Register a SAML application

The service works as a SAML 2.0 identity provider. Applications send people to sign in and receive a signed SAML response.

Before the first application

• Your organization's signing key. The team that operates the service creates it. Until it exists, the console shows «SAML signing keys are not configured for this organisation. Ask the operator to add them.»
• Access policy. A SAML application's resource is saml: followed by the application's identifier. See The application rule.
• Accounts in the applications. People must exist in the application. The service does not create accounts in applications.

Identity provider details

Under «Manage» › «SAML applications», the «Identity provider details» section shows, with copy buttons, the «Entity ID», the «Metadata URL», the «Sign-in URL (SSO)», the «Sign-out URL» and the «Signing certificate» («Download certificate (PEM)»).

How do I register the application?

1. Choose «New application». If the application provides metadata, use «Import application metadata» («Metadata file» or «Or paste the metadata XML», then «Import»).
2. Fill in:

3. Choose «Save application» and confirm.
4. For cloud administration applications, use «Mark as sensitive (recommended for cloud administration)».

What is not supported

SAML Single Logout, encrypted assertions and the Artifact binding. Responses always go by HTTP-POST.

Test each application with one person before production. Third-party menus change; follow each vendor's current instructions.