---
title: "Show SSO Strategy"
method: GET
path: "/sso_strategies/{id}"
tags: ["sso_strategies", "SSO Strategies"]
---

# Show SSO Strategy

`GET /sso_strategies/{id}`

Show SSO Strategy

## Path parameters

- `id` integer, required

## Response `200`

The SsoStrategies object.

- SsoStrategyEntity — SsoStrategyEntity model
  - `protocol` 'oauth2' | 'saml' | 'active_directory' | 'open_ldap' | 'scim' — SSO Protocol
  - `provider` 'google' | 'auth0' | 'okta' | 'azure' | 'box' | 'dropbox' | 'slack' | 'onelogin' | 'saml' | 'idaptive' | 'ldap' | 'scim' | 'jumpcloud' | 'duo' — Provider name
  - `label` string — Custom label for the SSO provider on the login page.
  - `logo_url` string — URL holding a custom logo for the SSO provider on the login page.
  - `id` integer — ID
  - `enabled` boolean — Is strategy enabled? This may become automatically set to `false` after a high number and duration of failures.
  - `user_count` integer — Count of users with this SSO Strategy
  - `saml_provider_cert_fingerprint` string — Identity provider sha256 cert fingerprint if saml_provider_metadata_url is not available.
  - `saml_provider_issuer_url` string — Identity provider issuer url
  - `saml_provider_metadata_content` string — Custom identity provider metadata
  - `saml_provider_metadata_url` string — Metadata URL for the SAML identity provider
  - `saml_provider_slo_target_url` string — Identity provider SLO endpoint
  - `saml_provider_sso_target_url` string — Identity provider SSO endpoint if saml_provider_metadata_url is not available.
  - `scim_authentication_method` 'none' | 'basic' | 'token' — SCIM authentication type.
  - `scim_username` string — SCIM username.
  - `scim_oauth_access_token` string — SCIM OAuth Access Token.
  - `scim_oauth_access_token_expires_at` string — SCIM OAuth Access Token Expiration Time.
  - `subdomain` string — Subdomain or domain name for your auth provider. Example: `https://[subdomain].okta.com/`
  - `provision_users` boolean — Auto-provision users?
  - `provision_groups` boolean — Auto-provision group membership based on group memberships on the SSO side?
  - `deprovision_users` boolean — Auto-deprovision users?
  - `deprovision_groups` boolean — Auto-deprovision group membership based on group memberships on the SSO side?
  - `deprovision_behavior` 'disable' | 'delete' — Method used for deprovisioning users.
  - `provision_group_default` string — Comma-separated list of group names for groups to automatically add all auto-provisioned users to.
  - `provision_group_exclusion` string — Comma-separated list of group names for groups (with optional wildcards) that will be excluded from auto-provisioning.
  - `provision_group_inclusion` string — Comma-separated list of group names for groups (with optional wildcards) that will be auto-provisioned.
  - `provision_group_required` string — Comma or newline separated list of group names (with optional wildcards) to require membership for user provisioning.
  - `provision_email_signup_groups` string — Comma-separated list of group names whose members will be created with email_signup authentication.
  - `provision_readonly_site_admin_groups` string — Comma-separated list of group names whose members will be created as Read-Only Site Admins.
  - `provision_site_admin_groups` string — Comma-separated list of group names whose members will be created as Site Admins.
  - `provision_group_admin_groups` string — Comma-separated list of group names whose members will be provisioned as Group Admins.
  - `provision_attachments_permission` boolean
  - `provision_dav_permission` boolean — Auto-provisioned users get WebDAV permission?
  - `provision_ftp_permission` boolean — Auto-provisioned users get FTP permission?
  - `provision_sftp_permission` boolean — Auto-provisioned users get SFTP permission?
  - `provision_time_zone` string — Default time zone for auto provisioned users.
  - `provision_company` string — Default company for auto provisioned users.
  - `provision_require_2fa` 'use_system_setting' | 'always_require' | 'never_require' — 2FA required setting for auto provisioned users. `use_system_setting` uses the site-wide setting, including SSO exemptions. `always_require` and `never_require` override the site-wide setting when user-level overrides are allowed.
  - `provision_filesystem_layout` 'site_root' | 'user_root' | 'partner_root' | 'integration_centric' — File System layout to use for auto provisioned users.
  - `provider_identifier` string — URL-friendly, unique identifier for Azure SAML configuration
  - `ldap_base_dn` string — Base DN for looking up users in LDAP server
  - `ldap_domain` string — Domain name that will be appended to LDAP usernames
  - `display_on_login_page` boolean — Should this strategy be displayed on the login page?
  - `ldap_host` string — LDAP host
  - `ldap_host_2` string — LDAP backup host
  - `ldap_host_3` string — LDAP backup host
  - `ldap_port` integer — LDAP port
  - `ldap_provisioning_enabled` boolean — Use LDAP server settings for scheduled provisioning while using this SSO provider for authentication?
  - `ldap_secure` boolean — Use secure LDAP?
  - `ldap_type` 'active_directory' | 'open_ldap' — LDAP server type
  - `ldap_username` string — Username for signing in to LDAP server.
  - `ldap_username_field` 'sAMAccountName' | 'userPrincipalName' — LDAP username field

## Other responses

- `400` — Bad Request
- `401` — Unauthorized
- `403` — Forbidden
- `404` — Not Found
- `405` — Method Not Allowed
- `409` — Conflict
- `412` — Precondition Failed
- `422` — Unprocessable Entity
- `423` — Locked
- `429` — Too Many Requests

---

[API](https://skmtc.net/files/apis/files-com-api.md) · [All operations](https://skmtc.net/files/apis/files-com-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/files/files-com-api/revisions/c6d6f57e6da8/schema)