# Connect a SAML 2.0 identity provider
URL: https://docs.autociso.io/product/sso/saml/
Description: Connect any SAML 2.0 identity provider to AutoCISO by pasting its metadata XML, then configuring the ACS URL and Entity ID on your side.

Use this when your identity provider speaks SAML 2.0 rather than OIDC — ADFS,
PingFederate, or a SAML app in Okta, Entra or OneLogin.

If your provider supports both, prefer OIDC: the setup is shorter and there is
no metadata document to keep in step. See [Okta](https://docs.autociso.io/product/sso/okta/) (also for any generic OIDC
provider) or [Microsoft Entra ID](https://docs.autociso.io/product/sso/microsoft-entra-id/).

Requires [The Growth plan or higher](https://docs.autociso.io/getting-started/plans-and-features/) and the [**Owner** role](https://docs.autociso.io/getting-started/roles-and-permissions/) in AutoCISO. The sign-in settings used here are explained in [Single Sign-On](https://docs.autociso.io/product/sso/overview/).

## The order matters

SAML setup is circular: your provider needs values from AutoCISO, and AutoCISO
needs metadata from your provider. AutoCISO goes first with a placeholder, then
you come back:

1. Create the connection in AutoCISO with your provider's metadata XML.
2. Copy the ACS URL and Entity ID AutoCISO then shows you.
3. Finish the configuration in your identity provider.
4. Test.

## 1. Export metadata from your identity provider

Create a SAML application in your identity provider and download its **IdP
metadata XML**. It is a single XML document containing an `EntityDescriptor`
with an `IDPSSODescriptor` and the signing certificate.

If your provider only offers a metadata *URL*, open it in a browser and save the
document — AutoCISO takes the XML itself, never a URL. This is deliberate:
AutoCISO never fetches a URL you supply.

## 2. Create the connection in AutoCISO

1. Go to **user menu → [Organization Settings](https://docs.autociso.io/console/settings/organization/) → Sign-In Policy**.
2. In the **Single Sign-On** section choose **Generic SAML 2.0**.
3. Paste the whole metadata document into **Metadata XML**.
4. Name the connection, for example `Acme ADFS`.
5. Select **Save**.

## 3. Copy AutoCISO's values into your identity provider

The saved connection now shows:

- **ACS URL** — the Assertion Consumer Service endpoint, where your provider
  posts the SAML assertion.
- **Entity ID** — the service provider identifier, also the audience your
  assertion must be addressed to.

Both are unique to your connection. Paste them into the SAML application you
created, as the Reply URL / ACS and the Audience / Entity ID respectively.

Set the **NameID** to the user's email address. AutoCISO matches people by
verified email; an opaque or transient NameID will not link to existing
accounts.

## 4. Test

Back in AutoCISO, select **Test connection**. On success the status becomes
**Active**.

## 5. Offer it to your team

1. In **Allowed Providers**, select the new connection, keeping
   **Email / Password** selected until you have confirmed sign-in works.
2. Select **Save**.
3. Sign out and sign in through your organization's sign-in link.

## Editing a SAML connection later

Editing requires pasting the metadata XML again, every time. AutoCISO does not
keep a copy of the document, so it cannot re-send one on your behalf, and
sending a blank one would erase your provider's configuration. The Save button
stays disabled until you paste it.

Re-export the metadata from your provider whenever its signing certificate
rotates, and paste the new document here. A rotated certificate that AutoCISO
does not know about looks like a sudden, total sign-in failure.

## Limitations

- **SP-initiated only.** People must start at AutoCISO — your sign-in link or
  the sign-in page. Starting from a tile in your identity provider's dashboard
  is not supported.
- **One connection per organization.**
- **No SAML single logout.** Signing out of AutoCISO does not sign the person
  out of your identity provider.