Skip to main content

SAML

Configure SAML 2.0 under Admin → Settings → Authentication → SAML 2.0.

Groove uses the same Service Provider path shape as Appsmith Business (Keycloak broker) so you can migrate an existing IdP registration with minimal changes. The path segment appsmith is intentional for compatibility.

Service provider details (give these to your IdP)​

FieldPath
Redirect URL (ACS){BASE_URL}/auth/realms/appsmith/broker/saml/endpoint
Entity ID{BASE_URL}/auth/realms/appsmith

Example if your instance is https://builder.example.com:

  • Redirect URL: https://builder.example.com/auth/realms/appsmith/broker/saml/endpoint
  • Entity ID: https://builder.example.com/auth/realms/appsmith

Register your Identity Provider​

  1. Paste your IdP Metadata URL (or configure XML / IdP data as your IdP provides).
  2. Set APPSMITH_SAML_IDP_METADATA_URL (env) or save it in Admin settings.
  3. Set APPSMITH_BASE_URL to the public HTTPS URL of this Groove instance (same host the IdP will call).

Optional override: APPSMITH_SAML_ENTITY_ID if you must use a non-default entity ID (defaults to {BASE_URL}/auth/realms/appsmith).

Migrating from Appsmith​

If your IdP already has the Appsmith Redirect URL / Entity ID paths above:

  1. Point DNS (or update only the hostname in the IdP) at Groove.
  2. Keep the /auth/realms/appsmith/... paths unchanged.
  3. Point Groove at the same IdP metadata URL.

Legacy Spring Security paths (/login/saml2/sso/saml, /saml2/service-provider/metadata/saml) still work as aliases.