> For AI agents: [llms.txt](https://docs.trustedauth.com/llms.txt) provides a Markdown index of this documentation.

# Integrate a generic SAML application

IDaaS includes a number of cloud applications for you to integrate with IDaaS for two-factor authentication. If you want to protect a cloud service that is not preconfigured with IDaaS, you can integrate it as a generic SAML service provider application.

note

This section describes how to add a generic SAML application. See [Preconfigured SAML applications](/docs/applications-and-sso/saml-integration-guides.md) for the available templates.

Before you begin, identify the following needed to complete this procedure:

- Service Provider Entity ID
- Assertion Consumer Service URL
- SAML NameID Attribute
- Other required or optional SAML attribute values

tip

If you have a metadata XML file that includes this information, you can upload the file to auto-populate these fields.

## Add a generic SAML application

Complete the following steps:

- [Step 1: Configure the General Settings](#step-1-configure-the-general-settings)
- [Step 2: Configure customizations](#step-2-configure-customizations)
- [Step 3: Configure a resource rule](#step-3-configure-a-resource-rule)
- [Step 4: Download the signing certificate](#step-4-download-the-signing-certificate)
- [Step 5: Set up IDaaS as an Identity Provider for your SAML Service Provider](#step-5-set-up-idaas-as-an-identity-provider-for-your-saml-service-provider)

### Step 1: Configure the General settings

1. Click Menu icon **>** **Security > Applications**. The **Applications List** page appears.

2. Click **Add**. The **Select an Application Template** page appears.

3. Do one of the following:

   - Select **SAML Cloud Integrations** from the search drop-down list and scroll to find the application you want to add to IDaaS.
   - In the **Search bar**, enter a search option to filter for the application you want to add to IDaaS.

4. Click **Generic SAML Application**. The **Add Generic SAML General** page appears.

5. Configure the **App Settings**.

   - Enter a **Name** for the application.
   - Enter a **Description**.

6. Configure the **SAML Settings**.

   1. If you have a metadata file from your Service Provider, use the **Upload Metadata XML** file option to auto-populate the following fields, if available in the file:

      - Default Assertion Consumer Service URL
      - Alternative Assertion Consumer URLs
      - Service Provider Entity ID (Issuer)
      - Single Logout Service URL
      - SAML Signing Certificate
      - SAML NameID Encoding Format
      - SAML Signature Algorithm

   2. To import the Metadata file:

      1. Click Arrow Up To Line icon and browse to select the file. The **Metadata Configuration** dialog box appears.
      2. If required, click **Merge with existing values** to merge new values with existing values for Alternative Assertion Consumer Services URLs and SAML attribute names.
      3. Click **Save**.

   3. If you do not have a metadata file, enter the following:

      1. Enter the **Default** **Assertion Consumer Service URL** for the SAML application.
      2. Enter the **Service Provider Entity ID (Issuer)** that is used by IDaaS to identify the SAML service provider.
      3. If your SAML service provider supports SAML SP-initiated logout, set the **Single Logout Service URL** to the value supplied by your SAML service provider. Otherwise, leave it blank.

   note
   IDaaS performs session logout based on the Authentication Session Lifetime (see [Manage General settings](/docs/authentication-and-security/manage-authenticators/manage-general-settings.md)). The default value for this setting is 15 minutes. Set this parameter to an appropriate value according to your site security policy.

   IDaaS also supports SP-initiated logout (SLO) from a SAML client application. In this case, the SAML application can be configured with a Single Logout URL. When a SAML request is sent, using either the HTTP-Redirect or HTTP-POST SAML binding, IDaaS logs out the current user session and the user is redirected to the configured Single Logout URL of the SAML client application using HTTP-POST binding. The binding used in the response is not configurable.

   - SAML SP-initiated logout is not propagated to all other SAML SPs.
   - IDaaS does not support IdP-initiated SAML logout.
   4. Enter the **SAML Max Authentication Age (seconds)** to set the maximum amount of time that can elapse before a user is required to reauthenticate during a new login attempt. This applies for both SP-initiated and IdP-initiated login. Set this field to -1 to disable this feature.

   5. From the **SAML NameID Attribute** drop-down list, select the user attribute that will be used to uniquely identify a user to both IDaaS and your SAML application. The attribute should be one that will never change.

   6. Select the **SAML NameID Encoding Format** from the drop-down list.

      Options include:

      - KERBEROS
      - PERSISTENT
      - TRANSIENT
      - UNSPECIFIED
      - X509_SUBJECT_NAME
      - EMAIL
      - WINDOWS_DOMAIN_QUALIFIED_NAME.

   7. From the **SAML Signing Certificate** drop-down list, do one of the following:

      - Select an existing certificate from the drop-down list.

      - Click **Create Certificate** to create a new signing certificate.

      attention
      If you are updating a previous SAML Signing Certificate for the SAML application, you need to update both here and at the SAML service provider. The certificate update must be made at the same time. Once the change is made to either side, the other side will not be available until it is also updated. Any SAML authentications during this period will result in a failure.

7. Add **SAML Attributes**.

   1. Under **SAML Attributes**, click **Add**. The **SAML Attributes** dialog box appears.

   2. Enter a **Name** that clearly indicates the purpose of the attribute. It should indicate whether the SAML attribute value contains user group, authenticator, or organization. For example, if the attribute value contains user groups the name could be User Groups.

   3. From the drop-down list, select the **Name Format** for the attribute.

   4. Click **Add** next to **Value(s)**.

   info
   You can further filter and parse the attributes by appending the following actions to it:

   `.filter(regex filter expression).matcher(regex matcher expression).replace(regex replacement).end()`

   **Attention:** This is an advanced setting and requires regex expertise.

   example
   Filter any IDaaS groups that start with AWS-, return the group names after AWS- and before -xxx:  
   `[Groups].filter(^AWS-(.*)\$).matcher(^AWS-(.*)-(.*)\$).replace(\$1).end()`

   Convert custom userid values of the form domain\userid into <userid@domain.com>:  
   `<Custom Userid>.filter().matcher(^(.*)\\.*)$).replace($2@$1.com).end()`

   5. In the **Values** field do the following, as required:

      1. Type < and select the user attribute to include every time the user authenticates to the application.
      2. Type **[** and select from the following, as required:
         - **[Authenticators]** to include a user's authenticators every time the user authenticates to the application.
         - **[Group Attributes]** to include a user's group attributes every time the user authenticates to the application.
         - **[Groups]** to include a user's groups every time the user authenticates to the application.
         - **[Organizations]** to include a list of the user's organizations every time the user authenticates to the application.
         - **[Role]** to include a list of the user's role every time the user authenticates to the application.
         - **[Selected Organization]** to include the user's selected organization the next time the user authenticates to the application.
         - **[Unique Group IDs]** to include a user's group ids every time the user authenticates to the application.
         - **[Unique Organization IDs]** to include a list of the user's organization ids every time the user authenticates to the application.
         - **[Unique Role ID]** to include the user's role ID the next time the user authenticates to the application.
         - **[Unique Selected Organization ID]** to include the user's selected organization id the next time the user authenticates to the application.
      3. To add static text, type the text in the **Value** text box.

   6. When you define a value, click Shield Check icon to test it.

   7. Optionally, use the **Test Regular Expressions** section to enter a list of values (one per line) and then click **Test** to run a test on the expression.

   8. Repeat these steps to add additional SAML attributes.

   9. Repeat these steps to add additional SAML attributes.

   10. Click **Add**.

8. Click **Show Advanced Settings** to configure the advanced settings.

   If required, configure the following Advanced Settings.

   1. Select **Enable Organizations and Domain-Based Identity Providers** to allow organization information to be returned in SAML attribute values when users log in. When enabled, if users are associated with one or more organizations and one has not yet been requested, users can select their organizations after they authenticate to their application.

   note
   When organizations are enabled, the corresponding SAML attributes must also be configured.

   2. From the **SAML Signature Algorithm** drop-down list, select the type of signing algorithm you want IDaaS to use to sign the SAML response/assertion. The type of algorithm you select depends on the requirements of the application being configured.

   3. Enter the **SAML Session Timeout (minutes)** to the time when the SAML Assertion times out. The maximum is 720 minutes.

   4. Optional: Enter the **SAML Username Parameter Name** used to identify the user ID being requested for authentication.

   5. The user ID can then be passed as a parameter, for example, Username=jdoe. Alternately, if the SAML username is NameID, the SAML Request XML NameID element value is used to the identity the IDaaS userID.

   6. Optional: Select **Sign complete SAML response** to ensure the message integrity of the SAML response sent to the application during authentication.

   7. Optional: Select **Encrypt SAML Assertion**. When selected the SAML Assertion is also encrypted. If you select this option, do the following:

      1. Click Arrow Up To Line icon and browse to upload the encryption certificate file.
      2. From the **Encryption Method for Key** drop-down list, select either **RSA Version 1.5** or **RSA-OAEP**. RSA Version 1.5 is the default.
      3. From the **Encryption Method for Data** drop-down list, select the encryption method used to encrypt data. The options are:
         - AES-256 (default)
         - AES-128
         - AES-192
         - Triple DES

   note
   The **Subject Domain Name** and **Certificate Expiry Date** values are populated with values from the certificate once the **Encryption Certificate** is uploaded.

   8. Optional: Select **Override SAML Audience** to override the SAML application issuer value. If you select this option, complete the following:

      1. Select **SAML Audience supplied in request** to determine the purpose of the following audience value:
         - If enabled, set the **Audience** value to the required prefix of the SAML authentication request audience parameter value. If it matches the supplied value, the supplied value is used.
         - If deselected, set the **Audience** value to the override value to use.

   note
   When selecting the **Override SAML Audience** option, consider the following:

   - Set the Audience value to a different value only if it is required by the SAML Service Provider.
   - Configure the SAML application to allow the client to override the audience only if the client is trusted. If the client specifies the audience value, it may allow one SAML application to specify the SAML audience of another SAML application and allow access to the other applications.

9. Optional: Add **Alternative Assertion Consumer Service URLs**, as follows:

   1. Click **Add**.
   2. Enter a **Name**.
   3. Enter a URL **Value**.
   4. Select **Show in My Profile** to display the Alternative Consumer Service URL in a user's My profile page.
   5. Optional: **Add an Application Logo**.
   6. Click **Add**.
   7. Repeat these steps to add more Alternative Assertion Consumer Service URLs.

10. Optional: To add a **Relay State**, do the following:

    1. Under **Relay State** click **Add**. The **Add Relay State** dialog box appears.
    2. Enter a **Name** for the relay state.
    3. Enter the **Value** for the relay state. This setting specifies the URL that a user is redirected to after successful authentication. For example, `https://google.calendar.com`.
    4. Select **Show in My Profile** to display the relay state on the user's My Profile page.

note
After you add relay states, you can also enable or disable them on the Add/Edit application page. Click Square icon next to the relay state to disable it or click Play icon to re-enable it.

    Relay states apply to the Default Assertion Consumer Service URLs and not the Alternative Consumer Service URLs.

11. Optional: Add a Relay State custom logo, as follows:

    1. Click Circle Plus icon next to **Relay State Logo**. The **Upload Logo** dialog box appears.
    2. Click Arrow Up To Line icon to select an image file to upload.
    3. Browse to select your file and click **Open**. The **Upload Logo** dialog box reappears showing your selected image.
    4. If required, resize your image.
    5. Click **OK**.
    6. Click **Add**.

12. Repeat these steps to add more Relay States.

13. Click **Save.**

note
After configuring the **General** settings, **Customization** and **Resource Rules** tabs appear.

14. Proceed to _Step 2: Configure customizations_.

### Step 2: Configure customizations

1. Click the **Customization** tab. The **Customization** page appears.
2. Select **Show Default Assertion Consumer URL Service in the My Profile**. When selected, the Default Assertion Consumer URL appears in a user's My Profile page in addition to relay states and Alternative Assertion Consumer URLs.
3. Deselect **Enable Go Back Button** if you do not want users to be able to go back to the application login page to log in.
4. Select **Respond Immediately for Unsuccessful Responses** to return to the application immediately after a login failure, rather than allow user to try again with a different userID.
5. Optional: Add a custom application logo.
   1. Click Circle Plus icon next to **Application Logo**. The **Upload Logo** dialog box appears.
   2. Click Arrow Up To Line icon to select an image file to upload.
   3. Browse to select your file and click **Open**. The **Upload Logo** **dialog box** displays your selected image.
   4. If required, resize your image.
   5. Click **OK**.
6. Select the **Login Options** that appear to users during login. You must select at least one. For details on each login option and requirements, see [Manage login options](/docs/applications-and-sso/manage-applications/manage-login-options.md).
7. Click **Save**.

### Step 3: Configure a resource rule

1. Click the **Resource Rules** tab.
2. Click **Add Resource Rule**.
3. Follow the instructions in [Create and manage resource rules](/docs/authentication-and-security/create-and-manage-resource-rules/create-resource-rules.md).

### Step 4: Download the signing certificate

1. Log in to your IDaaS administrator account.
2. Click Menu icon **>** **Security > Applications**. The **Applications List** page appears.
3. Under **SAML Cloud Integrations**, click **SAML Signing Certificates**. The **SAML Signing Certificates** page appears.
4. Click Arrow Down To Line icon next to the certificate to export the certificate you want to import into your SAML service provider application. The **Export Certificate** dialog box appears.
   1. If the certificate has been issued by a CA, do one of the following:
      - Click **Certificate** to export the self-signed certificate.
      - Click **Root CA Certificate** to export a certificate issued from a CA.
      - Click **Certificate Chain** to export the SAML signing certificate and its CA certificates.
   2. Click **Export**.

### Step 5: Set up IDaaS as an Identity Provider for your SAML Service Provider

1. Open your SAML Service Provider application.

2. Copy or import the signing certificate into your application.

note
For Service Providers that support it, the metadata file can be uploaded instead of manually filling in all the fields.

3. Complete other required tasks to configure IDaaS as an Identity Provider in your custom application.