# SAML

{% hint style="danger" %} <mark style="color:$danger;">Please note: if OIDC mode has ben configured before, you must</mark> <mark style="color:$danger;"></mark><mark style="color:$danger;">**reset the Client ID field to**</mark><mark style="color:$danger;">**&#x20;**</mark><mark style="color:$danger;">**`0`**</mark><mark style="color:$danger;">**&#x20;**</mark><mark style="color:$danger;">**in the OIDC tab and save**</mark> <mark style="color:$danger;"></mark><mark style="color:$danger;">before proceeding.</mark>

<img src="https://217025809-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUJGpmCYDFJNsz2CDasSm%2Fuploads%2FfYWP3fhegXH3Z6ZJGWBK%2Fimage.png?alt=media&#x26;token=a22b99f9-04df-4832-96f3-932e26b547d4" alt="" data-size="original">

<mark style="color:$danger;">Failure to do so will prevent proper SAML configuration. This behavior is known and will be addressed in future releases.</mark>
{% endhint %}

{% tabs %}
{% tab title="General configuration" %}

### Configure CISO Assistant with SAML

Once you've retrieved the **IdP Entity ID,** the **Metadata URL** and the **Entity ID** from your provider (see the list of providers for specific details), the configuration on CISO Assistant is pretty simple.

1. Log in into CISO Assistant as an **administrator > Extra > Settings**<br>

   <figure><img src="https://217025809-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUJGpmCYDFJNsz2CDasSm%2Fuploads%2F3z5pDa1gdTEkcxo9D2T2%2FScreenshot%202024-09-02%2012.31.25.png?alt=media&#x26;token=c1aee049-03fb-4c8b-87a3-9f86f97be797" alt=""><figcaption></figcaption></figure>
2. **Enable SSO**

   <figure><img src="https://217025809-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUJGpmCYDFJNsz2CDasSm%2Fuploads%2F4LjypuxS6bwEqBP0mR8f%2FScreenshot%202024-09-02%2012.32.06.png?alt=media&#x26;token=f484ce0d-269b-467b-ac1d-d25e101fd799" alt=""><figcaption></figcaption></figure>
3. Enter the <mark style="color:purple;">**Idp Entity ID**</mark><br>

   <figure><img src="https://217025809-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUJGpmCYDFJNsz2CDasSm%2Fuploads%2FT8QADfoj0vHJI1DB40BA%2FScreenshot%202024-09-02%2012.32.42.png?alt=media&#x26;token=8db36031-0529-45a7-9b10-aa473ba6b084" alt=""><figcaption></figcaption></figure>
4. Choose the option 1 or 2 depending of your provider and fill <mark style="color:purple;">**Metadata URL**</mark> or <mark style="color:purple;">**SSO URL**</mark>, <mark style="color:purple;">**SLO URL**</mark>, <mark style="color:purple;">**x509 certificate**</mark> retrieved from your provider<br>

   <figure><img src="https://217025809-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUJGpmCYDFJNsz2CDasSm%2Fuploads%2FfORouyvyEoppU7c0JFwu%2FScreenshot%202024-09-02%2012.33.52.png?alt=media&#x26;token=82d2b3bc-0710-44a9-ad35-720dc0ab62c1" alt=""><figcaption></figcaption></figure>
5. Check that the <mark style="color:purple;">**SP Entity ID**</mark> is similar to the **Entity/Client ID** specified on your provider<br>

   <figure><img src="https://217025809-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUJGpmCYDFJNsz2CDasSm%2Fuploads%2FOVe9ZNwKpwJd4JyzeM29%2Fciso-sso-step-4.png?alt=media&#x26;token=d8959a60-287c-46d8-9dac-824809c59b3b" alt=""><figcaption></figcaption></figure>
6. And that's it! Don't forget to save changes
7. You should now be able to see the **Login with SSO** button<br>

   <figure><img src="https://217025809-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUJGpmCYDFJNsz2CDasSm%2Fuploads%2FC9B0uTOSDje4TxZlPL6C%2Fciso-sso-step-6.png?alt=media&#x26;token=338f71f2-700e-45f5-8781-b39ae249445a" alt=""><figcaption></figcaption></figure>

{% endtab %}

{% tab title="Advanced settings" %}

* **Allow single label domains**: This allows you to authenticate through SAML on a single-label domain (e.g. `https://ciso-assistant:8443`). If this is left unchecked, the only host forms allowed are:
  * IPv4
  * IPv6
  * FQDN (e.g. <https://www.example.com/>)
  * `localhost`
    {% endtab %}
    {% endtabs %}

{% hint style="warning" %} <mark style="color:orange;">Be aware that the user needs to be created on CISO Assistant to be authenticated with SSO.</mark>
{% endhint %}
