Press CTRL+K to open search

aaa authentication saml web policy

  • Published on Aug 4, 2026
  • 2 minute(s) read
Prev Next

Sets the Security Assertion Markup Language (SAML) single sign-on (SSO) policy on the appliance.

You can specify the following policies for using single sign-on:

  • allowed:

    SSO login is optional. The first time a user makes a Web request for a SAML appliance Web UI page, the appliance Web UI displays two login options:

    • The standard login page (username and password fields.)

    • A Sign In Using SAML link.

  • disabled:

    SSO login is not accepted for authentication. If no local session exists when a user makes a Web request for a SAML appliance Web UI, the standard local login page for the appliance appears, and the user signs in using their local credentials for that appliance.

  • required:

    SSO login is mandatory for authentication. The first time a user makes a Web request for a SAML appliance Web UI page a Sign In Using SAML link appears on the login page. After successful authentication, an SSO session is established and the Dashboard page of the SAML appliance appears.

    Note

    If a SSO session is open when the user logs out of a SAML appliance, the user can continue to work in the SAML Web UI until the SSO session expires.

  • required-force:

    SSO login is mandatory and automatically provided. When the user visits the login page, they are automatically redirected to the IdP login page.

Note

System admins can log into the CLI interface using standard local authentication methods even if the SAML Web policy is set to required or required-force.

Syntax

[no] aaa authentication SAML web policy { disabled | allowed | required | required-force }

Parameters

no

Sets the SAML Web policy to the default (disabled) policy.Use either SAML authentication or local authentication methods.Disables SAML authentication (default)

required

Must use SAML authentication.

required-force

Must use SAML authentication and the login page automatically redirects to the IdP login page.

Example

The following example sets the SAML Web policy to required.

hostname (config) # aaa authentication saml web policy required

The following example sets the SAML Web policy to required-force.

hostname (config) # aaa authentication saml web policy required-force

The following example sets the SAML Web policy to allowed.

hostname (config) # aaa authentication saml web policy allowed

The following example sets the SAML Web policy to disabled.

hostname (config) # aaa authentication saml web policy disabled

The following example sets the SAML Web policy to the default policy (disabled).

hostname (config) # no aaa authentication saml web policy

User role

Admin

Command mode

Config

Supported appliances

  • Central Management System: Release 8.7.1. The parameter required-force was added in Release 9.1.0.

  • Network Security: Release 8.3.2. The parameter required-force was added in Release 9.1.0.

  • File Protect: Release 8.3.0. The parameter required-force was added in Release 9.1.0.

  • Malware Analysis: The parameter required-force was added in Release 9.1.0.

Related articles