Iden Platform GuideSSO
SAML
Set up SAML SSO between Iden and one of your connected apps.
Iden acts as the SAML identity provider (IdP); the connected app is the service provider (SP). Both IdP-initiated login (starting from Iden's own app launcher) and SP-initiated login (starting from the app itself) are supported.
Values Iden gives you
Paste these into the app's own SAML configuration:
| Field | What it is |
|---|---|
| IdP Entity ID | Iden's unique identifier as the identity provider |
| IdP SSO URL | The address the app redirects to for login |
| x509 Signing Certificate | The certificate the app uses to verify the login came from Iden |
Values the app needs from you
Enter these into Iden's SSO configuration for the app:
| Field | What it is |
|---|---|
| SP Entity ID | The app's own unique identifier as a service provider |
| ACS URL | The Assertion Consumer Service URL, the address Iden sends the signed login response to |
Configuration options
| Option | Choices |
|---|---|
| NameID format | Email, Persistent, or Unspecified |
| NameID source | The value used to populate the NameID: the person's Iden email, or their Iden external UUID |
| Signature algorithm | RSA-SHA1, RSA-SHA256, RSA-SHA384, or RSA-SHA512 if using RSA; ECDSA-SHA1, ECDSA-SHA256, ECDSA-SHA384, or ECDSA-SHA512 if using ECDSA. Only the algorithms matching your chosen signing key algorithm are selectable. |
| Digest algorithm | SHA1, SHA256, SHA384, or SHA512 |
| Sign assertion | On or off, independent of Sign response |
| Sign response | On or off, independent of Sign assertion |
| Session validity | How long the SAML session stays valid. Defaults to 12 hours if left blank. Any value you set is used as-is. |
| Default relay state | Optional. Sent alongside the SAML response on IdP-initiated login, for apps that use it to redirect to a specific page after login. |
Require MFA for login, Launch URL, and Signing key algorithm also apply here, see the SSO overview for what each one does.
How your team accesses the app
Through the Go to app button in Iden's dashboard, or by visiting the app directly if it supports SP-initiated login.