> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.itential.com/itential-platform/6/configure/auth/saml-sso/overview/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.itential.com/_mcp/server.

# SAML SSO overview

> Configure Single Sign-On with SAML identity providers

## Supported providers

Beginning with the 2023.2 release, Itential Platform has expanded its user management capabilities to include Single Sign-On (SSO) through SAML. The following providers are supported:

* Okta
* Azure/EntraID
* Active Directory Federation Service (AD FS)
* PingID.

## Enable SSO

To enable SSO, an **Identity Provider (IDP) Config** must be created under **Admin Essentials → Authorization → Identity Providers**.

To access and configure Identity Providers, users must have both "SSO" and "SSOGroupMappings" permissions assigned to their role.

Along with enabling an **Identity Provider**, a successful authentication test is required. Upon successful test, a single provider can be enabled at a time. Once an Identity Provider is enabled, all Itential Platform authentication is done via SSO SAML using that config immediately without restart of Itential Platform. Authentication via AAA broker is still supported, but it is disabled when an Identity Provider is enabled. All IDP Configs must be disabled to continue AAA broker authentication usage.

Note that in the Itential Platform, an **Identity Provider** is linked as an **SSO Config**.

## Create an Identity Provider

To create an Identity Provider, first navigate to **Admin Essentials → Authorization → Identity Providers**. Then, click the **New Provider** button. This will prompt you for the name and optional description of the Identity Provider. All providers must use SAML in 2023.2, so that cannot be changed.

Any number of IDP Configs can be created for a single IDP (Identity Provider). For instance, if two (2) IDP Configs are created for an Okta provider with `Login URL` `https://exampleapp.oktapreview.com/app/examplesaml/7Y374u1d7/sso/saml`, separate Itential Platform users will be created for each IDP upon successful authentication, and each will have `provenance` corresponding to the name of the IDP. Accordingly, a user authenticated from Okta using two (2) separate IDP Configs with username `example@email` creates two separate Itential Platform users with the same username, but a different provenance.

*Figure 1: Identity Providers Home Page*
![Identity Providers Home Page](/_fern-img/4b6922105b191b7ba7df0ae43967572a29b007d4cf946bf48f52f71e5abc116d.webp)

*Figure 2: Identity Providers Create Dialog*
![Identity Providers Creation Dialog](/_fern-img/f3401af989cb3225f9470b53cb936030f09d422136dd2647f704037b3505f92f.webp)

Newly created Identity Providers are disabled by default and include empty text fields for the required `Issuer`, `Login URL`, `Username Attribute`, and `Groups Attribute` fields. The `Login URL` is the entry point by which SSO authentication is initiated. The `Issuer` maps to the `Entity Identifier` from the provider. Identity Providers also require a public signing certificate, which can be retrieved from the IDP and uploaded to Itential Platform. This certificate is used to validate signatures of incoming SAML responses. Below shows the newly created IDP from the above example. These fields are provider spe

> Configure Single Sign-On with SAML identity providers