diff --git a/profiles/saml2/README.md b/profiles/saml2/README.md
new file mode 100644
index 0000000..2503873
--- /dev/null
+++ b/profiles/saml2/README.md
@@ -0,0 +1,6 @@
+# saml2
+
+## Usage
+
+Start a saml2 idp sidecar and configure it to Pulp.
+This also starts a webbrowser in the compose network and points it to the login address.
diff --git a/profiles/saml2/browser.Containerfile b/profiles/saml2/browser.Containerfile
new file mode 100644
index 0000000..731612c
--- /dev/null
+++ b/profiles/saml2/browser.Containerfile
@@ -0,0 +1,14 @@
+FROM debian:latest
+
+RUN \
+  apt-get update && \
+  apt-get install extrepo -y && \
+  extrepo enable librewolf && \
+  extrepo update librewolf && \
+  apt-get update && \
+  apt-get install librewolf -y && \
+  apt-get clean
+
+COPY librewolf.overrides.cfg /root/.librewolf/librewolf.overrides.cfg
+
+CMD librewolf
diff --git a/profiles/saml2/compose.yaml b/profiles/saml2/compose.yaml
new file mode 100644
index 0000000..d10f823
--- /dev/null
+++ b/profiles/saml2/compose.yaml
@@ -0,0 +1,25 @@
+# Add any custom services for your profile here.
+---
+version: "3.7"
+
+services:
+  saml2idp:
+    image: "ghcr.io/pfrest/mock-saml2-idp:latest"
+    ports:
+      - "8443:8443"
+    environment:
+      IDP_AUTH_MODE: "auto"
+      SP_ENTITY_ID: "https://pulp/saml2/metadata/"
+      SP_ACS_LOCATION: "https://pulp/saml2/acs/"
+      IDP_USER_GROUPS: "file_admin"
+  browser:
+    build:
+      dockerfile: "../../profiles/saml2/browser.Containerfile"
+      context: "../../profiles/saml2/"
+    devices:
+      - "/dev/dri/"
+    volumes:
+      - "/tmp/.X11-unix/:/tmp/.X11-unix/:ro"
+    environment:
+      DISPLAY: ":0.0"
+...
diff --git a/profiles/saml2/init.sh b/profiles/saml2/init.sh
new file mode 100644
index 0000000..74d795b
--- /dev/null
+++ b/profiles/saml2/init.sh
@@ -0,0 +1,13 @@
+#!/bin/bash
+
+set -eu
+
+dnf -y install xmlsec1-openssl
+uv pip install djangosaml2
+
+mkdir -p /etc/pulp/certs
+pushd /etc/pulp/certs
+yes "" | openssl req -nodes -new -x509 -newkey rsa:2048 -days 3650 -keyout saml2-private.key -out saml2-public.crt
+
+chown pulp saml2-private.key saml2-public.crt
+popd
diff --git a/profiles/saml2/librewolf.overrides.cfg b/profiles/saml2/librewolf.overrides.cfg
new file mode 100644
index 0000000..2847192
--- /dev/null
+++ b/profiles/saml2/librewolf.overrides.cfg
@@ -0,0 +1 @@
+defaultPref("browser.startup.homepage", "https://pulp/saml2/login/");
diff --git a/profiles/saml2/profile_default_config.env b/profiles/saml2/profile_default_config.env
new file mode 100644
index 0000000..b91f3e7
--- /dev/null
+++ b/profiles/saml2/profile_default_config.env
@@ -0,0 +1 @@
+saml_config='@json {"entityid": "https://pulp/saml2/metadata/", "entity_category": [], "allow_unknown_attributes": true, "service": {"sp": {"name": "Pulp CI", "force_authn": true, "required_attributes": ["username"], "endpoints": {"assertion_consumer_service": [["https://pulp/saml2/acs/", "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"]], "single_logout_service": [["https://pulp/saml2/ls/", "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"], ["https://pulp/saml2/ls/post", "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"]]}, "idp": {"https://saml2idp:8443/sso/saml2/idp/metadata.php": {}}, "allow_unsolicited": true}}, "key_file": "/etc/pulp/certs/saml2-private.key", "cert_file": "/etc/pulp/certs/saml2-public.crt", "xmlsec_binary": "/usr/bin/xmlsec1", "metadata": {"remote": [{"url": "https://saml2idp:8443/sso/saml2/idp/metadata.php"}]}, "debug": 1, "disable_ssl_certificate_validation": true}'
diff --git a/profiles/saml2/pulp_config.env b/profiles/saml2/pulp_config.env
new file mode 100644
index 0000000..1511c4d
--- /dev/null
+++ b/profiles/saml2/pulp_config.env
@@ -0,0 +1,3 @@
+PULP_SAML_CONFIG='{saml_config}'
+PULP_LOGIN_REDIRECT_URL='/pulp/default/api/v3/login/'
+PULP_HTTPS=True