Security · AMP
Implementing SAML 2.0 Single Sign-On in Liferay DXP
To implement SAML 2.0 SSO in Liferay DXP, deploy Liferay's SAML 2.0 Provider module, enable it in System Settings, upload your identity provider metadata, exchange certificates, and configure attribute mappings for automated user provisioning.
Exchanging Metadata and Certs
SAML Single Sign-On relies on mutual trust established via digital certificates. First, configure your Identity Provider (Okta or Azure AD) and download its metadata XML. Import this XML file into Liferay's SAML admin panel and generate a keypair. Export Liferay's metadata XML and upload it to your IdP to complete the handshake link.
# Typical SAML metadata exchange variables
Entity ID: liferay-portal-sp
ACS URL: https://liferayx.com/c/portal/saml/acs
Binding: HTTP-POST
Automated User Provisioning
When users log in via SSO, Liferay can create accounts on-the-fly using SAML User Provisioning. Map IdP fields (e.g., emailAddress, firstName, lastName) to Liferay fields in System Settings. This guarantees new employees automatically gain access to correct user profiles without manual directory syncs.
Troubleshooting SSO Failures
If logins fail, inspect Liferay log files. Enable debug logging on SAML packages (com.liferay.saml)
using Liferay's Server Administration. Common issues include certificate expiration, clock drift between systems,
and mismatching entity identifiers in configuration profiles.
Frequently asked questions
Does Liferay support Identity Provider (IdP) mode?
Yes. Liferay DXP can act either as a Service Provider (SP) connected to Okta/Azure or as a primary Identity Provider (IdP) authenticating external clients.
Are SAML assertions encrypted by default?
Encryption depends on IdP settings, but Liferay strongly recommends enabling signed and encrypted SAML assertions to secure tokens in transit.
Read the full article, with table of contents, comparison table, and author bio →