> For the complete documentation index, see [llms.txt](https://intuitem.gitbook.io/ciso-assistant/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://intuitem.gitbook.io/ciso-assistant/configuration/sso/saml.md).

# SAML

{% hint style="danger" %} <mark style="color:$danger;">Please note: if OIDC mode has ben configured before, you must</mark> <mark style="color:$danger;">**reset the Client ID field to**</mark><mark style="color:$danger;">**&#x20;**</mark><mark style="color:$danger;">**`0`**</mark><mark style="color:$danger;">**&#x20;**</mark><mark style="color:$danger;">**in the OIDC tab and save**</mark> <mark style="color:$danger;">before proceeding.</mark>

<img src="https://629777851-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FCqFeU3oPCgDWkkR386NK%2Fuploads%2Fgit-blob-2f62c048bd6f9fa550d2c4b8243933528305d348%2Fimage%20(11).png?alt=media" alt="" data-size="original">

<mark style="color:$danger;">Failure to do so will prevent proper SAML configuration. This behavior is known and will be addressed in future releases.</mark>
{% endhint %}

{% tabs %}
{% tab title="General configuration" %}

### Configure CISO Assistant with SAML

Once you've retrieved the **IdP Entity ID,** the **Metadata URL** and the **Entity ID** from your provider (see the list of providers for specific details), the configuration on CISO Assistant is pretty simple.

1. Log in into CISO Assistant as an **administrator > Extra > Settings**<br>

   <figure><img src="https://629777851-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FCqFeU3oPCgDWkkR386NK%2Fuploads%2Fgit-blob-7aaf14a372e2c23052887a6fcb7a219a579f101a%2FScreenshot%202024-09-02%2012.31.25.png?alt=media" alt=""><figcaption></figcaption></figure>
2. **Enable SSO**

   <figure><img src="https://629777851-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FCqFeU3oPCgDWkkR386NK%2Fuploads%2Fgit-blob-354a9567ee3386367180f24b6eb5993b631f5587%2FScreenshot%202024-09-02%2012.32.06.png?alt=media" alt=""><figcaption></figcaption></figure>
3. Enter the <mark style="color:purple;">**Idp Entity ID**</mark><br>

   <figure><img src="https://629777851-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FCqFeU3oPCgDWkkR386NK%2Fuploads%2Fgit-blob-ac0413f3859e068f8d06c3f8de10188033a24ac2%2FScreenshot%202024-09-02%2012.32.42.png?alt=media" alt=""><figcaption></figcaption></figure>
4. Choose the option 1 or 2 depending of your provider and fill <mark style="color:purple;">**Metadata URL**</mark> or <mark style="color:purple;">**SSO URL**</mark>, <mark style="color:purple;">**SLO URL**</mark>, <mark style="color:purple;">**x509 certificate**</mark> retrieved from your provider<br>

   <figure><img src="https://629777851-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FCqFeU3oPCgDWkkR386NK%2Fuploads%2Fgit-blob-c4c21f046dec49f3d48dc717782b598de89d4f54%2FScreenshot%202024-09-02%2012.33.52%20(1).png?alt=media" alt=""><figcaption></figcaption></figure>
5. Check that the <mark style="color:purple;">**SP Entity ID**</mark> is similar to the **Entity/Client ID** specified on your provider<br>

   <figure><img src="https://629777851-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FCqFeU3oPCgDWkkR386NK%2Fuploads%2Fgit-blob-23de0b75f8d883f8d5b65fc20f9011fd6c3436c9%2Fciso-sso-step-4.png?alt=media" alt=""><figcaption></figcaption></figure>
6. And that's it! Don't forget to save changes
7. You should now be able to see the **Login with SSO** button<br>

   <figure><img src="https://629777851-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FCqFeU3oPCgDWkkR386NK%2Fuploads%2Fgit-blob-887d7b79f3b5342213f99ac1ea3b82b257f00ea1%2Fciso-sso-step-6.png?alt=media" alt=""><figcaption></figcaption></figure>

{% endtab %}

{% tab title="Advanced settings" %}

* **Allow single label domains**: This allows you to authenticate through SAML on a single-label domain (e.g. `https://ciso-assistant:8443`). If this is left unchecked, the only host forms allowed are:
  * IPv4
  * IPv6
  * FQDN (e.g. <https://www.example.com/>)
  * `localhost`
* **Authn request signed**: allows the Service Provider (SP) to digitally sign the SAML authentication request sent to the Identity Provider (IdP).

  This option should be enabled if your IdP requires signed authentication requests or if you are looking to enforce additional security on SAML authentication flows:

  <figure><img src="https://629777851-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FCqFeU3oPCgDWkkR386NK%2Fuploads%2Fgit-blob-072088cebd75af5688cf9f2e6007a30d3a3d2705%2Fimage%20(83).png?alt=media" alt=""><figcaption></figcaption></figure>

{% endtab %}
{% endtabs %}

### Single Logout

Turn on **Enable service provider-initiated single logout** in the SSO settings to close the SAML session at the identity provider when users log out of CISO Assistant (see [Single Logout](/ciso-assistant/configuration/sso.md#single-logout) for the general behavior).

It also needs the identity provider's Single Logout Service URL. When you configure the identity provider by **Metadata URL**, this is read automatically from the metadata — the **SLO URL** field is only used when you configure the identity provider manually.

Some identity providers require signed logout requests. In that case, enable **Logout request signed** in the advanced SAML settings and configure the SP private key and certificate — and register that SP certificate with the identity provider so it can verify the signature. Microsoft Entra ID, for example, rejects unsigned SAML logout requests.

{% hint style="warning" %} <mark style="color:orange;">Be aware that the user needs to be created on CISO Assistant to be authenticated with SSO.</mark>
{% endhint %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://intuitem.gitbook.io/ciso-assistant/configuration/sso/saml.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.