> ## Documentation Index
> Fetch the complete documentation index at: https://docs.strata.io/llms.txt
> Use this file to discover all available pages before exploring further.

# 1Kosmos (SAML)

The 1Kosmos connector integrates the Maverics Orchestrator with the 1Kosmos BlockID platform -- enabling passwordless and identity-verified authentication for your applications.

> [!NOTE]
>
> **Console terminology:** In the Maverics Console, this section is called
> **Identity Fabric**. The YAML configuration uses the `connectors` key to define
> identity provider integrations.

## Overview

The 1Kosmos connector uses SAML 2.0 to federate authentication with the 1Kosmos BlockID platform -- enabling identity-verified, passwordless authentication through the Maverics Orchestrator.

## Use Cases

* **Passwordless authentication** -- Replace passwords with 1Kosmos BlockID identity-verified authentication, modernizing the sign-on experience across legacy and cloud applications
* **Identity proofing for high-assurance access** -- Leverage 1Kosmos document verification and biometric capabilities for high-assurance authentication where compliance or security policies demand strong identity verification
* **Unify SSO with passwordless across hybrid environments** -- Route authentication to 1Kosmos alongside other IdPs, extending passwordless access to legacy apps that were never designed for it
* **Phased IdP rationalization** -- Gradually migrate users from legacy IdPs to 1Kosmos BlockID, reducing the number of identity platforms and the associated licensing and maintenance costs

## Setup

**Console UI**

To create a 1Kosmos connector in the Maverics Console:

1. Navigate to **Identity Fabric** in the Console sidebar.
2. Click **Create** and select **1Kosmos (SAML)**.
3. Enter a **Name** -- the friendly name that identifies your provider.
4. Enter the **Metadata URL** -- the URL of the 1Kosmos SAML metadata document.
5. Enter the **Consumer Service (ACS) URL** -- the Assertion Consumer Service URL where 1Kosmos sends SAML responses.
6. Enter the **Entity ID** -- the unique identifier for the Service Provider.
7. Click **Save**.

**Configuration**

```yaml maverics.yaml theme={null}
connectors:
  - name: onekosmos
    type: onekosmos
    domain: "{{ env.ONEKOSMOS_DOMAIN }}"
    samlMetadataURL: "https://{{ env.ONEKOSMOS_DOMAIN }}/saml2/idp/metadata"
    samlConsumerServiceURL: "https://orch.example.com/saml/callback"
    samlEntityID: "https://orch.example.com"
    tls: onekosmos-tls
```

## Configuration Reference

| Key | Type | Required | Description |
| - | - | - | - |
| `name` | string | Yes | Unique connector identifier referenced in app policies |
| `type` | string | Yes | Must be `onekosmos` |
| `domain` | string | Yes | The 1Kosmos BlockID domain for your organization |
| `samlMetadataURL` | string | Yes | URL to the 1Kosmos SAML metadata XML |
| `samlConsumerServiceURL` | string | Yes | Assertion Consumer Service (ACS) URL where 1Kosmos sends SAML responses |
| `samlEntityID` | string | No | Service Provider entity ID that identifies the Orchestrator to 1Kosmos |
| `errorPage` | string | No | URL to redirect users to when an error occurs during authentication |
| `cache` | string | No | Cache name reference for SAML request data storage |
| `tls` | string | No | Named TLS profile for metadata retrieval and IdP communication |

For the complete connector field reference, see [Identity Fabric Configuration Reference](/reference/orchestrator/identity-fabric#configuration-reference).

## Troubleshooting

* **Verify the SAML metadata URL is accessible** from the Orchestrator host -- confirm the 1Kosmos domain is correct and reachable
* **Ensure the entity ID matches the 1Kosmos configuration** -- The `samlEntityID` value must match the trusted Service Provider identifier configured in the 1Kosmos BlockID administration portal
* **Check the Assertion Consumer Service URL** -- The `samlConsumerServiceURL` must match the Orchestrator's actual callback endpoint. If behind a load balancer, use the external-facing URL.
* **Verify the domain value** -- The `domain` field must match the 1Kosmos BlockID domain assigned to your organization

## Related Pages

> **[Identity Fabric](/reference/orchestrator/identity-fabric)**
>
> Overview of all identity providers

> **[Generic OIDC](/reference/orchestrator/identity-fabric/custom-oidc)**
>
> Generic OpenID Connect connector

> **[Generic SAML](/reference/orchestrator/identity-fabric/custom-saml)**
>
> Generic SAML 2.0 connector

> **[HYPR](/reference/orchestrator/identity-fabric/hypr)**
>
> HYPR passwordless authentication connector