — Displays the Signature Certificate file upload, Signature Certificate Password, Signature Certificate Expiration Date, and the Use Same Certificate for Encryption checkbox, which is selected by default. If you clear it, the matching Encryption Certificate upload, Encryption Certificate Password, and Encryption Certificate Expiration Date fields appear.
Serial Number — Displays the Certificate Serial Number and Certificate Expiration Date fields. The serial number of the service provider certificate is used to validate the certificates exchanged between systems.
When PFX Certificate or Serial Number is selected, two additional checkboxes are displayed. Both are cleared by default:
Sign Authentication Request — Signs the authentication request that PAL sends to the identity provider.
Want Assertion Encrypted — Requires the identity provider to encrypt the assertion.
NOTE: When you select Use Same Certificate for Encryption, the system automatically applies the Signature Certificate configuration to the Encryption Certificate. The Signature Certificate and Encryption Certificate uploads accept .pfx files only. All other file types are filtered out and cannot be selected. Signature Certificate Expiration Date and Encryption Certificate Expiration Date are read-only. Until a certificate is uploaded they display the placeholder (Auto-populated on update).
Step 2: Identity Provider
Next, enter the Identity Provider details. This step contains two panels: Identity Provider and Identity Provider Certificates. Each panel has its own Advance Settings checkbox, and the two work independently of each other.
Column Name | Description |
|---|---|
Upload Metadata XML Here | Upload the identity provider's metadata XML file. Only .xml files are supported. When a valid file is uploaded, the Identity Provider and IDP Certificate fields are populated automatically. The Entity ID/Name and SSO URL fields remain editable. |
Entity ID/Name | Required. Enter the identity provider's Entity ID (Issuer). |
Single Sign ON Service (SSO) URL | Enter the SSO endpoint URL provided by the identity provider. |
Test Connection | Validates the current SAML SSO configuration and displays the results of the connection test. |
Select the Advance Settings checkbox in the Identity Provider panel to display these fields: SAML SSO URL Binding Type, Single Logout Service (SLO) URL, SAML SLO URL Binding Type, Name ID Format, Authentication Context, and Authentication Context Comparison. All of these values are provided by your IDP if required.
Clearing the checkbox hides the fields again but keeps any values you entered. Each section’s Advance Settings checkbox works independently of the others.
Identity Provider Certificates
The Identity Provider Certificates panel, below the Identity Provider panel on the same step, shows the following basic fields:
Column Name | Description |
|---|---|
Signature Certificate Text | To be provided by IDP. |
Encryption Certificate Text | To be provided by IDP (same as a Signature Certificate Text). |
Certificate (file upload) | Upload the identity provider public certificate using the Select button. Only .cer, .pfx, .crt, and .pem files can be selected — all other file types are filtered out. We recommend using Signature Certificate text and Encryption Certificate Text and skipping this field. For Login.gov the IDP certificate x509 can be found at the following URL: https://developers.login.gov/saml/ |
Expiration date fields | Signature Certificate Expiration Date, Encryption Certificate Expiration Date, and IDP Certificate Expiration Date are read-only and automatically populated when the corresponding certificate is updated. Until then they display the placeholder (Auto-populated on update). |
NOTE: For some IDPs the x509 certificate text has to be updated each year and a reminder that the sandbox and production certificates may not be the same.
Select the Advance Settings › checkbox in the Identity Provider Certificates panel to display these options as checkboxes: Want SAML Response Signed, Want Assertion Signed, Encrypt Logout Name ID, Force Authentication, Sign Logout Request, Sign Logout Response, and Disable In Response To Check.
Set these seven checkboxes to match what your identity provider requires. They are stored separately for each purpose, so selecting a different purpose loads that purpose’s own settings. If your identity provider supports single logout, select Sign Logout Request and Sign Logout Response.
Step 3: SAML Field Mapping
The SAML Field Mapping step shows the following basic fields:
When the selected purpose is PAL Application Sign In or Proof of Identity, SAML Field Mapping is the third step of the wizard. It is not displayed for PAL Config Sign In, where Review & Save becomes step 3 instead.
The mapping table has these columns: Pal Field, Provider Field, Description, and Action (a Delete button per row).
Three rows are seeded by default — Email, First Name, and Last Name. Each row can be edited or deleted.
• Select Add to add a new empty mapping row. All three values (Provider Field, PAL Field, and Description) are required while adding a new SAML field in Mappings.
• Select the Delete control on a row to remove that mapping.
NOTE: The provider fields for both ‘Email and Login PAL Fields are the same.
Once all the required fields are complete, click Next
Step 4: Review & Save
The summary shows Configuration Overview, Service Provider, Identity Provider, and SAML Field Mapping. Click Previous to correct anything, then Save Configuration to apply the configuration.
The final step presents all configured values as read-only cards: Purpose, Service Provider, Identity Provider, Identity Provider Certificate, and SAML Field Mapping (shown only for PAL Application Sign In or Proof of Identity).
Configuration Overview lists Sign-On Mode and Purpose.
Each configured field is shown as a label–value pair. Fields you have not configured display Not configured in muted styling
The identity provider certificate values appear inside the Identity Provider section — there is no separate certificate section.
Advance Settings and each individual option — for example Sign Authentication Request and Want Assertion Encrypted — are shown as an Enable or Disable value.
The SAML Field Mapping section is a read-only table with the columns Pal Field, Provider Field, and Description
Select Previous to return to the preceding step and make corrections before saving
Select Save Configuration to save the SAML SSO configuration for the selected purpose
NOTE: Saving the Authentication Configuration may restart the PAL application automatically. If your changes are not reflected in the PAL application, restart the PAL application manually from the server.
Configure Proof of Identity
Select Proof of Identity from the Purpose of SAML Configuration drop-down menu to verify a requester’s identity with a provider such as Login.gov. The wizard has the same four steps as PAL Application Sign In. Only the differences are described below — for the full field reference, see Configure PAL Application Sign In.
Before you begin
• Configure a separate identity provider entity account. You cannot use the same account for PAL Application Sign In and for Proof of Identity.
• Set up your sandbox environment. Some providers let you do this yourself; others perform the setup on your behalf.
• You can use either level 1 or level 2 for sign-in, but level 2 is required for identity verification.
• Make sure the assertion URL recorded in your identity provider account matches the Assertion Service URL shown in Step 1 for this purpose.
Step 1: Service Provider
Enter the Service Provider details as outlined below:
Field | Description |
Issuer/Entity ID/Name | Required. Enter the entity ID of the identity provider (IdP) account configured for identity verification. This value must be different from the entity ID used for PAL Application Sign In. |
Assertion Service URL | Required. Pre-populated with the Proof of Identity assertion consumer service URL: https://<hostname>/app/AssertionConsumerServicePoi.aspx. Replace <hostname> with your organization's hostname. The Poi suffix identifies this URL as the Proof of Identity endpoint and distinguishes it from the requester sign-in assertion service URL. |
NOTE: Give your identity provider the Proof of Identity assertion URL, not the requester sign-in URL. Using the wrong URL is the most common cause of a failed verification.
Certificate configuration under Advance Settings works exactly as described for PAL Application Sign In and is stored separately for this purpose.
Step 2: Identity Provider
The Identity Provider and Identity Provider Certificates panels contain the same fields as PAL Application Sign In. Enter the values for the identity provider account you created for identity verification. For Login.gov, the IDP x509 certificate is published at https://developers.login.gov/saml/.
Step 3: SAML Field Mapping
The mapping table has the same columns and controls as PAL Application Sign In, but the mapped values are used differently. For Proof of Identity, the PAL Field entries become the labels printed on the verification document that accompanies the request submission to FOIAXpress/ATIPXpress. The document is added automatically to the Proof of Identity attachment area and is available in the Correspondence Log of the request.
Map every attribute you want to appear on that document — typically first name, last name, email, address, and any identity attribute your provider returns.
NOTE: A Social Security number is masked on the verification document only if the Pal Field is named SSN, Social Security, or Social Security Number. Any other name leaves the value unmasked.
Step 4: Review & Save
The summary shows Configuration Overview, Service Provider, Identity Provider, and SAML Field Mapping. Click Previous to correct anything, then Save Configuration to apply the configuration.
Review & Save behaves exactly as it does for PAL Application Sign In and includes the SAML Field Mapping section. Click Save Configuration to store the configuration for this purpose.
Finish the setup on the Request Fields page
Saving the SAML configuration does not by itself switch requesters to digital verification. To turn it on, go to Request Fields in the left-hand menu, find the Proof of Identity Mode request field, and select Digital Authentication or Upload Attachment/Digital Authentication from the drop-down menu in the Default column, then scroll down and click Save.
Configure PAL Config Sign In
Select PAL Config Sign In from the Purpose of SAML Configuration drop-down menu to set up federated sign-in for the PAL Configuration application itself — the application you are using to make these settings. This purpose affects administrators, not requesters.
NOTE: This wizard has three steps, not four. PAL Configuration does not register new users from a SAML assertion, so the SAML Field Mapping step does not apply and is not displayed. Review & Save becomes step 3.
Step 1: Service Provider
Enter the Service Provider details as outlined below:
Field | Description |
Issuer/Entity ID/Name | Required. Enter the entity ID registered with your identity provider (IdP) for the PAL Configuration application. For example, https://<hostname>/palconfig. Replace <hostname> with your organization's host name. |
Assertion Service URL | Required. Pre-populated with the PAL Configuration assertion consumer service URL: https://<hostname>/palconfig/index.aspx. Replace <hostname> with your organization's host name. |
Click Download XML Metadata to hand the service provider metadata to your identity provider, and configure certificates under Advance Settings as described for PAL Application Sign In.
Step 2: Identity Provider
The Identity Provider and Identity Provider Certificates panels are identical to other purposes. Enter the entity ID, SSO URL, and certificate details of the identity provider application registered for PAL Configuration, then click Test Connection to check the values before you continue.
Step 3: Review & Save
The summary shows Configuration Overview, Service Provider, and Identity Provider. There is no SAML Field Mapping section for this purpose. Click Previous to correct anything, then Save Configuration to apply the configuration.
Disable SAML SSO for PAL Config
Select Disable SAML SSO for PAL Config to temporarily or permanently turn off SAML-based Single Sign-On (SSO) authentication for PAL (Public Access Link) access.
When this option is enabled:
Administrators signing in to PAL Configuration are not redirected to the external Identity Provider (IdP) for authentication.
The system will bypass the SAML SSO settings configured for the PAL Configuration application.
Alternative authentication methods (such as Forms authentication, if configured) will be used instead.
This option is useful for troubleshooting SSO issues, testing access behavior, or when SAML configuration is incomplete or unavailable.
NOTE: This option does not affect the requester portal. Requester sign-in is controlled by the PAL Application Sign In purpose under SAML SSO.
No additional fields are displayed. Click Save Configuration to apply the change.