> For the complete documentation index, see [llms.txt](https://docs.securepass.me/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.securepass.me/documentation/admin-user-guide/register-and-configure-applications/adding-an-application/entering-the-application-details/configuring-a-saml-application.md).

# Configuring a saml application

Selecting **SAML 2.0** opens five sections: **Basic SAML Configuration**, **Attributes & Claims**, **SAML Certificates**, **Set up your application**, and **Test single sign-on**.

{% stepper %}
{% step %}

## Basic SAML Configuration

![The Basic SAML Configuration section.](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/XCnbY4VQtvstdVSSM9vZ/assets/image16.png)

You can complete this section two ways. If the service provider has given you an XML metadata file, click **Upload metadata file** and select it — the fields fill themselves.

![Uploading a SAML metadata file.](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/pJMEC0YjZzVWxmzGnZOQ/assets/image17.png)

Otherwise, enter the values by hand.

![The Basic SAML Configuration fields.](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/p8WozRBGf3FL6xR0fefn/assets/image18.png)

| Field                                          | Description                                                                  |
| ---------------------------------------------- | ---------------------------------------------------------------------------- |
| **Identifier (Entity ID)**                     | Required. The unique SP identifier from the service provider's SAML metadata |
| **Reply URL (Assertion Consumer Service URL)** | Required. Where the IdP posts the SAML response                              |
| **Sign on URL**                                | Optional. The SP-initiated login URL, used when the SP is the entry point    |
| **Relay State**                                | Optional. The default value passed back to the SP when none is supplied      |
| **Logout URL**                                 | Optional. The Single Logout Service endpoint on the SP                       |
| **NameID Format**                              | The format of the subject identifier, for example **Email Address**          |
| {% endstep %}                                  |                                                                              |

{% step %}

## Attributes & Claims

This section defines what SECUREpass sends in the SAML assertion after a successful sign-in. The claim marked **NameID** drives the `<Subject>/<NameID>` element.

![The Attributes & Claims section, showing the default claims.](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/YiKMivsSCW8VE6Zmetnu/assets/image19.png)

SECUREpass ships with a default set — `givenname`, `surname`, `emailaddress`, `name`, and the Unique User Identifier — each mapped to a source attribute on the user record. You can add more in two ways.

![The Add common claims and Add a claim buttons.](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/NHh4Wx1v1ulbTk2PgB5G/assets/image1a.png)

### Add common claims

**Add common claims** offers a list of standard claims to pick from.

![The Add common claims panel.](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/imO14DtosnwEvKUL49Lp/assets/image1b.png)

![Selecting claims to add.](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/Msx6qkNA8k8fEaasUFhf/assets/image43.png)

Select what you need and click **Add Claims**.

### Add a claim

**Add a claim** is for anything not on that list.

![The Add a claim button.](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/XlyK5OcSuMlXGYZKIKeL/assets/image1d.png)

![The Add a claim dialog.](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/8buyP3i8qqeIrzF6W10R/assets/image1e.png)

Fill in the claim details. The **Use as Name ID** checkbox makes this claim the subject identifier instead of the default. Click **Add Claim** and it appears in the attributes list.

![The new claim in the attributes list.](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/PKnlfnGO6YcOjx364Fpn/assets/image1f.png)
{% endstep %}

{% step %}

## SAML Certificates

This section controls which SAML messages carry digital signatures and which algorithm signs them. SECUREpass signs outbound messages with its own private key as the identity provider. Where inbound messages from the service provider need signature verification, upload the SP's public certificate here.

![The SAML Certificates section.](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/BhZK6pv7qnoRYUcTziJQ/assets/image20.png)
{% endstep %}

{% step %}

## Set up your application

This section gives you the URLs and metadata the service provider needs to connect to SECUREpass as its identity provider. Copy these values into the application's own SAML configuration.

![The Set up your application section.](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/8e6Amuaq9yJ0cG9DF2X7/assets/image21.png)
{% endstep %}

{% step %}

## Test single sign-on

With everything filled in, run the test to confirm the configuration works before you go further.

![Testing single sign-on.](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/hRC8llQJLgrckkgYv6Rh/assets/image22.png)

Click **Next**.

![Moving on from the SAML configuration.](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/PcUsZXew39Jnw1q8i9Cb/assets/image23.png)
{% endstep %}
{% endstepper %}