# SAML

{% hint style="danger" %} <mark style="color:$danger;">Please note: if OIDC mode has ben configured before, you must</mark> <mark style="color:$danger;"></mark><mark style="color:$danger;">**reset the Client ID field to**</mark><mark style="color:$danger;">**&#x20;**</mark><mark style="color:$danger;">**`0`**</mark><mark style="color:$danger;">**&#x20;**</mark><mark style="color:$danger;">**in the OIDC tab and save**</mark> <mark style="color:$danger;"></mark><mark style="color:$danger;">before proceeding.</mark>

<img src="https://217025809-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUJGpmCYDFJNsz2CDasSm%2Fuploads%2FfYWP3fhegXH3Z6ZJGWBK%2Fimage.png?alt=media&#x26;token=a22b99f9-04df-4832-96f3-932e26b547d4" alt="" data-size="original">

<mark style="color:$danger;">Failure to do so will prevent proper SAML configuration. This behavior is known and will be addressed in future releases.</mark>
{% endhint %}

{% tabs %}
{% tab title="General configuration" %}

### Configure CISO Assistant with SAML

Once you've retrieved the **IdP Entity ID,** the **Metadata URL** and the **Entity ID** from your provider (see the list of providers for specific details), the configuration on CISO Assistant is pretty simple.

1. Log in into CISO Assistant as an **administrator > Extra > Settings**<br>

   <figure><img src="https://217025809-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUJGpmCYDFJNsz2CDasSm%2Fuploads%2F3z5pDa1gdTEkcxo9D2T2%2FScreenshot%202024-09-02%2012.31.25.png?alt=media&#x26;token=c1aee049-03fb-4c8b-87a3-9f86f97be797" alt=""><figcaption></figcaption></figure>
2. **Enable SSO**

   <figure><img src="https://217025809-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUJGpmCYDFJNsz2CDasSm%2Fuploads%2F4LjypuxS6bwEqBP0mR8f%2FScreenshot%202024-09-02%2012.32.06.png?alt=media&#x26;token=f484ce0d-269b-467b-ac1d-d25e101fd799" alt=""><figcaption></figcaption></figure>
3. Enter the <mark style="color:purple;">**Idp Entity ID**</mark><br>

   <figure><img src="https://217025809-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUJGpmCYDFJNsz2CDasSm%2Fuploads%2FT8QADfoj0vHJI1DB40BA%2FScreenshot%202024-09-02%2012.32.42.png?alt=media&#x26;token=8db36031-0529-45a7-9b10-aa473ba6b084" alt=""><figcaption></figcaption></figure>
4. Choose the option 1 or 2 depending of your provider and fill <mark style="color:purple;">**Metadata URL**</mark> or <mark style="color:purple;">**SSO URL**</mark>, <mark style="color:purple;">**SLO URL**</mark>, <mark style="color:purple;">**x509 certificate**</mark> retrieved from your provider<br>

   <figure><img src="https://217025809-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUJGpmCYDFJNsz2CDasSm%2Fuploads%2FfORouyvyEoppU7c0JFwu%2FScreenshot%202024-09-02%2012.33.52.png?alt=media&#x26;token=82d2b3bc-0710-44a9-ad35-720dc0ab62c1" alt=""><figcaption></figcaption></figure>
5. Check that the <mark style="color:purple;">**SP Entity ID**</mark> is similar to the **Entity/Client ID** specified on your provider<br>

   <figure><img src="https://217025809-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUJGpmCYDFJNsz2CDasSm%2Fuploads%2FOVe9ZNwKpwJd4JyzeM29%2Fciso-sso-step-4.png?alt=media&#x26;token=d8959a60-287c-46d8-9dac-824809c59b3b" alt=""><figcaption></figcaption></figure>
6. And that's it! Don't forget to save changes
7. You should now be able to see the **Login with SSO** button<br>

   <figure><img src="https://217025809-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUJGpmCYDFJNsz2CDasSm%2Fuploads%2FC9B0uTOSDje4TxZlPL6C%2Fciso-sso-step-6.png?alt=media&#x26;token=338f71f2-700e-45f5-8781-b39ae249445a" alt=""><figcaption></figcaption></figure>

{% endtab %}

{% tab title="Advanced settings" %}

* **Allow single label domains**: This allows you to authenticate through SAML on a single-label domain (e.g. `https://ciso-assistant:8443`). If this is left unchecked, the only host forms allowed are:
  * IPv4
  * IPv6
  * FQDN (e.g. <https://www.example.com/>)
  * `localhost`
* **Authn request signed**: allows the Service Provider (SP) to digitally sign the SAML authentication request sent to the Identity Provider (IdP).

  This option should be enabled if your IdP requires signed authentication requests or if you are looking to enforce additional security on SAML authentication flows:

  <figure><img src="https://217025809-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUJGpmCYDFJNsz2CDasSm%2Fuploads%2Fe6zsoGqquc1udGkuscLz%2Fimage.png?alt=media&#x26;token=4a5fce37-a70a-41b0-9306-4b5a44e821ca" alt=""><figcaption></figcaption></figure>

{% endtab %}
{% endtabs %}

{% hint style="warning" %} <mark style="color:orange;">Be aware that the user needs to be created on CISO Assistant to be authenticated with SSO.</mark>
{% endhint %}