From f73cfb2a9ed1585db3705bd4e76b3fd36544658a Mon Sep 17 00:00:00 2001 From: Adam Mcgrath Date: Wed, 15 Jul 2026 15:44:27 +0100 Subject: [PATCH 1/3] Add example of algorithm_exceptions --- .../sign-and-encrypt-saml-requests.mdx | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/main/docs/authenticate/protocols/saml/saml-sso-integrations/sign-and-encrypt-saml-requests.mdx b/main/docs/authenticate/protocols/saml/saml-sso-integrations/sign-and-encrypt-saml-requests.mdx index 505fde8340..42a7a0037b 100644 --- a/main/docs/authenticate/protocols/saml/saml-sso-integrations/sign-and-encrypt-saml-requests.mdx +++ b/main/docs/authenticate/protocols/saml/saml-sso-integrations/sign-and-encrypt-saml-requests.mdx @@ -129,7 +129,12 @@ Payload: [...], // all the other connection options "assertion_decryption_settings": { "algorithm_profile": "v2026-1", - "algorithm_exceptions": [] + "algorithm_exceptions": [ + // You can override the security profile to use a less secure algorithm, for example: + // "http://www.w3.org/2001/04/xmlenc#aes128-cbc", + // "http://www.w3.org/2001/04/xmlenc#aes256-cbc", + // "http://www.w3.org/2001/04/xmlenc#tripledes-cbc" + ] } } } From 0bdc9b144ef621398c07eff3adac5fed3275e9ae Mon Sep 17 00:00:00 2001 From: Carlos Fung Date: Fri, 17 Jul 2026 13:43:47 +0200 Subject: [PATCH 2/3] Update sign-and-encrypt-saml-requests.mdx --- .../saml-sso-integrations/sign-and-encrypt-saml-requests.mdx | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/main/docs/authenticate/protocols/saml/saml-sso-integrations/sign-and-encrypt-saml-requests.mdx b/main/docs/authenticate/protocols/saml/saml-sso-integrations/sign-and-encrypt-saml-requests.mdx index 42a7a0037b..6ed01473d1 100644 --- a/main/docs/authenticate/protocols/saml/saml-sso-integrations/sign-and-encrypt-saml-requests.mdx +++ b/main/docs/authenticate/protocols/saml/saml-sso-integrations/sign-and-encrypt-saml-requests.mdx @@ -113,7 +113,9 @@ Download the certificate in the format requested by the IdP. By default, Auth0 automatically supports the algorithms listed in the latest [Algorithm Profile](/docs/authenticate/protocols/saml/saml-sso-integrations/algorithm-profiles) for decrypting SAML assertions. -If the assertion is encrypted with an algorithm not in the list, then the assertion will be rejected by Auth0. +- If the assertion is encrypted with an algorithm **not** in the list, then the assertion will be rejected by Auth0. + +- If your IdP provider does not support an algorithm in the list, you can use the `algorithm_exceptions` parameter to override the security profile. Auth0 recommends to use the latest [Algorithm Profile](/docs/authenticate/protocols/saml/saml-sso-integrations/algorithm-profiles) for decrypting SAML assertions. To specify a different profile or use an unlisted algorithm, you need to update the connection using the [Update a Connection](https://auth0.com/docs/api/management/v2/connections/patch-connections-by-id) endpoint and change the `assertion_decryption_settings` property as shown in the payload example below. From 1308bbbda409d55b87c5df74c8ad967bc8025fc2 Mon Sep 17 00:00:00 2001 From: Carlos Fung Date: Fri, 17 Jul 2026 17:37:01 +0200 Subject: [PATCH 3/3] Update main/docs/authenticate/protocols/saml/saml-sso-integrations/sign-and-encrypt-saml-requests.mdx Co-authored-by: Nick Gagliardi <133918568+nick-gagliardi@users.noreply.github.com> --- .../saml-sso-integrations/sign-and-encrypt-saml-requests.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/main/docs/authenticate/protocols/saml/saml-sso-integrations/sign-and-encrypt-saml-requests.mdx b/main/docs/authenticate/protocols/saml/saml-sso-integrations/sign-and-encrypt-saml-requests.mdx index 6ed01473d1..6039b9e054 100644 --- a/main/docs/authenticate/protocols/saml/saml-sso-integrations/sign-and-encrypt-saml-requests.mdx +++ b/main/docs/authenticate/protocols/saml/saml-sso-integrations/sign-and-encrypt-saml-requests.mdx @@ -115,7 +115,7 @@ By default, Auth0 automatically supports the algorithms listed in the latest [Al - If the assertion is encrypted with an algorithm **not** in the list, then the assertion will be rejected by Auth0. -- If your IdP provider does not support an algorithm in the list, you can use the `algorithm_exceptions` parameter to override the security profile. Auth0 recommends to use the latest [Algorithm Profile](/docs/authenticate/protocols/saml/saml-sso-integrations/algorithm-profiles) for decrypting SAML assertions. +- If your IdP does not support an algorithm in the list, you can use the `algorithm_exceptions` parameter to override the security profile. Auth0 recommends to use the latest [Algorithm Profile](/docs/authenticate/protocols/saml/saml-sso-integrations/algorithm-profiles) for decrypting SAML assertions. To specify a different profile or use an unlisted algorithm, you need to update the connection using the [Update a Connection](https://auth0.com/docs/api/management/v2/connections/patch-connections-by-id) endpoint and change the `assertion_decryption_settings` property as shown in the payload example below.