Setting up Mastodon

Mastodon uses SAML for SSO authentication. The example configuration is available at the following URL : https://github.com/tootsuite/mastodon/blob/master/.env.production.sample.

In order to configure SAML for Mastodon, you may copy then paste the following lines directly into your Mastodon environment.

# Authentication
OAUTH_REDIRECT_AT_SIGN_IN=true
SAML_ENABLED=true
SAML_ISSUER={{ service.config["sp_entityid"] }}
SAML_ATTRIBUTES_STATEMENTS_UID=urn:oid:0.9.2342.19200300.100.1.1
SAML_ATTRIBUTES_STATEMENTS_EMAIL=urn:oid:1.2.840.113549.1.9.1.1
SAML_UID_ATTRIBUTE=urn:oid:0.9.2342.19200300.100.1.1
SAML_ALLOWED_CLOCK_DRIFT=60
SAML_SECURITY_WANT_ASSERTION_SIGNED=true
SAML_SECURITY_WANT_ASSERTION_ENCRYPTED=true
SAML_SECURITY_ASSUME_EMAIL_IS_VERIFIED=true
SAML_IDP_SSO_TARGET_URL={{ url_for("sso.saml_redirect", service_uuid=service.uuid, _external=True) }}
SAML_IDP_CERT={{ "".join(service.config["idp_cert"].strip().split("\n")[1:-1]) }}
SAML_CERT={{ "".join(service.config["sp_cert"].strip().split("\n")[1:-1]) }}
SAML_PRIVATE_KEY={{ "".join(service.config["sp_key"].strip().split("\n")[1:-1]) }}
{% include "application_saml.html" %}