Which aspect of EPP are you submitting for?
Endpoint Protector Server
What is a one sentence summary of your feature request?
SAML 2.0 SSO support for generic / non-listed Identity Providers (e.g. Keycloak)
Please describe your idea in detail. What is your problem, why do you feel this idea is the best solution, etc.
We run Keycloak as our central on-premises IdP for company-wide SSO across multiple services. This is currently not possible for Endpoint Protector, since SSO configuration is hard-coupled to three listed providers (Azure, Okta, Auth0) according to Support (Tier 2, 2026-08-20) rather than to the SAML 2.0 standard itself. Our SAML response is provably correctly issued and signed (verified via SAML tracer, signature present inside both the Assertion and the Response, valid Conditions window) — but it is rejected by EPP regardless. For organizations running their own IdP (Keycloak, but also other open-source or on-prem solutions), this means no unified SSO across all deployed security products, even though the underlying standard is fully honored. Requested: either (a) official support for generic SAML 2.0 IdPs with configurable attribute/NameID mapping, or alternatively (b) documentation of the attribute names and formats EPP expects internally per provider profile, so a compatible configuration can be built without impersonating one of the three listed providers.
How do you currently solve the challenges you have by not having this feature?
We attempted to connect Keycloak via EPP’s Okta SSO profile (Issuer, SSO URL, and certificate manually set to Keycloak values). The SAML roundtrip completes technically, but the assertion is rejected by EPP with an HTTP 500 error — per Netwrix Support, this is expected behavior, since the attribute mapping is hard-coupled to the selected provider profile and not validated against the actual sending IdP. There is currently no working workaround, only the failover login as a fallback without SSO.