# SAML

{% tabs %}
{% tab title="General configuration" %}

## Configure CISO Assistant with SAML <a href="#configure-ciso-assistant-with-saml" id="configure-ciso-assistant-with-saml"></a>

Once you've retrieved the **IdP Entity ID,** the **Metadata URL** and the **Entity ID** from your provider (see the list of providers for specific details), the configuration on CISO Assistant is pretty simple.

1. Log in into CISO Assistant as an **administrator > Extra > Settings**

   <figure><img src="https://intuitem.gitbook.io/ciso-assistant/~gitbook/image?url=https%3A%2F%2F217025809-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FUJGpmCYDFJNsz2CDasSm%252Fuploads%252F3z5pDa1gdTEkcxo9D2T2%252FScreenshot%25202024-09-02%252012.31.25.png%3Falt%3Dmedia%26token%3Dc1aee049-03fb-4c8b-87a3-9f86f97be797&#x26;width=768&#x26;dpr=4&#x26;quality=100&#x26;sign=caf49121&#x26;sv=2" alt=""><figcaption></figcaption></figure>
2. **Enable SSO**

   <figure><img src="https://intuitem.gitbook.io/ciso-assistant/~gitbook/image?url=https%3A%2F%2F217025809-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FUJGpmCYDFJNsz2CDasSm%252Fuploads%252F4LjypuxS6bwEqBP0mR8f%252FScreenshot%25202024-09-02%252012.32.06.png%3Falt%3Dmedia%26token%3Df484ce0d-269b-467b-ac1d-d25e101fd799&#x26;width=768&#x26;dpr=4&#x26;quality=100&#x26;sign=447334b6&#x26;sv=2" alt=""><figcaption></figcaption></figure>
3. Enter the **Idp Entity ID**

   <figure><img src="https://intuitem.gitbook.io/ciso-assistant/~gitbook/image?url=https%3A%2F%2F217025809-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FUJGpmCYDFJNsz2CDasSm%252Fuploads%252FT8QADfoj0vHJI1DB40BA%252FScreenshot%25202024-09-02%252012.32.42.png%3Falt%3Dmedia%26token%3D8db36031-0529-45a7-9b10-aa473ba6b084&#x26;width=768&#x26;dpr=4&#x26;quality=100&#x26;sign=10f71c58&#x26;sv=2" alt=""><figcaption></figcaption></figure>
4. Choose the option 1 or 2 depending of your provider and fill **Metadata URL** or **SSO URL**, **SLO URL**, **x509 certificate** retrieved from your provider

   <figure><img src="https://intuitem.gitbook.io/ciso-assistant/~gitbook/image?url=https%3A%2F%2F217025809-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FUJGpmCYDFJNsz2CDasSm%252Fuploads%252FfORouyvyEoppU7c0JFwu%252FScreenshot%25202024-09-02%252012.33.52.png%3Falt%3Dmedia%26token%3D82d2b3bc-0710-44a9-ad35-720dc0ab62c1&#x26;width=768&#x26;dpr=4&#x26;quality=100&#x26;sign=617a9133&#x26;sv=2" alt=""><figcaption></figcaption></figure>
5. Check that the **SP Entity ID** is similar to the **Entity/Client ID** specified on your provider

   <figure><img src="https://intuitem.gitbook.io/ciso-assistant/~gitbook/image?url=https%3A%2F%2F217025809-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FUJGpmCYDFJNsz2CDasSm%252Fuploads%252FOVe9ZNwKpwJd4JyzeM29%252Fciso-sso-step-4.png%3Falt%3Dmedia%26token%3Dd8959a60-287c-46d8-9dac-824809c59b3b&#x26;width=768&#x26;dpr=4&#x26;quality=100&#x26;sign=7e22e358&#x26;sv=2" alt=""><figcaption></figcaption></figure>
6. And that's it! Don't forget to save changes
7. You should now be able to see the **Login with SSO** button

   <figure><img src="https://intuitem.gitbook.io/ciso-assistant/~gitbook/image?url=https%3A%2F%2F217025809-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FUJGpmCYDFJNsz2CDasSm%252Fuploads%252FC9B0uTOSDje4TxZlPL6C%252Fciso-sso-step-6.png%3Falt%3Dmedia%26token%3D338f71f2-700e-45f5-8781-b39ae249445a&#x26;width=768&#x26;dpr=4&#x26;quality=100&#x26;sign=883e8330&#x26;sv=2" alt=""><figcaption></figcaption></figure>

{% endtab %}

{% tab title="Advanced settings" %}
**Allow single label domains**: This allows you to authenticate through SAML on a single-label domain (e.g. `https://ciso-assistant:8443`). If this is left unchecked, the only host forms allowed are:

* IPv4
* IPv6
* FQDN (e.g. <https://www.example.com/>)
* `localhost`
  {% endtab %}
  {% endtabs %}

{% hint style="warning" %}
Be aware that the user needs to be created on CISO Assistant to be authenticated with SSO.
{% endhint %}