Assertion Consumer Service for IdP-initiated SAML 2.0. Your identity provider posts SAMLResponse (and optionally RelayState) here with the HTTP-POST binding. SP-initiated requests are not supported.

Grid validates

• Issuer matches the IdP entity ID saved on the parent customer.
• The assertion is signed by one of the saved certificates (the outer response may be unsigned).
• Audience is urn:grid:saml:{parentCustomerId}.
• Destination and SubjectConfirmationData/@Recipient equal this exact ACS URL.
• The assertion is within its validity window (2 minutes of clock skew), at most 5 minutes old, and has not been used before.

Identity

Email is read from the email attribute, then mail, then urn:oid:0.9.2342.19200300.100.1.3, then an email-format NameID. Session rules match the HMAC launch: customerId in the URL is the target (the parent or a direct sub-organization).

When Grid creates a user, it uses firstName, lastName, and the optional role attribute (the first value if several are sent; default Case Reviewer). Admin and Billing are rejected with SSO_ROLE_NOT_ASSIGNABLE, and an unknown role name with SSO_ROLE_NOT_FOUND. Existing users keep their current role.

RelayState

Optional portal URL to return to after sign-in. Its origin must be one of the saved portal origins (outside production, localhost is also accepted). Anything else is ignored.

Response

302 to {Orchestrator host}/auth/callback?code=<one-time code>&method=sso, or on failure to /auth/callback?method=sso&error=<CODE>: SSO_SIGNATURE_INVALID, SSO_LAUNCH_REPLAYED, SSO_LAUNCH_FIELD_REQUIRED, SSO_LAUNCH_TARGET_INVALID, SSO_SAML_CONFIGURATION_NOT_FOUND, SSO_MODULE_NOT_ENABLED, CUSTOMER_NOT_FOUND, SSO_USER_CUSTOMER_MISMATCH, SSO_USER_NOT_ORCHESTRATOR, SSO_ROLE_NOT_ASSIGNABLE, SSO_ROLE_NOT_FOUND, FORBIDDEN.