FOIAXpress SAML SSO Configuration

Overview

The Sign On Mode dialog in FOIAXpress allows system administrators to integrate FOIAXpress with an external Identity Provider (IdP) that supports the Security Assertion Markup Language (SAML) 2.0 protocol.

When SAML SSO is active, FOIAXpress delegates user authentication to the configured IdP — such as Active Directory Federation Services (ADFS), Microsoft Entra ID (formerly Azure Active Directory), Okta, PingFederate, or any other SAML 2.0-compliant provider — instead of using local FOIAXpress credentials.

Regardless of the Identity Provider, the steps to configure Sign On Mode on FOIAXpress remain the same.

NOTE: When SAML SSO is selected as the Sign On Mode, all required fields in the Service Provider, Identity Provider, and IDP Certificate steps must be populated. An incomplete configuration cannot be saved. Additionally, changing the Sign On Mode terminates active sessions. It is recommended to plan this operation during a scheduled maintenance window or outside peak business hours to minimize disruption.

Prerequisites

Before you access the Sign On Mode dialog, the FOIAXpress administrator must obtain the following values from the IdP administrator. The table below maps each required value to the FOIAXpress field it populates.

Required Value	Alternate Identifier (in IdP)	FOIAXpress Field
Entity ID / Issuer	Audience URI; Relying Party Identifier; SP Issuer	Issuer (Service Provider section)
Assertion Consumer Service URL	ACS URL; Reply URL	Assertion Service URL (Service Provider section)
IdP Entity ID / Issuer URL	Federation Service Identifier; Azure AD Identifier; Issuer	IDP Entity ID / Issuer URL
SSO Service URL	SAML Single Sign-On Endpoint; Login URL	SAML SSO URL
IdP Signing Certificate	Token-signing certificate; Federation certificate (public key)	Identity Provider Certificate file (.cer) referenced in the SAML configuration
SLO / Logout URL	Single Logout Service URL; SAML Logout endpoint	SAML SLO URL
Name ID Format (optional)	NameIDFormat URN — e.g., urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress	Name ID Format (leave blank to use the IdP default)
IdP metadata XML file (optional)	Federation metadata XML; IdP metadata document	Upload Metadata XML (Identity Provider step)

Ensure that you using version 11.7.2 or above. If not, you must Update Assertion URL.
Obtain the metadata XML file from your IdP administrator where one is available; FOIAXpress populates every Identity Provider and IDP Certificate field whose value is present in the file

Configuration Checklist

Confirm that each of the following items is complete before proceeding to the configuration steps.

Issuer for FOIAXpress has been determined and registered in the IdP (for example, https://myDns/FOIAXpress, or a unique name such as casepointFOIAXpressProd).
Assertion Service URL (https://<<DNS>>/FOIAXpress/AssertionConsumerService.aspx) has been registered in the IdP.
IdP Entity ID / Issuer URL has been copied exactly as it appears in the IdP configuration.
IdP SAML SSO URL has been copied and confirmed reachable from the FOIAXpress server network.
Identity Provider Certificate has been exported as a Base64-encoded .cer file. (See Retrieve a .cer File via the Certificate Management Console.)
IdP Logout (SLO) URL has been copied (if single logout will be used).
If the IdP requires signed authentication requests: an SP signing certificate (.pfx) and its password have been prepared.
If the IdP requires encrypted assertions: an SP encryption certificate (.pfx) and its password have been prepared.
A maintenance window has been scheduled. Changing the Sign On Mode terminates active sessions.
At least one local FOIAXpress administrator account with a known password exists and is documented securely as a break-glass account.
A decision has been made on whether your IdP team will import the Service Provider metadata XML file, which you can download from the Service Provider step, or configure the values manually

Accessing the Sign On Mode

The Sign On Mode dialog is available in the FOIAXpress application.

To access the dialog:

Sign in to FOIAXpress with an Admin role.
Navigate to Administration.
Select Security and select Sign On Mode.

The Sign On Mode page allows you to configure how you authenticate into FOIAXpress. When enabled, SAML-based Single Sign-On (SSO) lets you sign in using your organization’s identity provider instead of a separate FOIAXpress account. This configuration typically requires coordination with your IT or identity management team.

The Sign On Mode drop-down menu offers two options — Forms and SAML SSO — which display different fields, described in the sections below.

Forms Authentication

Select Forms to have users sign in with a FOIAXpress user name and password instead of an identity provider. Forms mode displays a single additional field:

Field	Description
Membership Provider	Specifies the provider used to store FOIAXpress user accounts. Database is the only available option and is selected by default.

There are no other fields to complete. Click Save to apply the change.

SAML SSO Configuration

Selecting SAML as the Sign On Mode

Select SAML SSO from the Sign On Mode drop-down menu.

Selecting SAML SSO displays the SAML SSO Configuration wizard. A step indicator guides you through three steps: Service Provider, Identity Provider, and Review & Save.

• Click Next to move forward and Back to return to the previous step.

• Click a numbered step in the indicator to jump straight to that step.

• Required fields are marked with a red asterisk.

• Each panel has its own collapsible Advanced Settings section. Click the heading to expand or collapse it.

Step 1: Service Provider

Enter the Service Provider details for the relying party identifier.

These are shown below and described in the following table:

Field	Description
Sign Authentication Request	Signs the authentication request that FOIAXpress sends to your identity provider.
Want Assertion Encrypted	Requires your identity provider to encrypt the assertion.
Certificate	Selects how the service provider certificate is supplied: None, PFX Certificate, or Serial Number. The remaining fields change with your choice.

None — No service provider certificate is configured and no certificate fields are displayed.
PFX Certificate — Displays Signature Certificate with a Select button, the Use same certificate for encryption checkbox, Signature Certificate Password, and a read-only Signature Certificate Expiration Date. Clearing the checkbox adds the matching Encryption Certificate, password and expiration date fields.
Serial Number — Displays Certificate Serial Number and a read-only Certificate Expiration Date.

NOTE: The Signature Certificate and Encryption Certificate uploads accept .pfx files only. Click the red X beside a field to clear the selected file. Expiration dates are read-only and show Auto-populated on update until a certificate is supplied.

Step 2: Identity Provider

Enter the Identity Provider values (SAML SSO Identity Provider) in the corresponding fields.

These are shown below and described in the following table:

Field	Description
Upload Metadata XML	Upload the metadata file supplied by your identity provider. Only .xml files are accepted.
Identity Provider Entity ID	Required. The unique identifier for your identity provider.
SAML SSO URL	Required. The endpoint FOIAXpress redirects you to for signing in.
Test Connection	Validates the SAML SSO connection using the values currently entered and displays the result.

Click Advanced Settings in the Identity Provider panel to display these fields. All of them are provided by your identity provider if required.

Field	Description
SAML SSO URL Binding Type	Determines how messages are transmitted (for example, HTTP POST).
SAML SSO URL	Used if single logout is configured by your organization.
SAML SLO URL Binding Type	Determines how single logout messages are transmitted.
Name ID Format	Specifies the identifier format sent by your identity provider.
Authentication Context	Allows you to specify required authentication strength if your organization requires it.
Authentication Context Comparison	Sets how the requested authentication context is compared, if your organization requires it.

Identity Provider Certificate

The Identity Provider Certificate panel sits below the Identity Provider panel on the same step. If signing or encryption is required by your organization, you must enter the Signature Certificate Text and Encryption Certificate Text, respectively. FOIAXpress does not enforce which signing or encryption requirements you must choose. These depend entirely on your identity provider’s policies.

Field	Description
Signature Certificate Text	The x509 signing certificate supplied by your identity provider. A read-only Signature Certificate Text Expiration Date is displayed beneath it.
Encryption Certificate Text	The encryption certificate supplied by your identity provider, with its own read-only expiration date.
Certificate	Optionally upload the identity provider certificate as a file instead of pasting the text. Only .cer, .crt and .pem files can be selected. A read-only IDP Certificate Expiration Date is displayed beneath it.

NOTE: Expiration dates display beneath each certificate field and read Auto-populated on update until a certificate is supplied. If a certificate cannot be read or has expired, you must upload a valid one before SSO can function. Admin users receive an automated email notification 30 days before certificate expiration.

Click Advanced Settings in the Identity Provider Certificate panel and select the remaining checkboxes as needed depending on your configuration requirements.

Want SAML Response Signed
Want Assertion Signed
Force Authentication — prompts your IdP to re-challenge the user at every login
Sign Logout Request
Sign Logout Response

NOTE: Force authentication may increase login time because your identity provider will not reuse an existing session.

Step 3: Review & Save

The final step presents everything you have entered as read-only sections: Service Provider, Identity Provider, and Identity Provider Certificate.

Each setting is shown as a label and value. Anything you have not configured reads Not configured in muted text, and an enabled checkbox reads Enabled.
Certificate files are listed by name with their expiry, for example IDP_Cert.pem (exp: 2026-05-22). Long certificate text is truncated — click Show More to expand it.
Click Back to return to the Identity Provider step and make corrections.

Click Save on the Review & Save step to apply the configuration.