Connect a SAML 2.0 identity provider

Use this when your identity provider speaks SAML 2.0 rather than OIDC — ADFS, PingFederate, or a SAML app in Okta, Entra or OneLogin.

If your provider supports both, prefer OIDC: the setup is shorter and there is no metadata document to keep in step.

Requires the Growth or Scale plan, and the Owner role in autociso.

The order matters

SAML setup is circular: your provider needs values from autociso, and autociso needs metadata from your provider. autociso goes first with a placeholder, then you come back:

1. Create the connection in autociso with your provider’s metadata XML.
2. Copy the ACS URL and Entity ID autociso then shows you.
3. Finish the configuration in your identity provider.
4. Test.

1. Export metadata from your identity provider

Create a SAML application in your identity provider and download its IdP metadata XML. It is a single XML document containing an EntityDescriptor with an IDPSSODescriptor and the signing certificate.

If your provider only offers a metadata URL, open it in a browser and save the document — autociso takes the XML itself, never a URL. This is deliberate: autociso never fetches a URL you supply.

2. Create the connection in autociso

1. Go to Organization → Sign-In Policy.
2. In the Single Sign-On section choose Generic SAML 2.0.
3. Paste the whole metadata document into Metadata XML.
4. Name the connection, for example Acme ADFS.
5. Select Save.

3. Copy autociso’s values into your identity provider

The saved connection now shows:

• ACS URL — the Assertion Consumer Service endpoint, where your provider posts the SAML assertion.
• Entity ID — the service provider identifier, also the audience your assertion must be addressed to.

Both are unique to your connection. Paste them into the SAML application you created, as the Reply URL / ACS and the Audience / Entity ID respectively.

Set the NameID to the user’s email address. autociso matches people by verified email; an opaque or transient NameID will not link to existing accounts.

4. Test

Back in autociso, select Test connection. On success the status becomes Active.

5. Offer it to your team

1. In Allowed Providers, select the new connection, keeping Email / Password selected until you have confirmed sign-in works.
2. Select Save.
3. Sign out and sign in through your organization’s sign-in link.

Editing a SAML connection later

Editing requires pasting the metadata XML again, every time. autociso does not keep a copy of the document, so it cannot re-send one on your behalf, and sending a blank one would erase your provider’s configuration. The Save button stays disabled until you paste it.

Re-export the metadata from your provider whenever its signing certificate rotates, and paste the new document here. A rotated certificate that autociso does not know about looks like a sudden, total sign-in failure.

Limitations

• SP-initiated only. People must start at autociso — your sign-in link or the sign-in page. Starting from a tile in your identity provider’s dashboard is not supported.
• One connection per organization.
• No SAML single logout. Signing out of autociso does not sign the person out of your identity provider.