Skip to content
Plune Plune Plune Docs

The assertion consumer service - the identity provider’s response

POST
/v1/auth/sso/{companyId}/acs
 
curl --request POST \
  --url https://beta-api.plune.ai/v1/auth/sso/example/acs \
  --header 'Content-Type: application/x-www-form-urlencoded' \
  --data ''

The browser posts here what the provider answered (SAMLResponse, RelayState; HTTP-POST binding). Accepted only if: the assertion is signed by one of the company’s certificates with SHA-256 or stronger; Issuer, Audience, Destination and Recipient are ours; InResponseTo is a request THIS company issued in the last ten minutes (used once, good or bad); the clocks agree within two minutes and the assertion is under five minutes old; its id was not seen; the address is in a domain the company proved; the company has the option and has it on. Then the person is found or made by the same findOrCreateUser as a magic link (the beta list does not apply to a verified domain of such a company), joins the company only if jit is on (default role, a reader when no write seat is free, never a manager or an owner) and was not removed from it, and gets the same plune_session cookie with the sign-in method recorded, for at most seven days and not past the provider’s SessionNotOnOrAfter. With a web app configured the answer is a 303 into it (/ on success, /login?sso=failed otherwise); without one, 200 { ok, userId }, 403, or 409 session_conflict when the browser already holds somebody else’s live session (a web app gets /login?sso=session_conflict). The reason of a refusal is in the company’s log and never in the answer. There is no provider-initiated login and no single logout. 30 a minute a client address. Every answer is Cache-Control: no-store, Referrer-Policy: no-referrer, X-Robots-Tag: noindex, nofollow and X-Content-Type-Options: nosniff.

Parameters

Section titled “ Parameters ”

Path Parameters

Section titled “Path Parameters ”
companyId
required
string

Request Body required

Section titled “Request Body required ”
Media type application/x-www-form-urlencoded
object
SAMLResponse
required

Base64 of the Response, at most 256 KiB

string
RelayState
required
string
Example 
SAMLResponse=PHNhbWxwOlJlc3BvbnNlIC8%2B&RelayState=Zt3bQ0kC1mB7wX2nY5aP9d4h

Responses

Section titled “ Responses ”

200

Section titled “200 ”

Signed in (no web app configured): the plune_session cookie is set

Media type application/json
object
ok
required
boolean
userId
required
string
Example generated
{
  "ok": true,
  "userId": "example"
}

303

Section titled “303 ”

Into the web app: / signed in, /login?sso=failed not

Headers

Section titled “Headers ”
Location
string

403

Section titled “403 ”

Single sign-on did not work (no reason is given; the company’s log has it)

Media type application/json
object
error
required
string
Example generated
{
  "error": "example"
}

409

Section titled “409 ”

The browser holds a live session of another person: sign out first (session_conflict); a session is never replaced by a response

Media type application/json
object
error
required
string
Example generated
{
  "error": "example"
}

429

Section titled “429 ”

Rate-limited: the per-route throttle, or the per-minute request limit of the plan an API token counts by (#1442; the body names the plan, #2092). Retry-After carries the seconds until the window rolls over.

Media type application/json
object
error
required
string
Example generated
{
  "error": "example"
}

Headers

Section titled “Headers ”
Retry-After
integer

Seconds until the window rolls over