# Keeper Security

> Integrate Keeper Security with Ironchip over SAML (SSO Connect): set up the authentication method in Keeper, the application in Ironchip, and fix common errors.

URL: https://docs.ironchip.com/en/identidad/integraciones/saas/keeper-security/

This guide describes how to integrate Keeper Security with Ironchip over SAML. Ironchip acts as the identity provider and Keeper Security, with SSO Connect Cloud, as the service provider.

:::caution
All users must have an email address from a domain associated with your organization in Keeper Security.
:::

## Requirements

- Access to the Ironchip admin console.
- A user with permissions to make the configuration in Keeper Security.

## Configure Keeper Security

1. Sign in to the Keeper Security admin console.
2. Open the **Admin** tab.
3. In **Node**, select the node you want to apply the Ironchip configuration to.
4. Go to the **Provisioning** tab.
5. Click **Add Method** and create an SSO Connect Cloud single sign-on method.
6. Open the three-dot menu on the right of the method and select **View**.

   [Image: User Provisioning list in the Keeper admin console with the Add Method button and the three-dot menu of the SSO Connect Cloud method with View highlighted]

7. Click **Export Metadata** to download the Keeper Security metadata. Upload the file content to a public URL so Ironchip can read it, and save that URL, because you will use it later.

   [Image: SSO Connect Cloud method view with the export metadata button]

8. Before continuing in Ironchip, edit the method from the three-dot menu. Under the identity provider attribute mappings, enter `uid` in **Email**. Ironchip only needs the email: leave the other fields empty.

   [Image: Identity provider attribute mappings with uid in the Email field]

## Configure Ironchip

1. In the Ironchip admin console, go to **Applications** and click the green **New application** button.

   [Image: New application button in the Applications section of the Ironchip admin console]

2. Select the **SAML** type and download the Ironchip metadata with **Download metadata file**.

   [Image: Add a new application form with the SAML type and the Download metadata file button]

3. In the **Metadata URL** field, enter the Keeper metadata URL you got earlier. This is the URL Ironchip uses to communicate with Keeper.

   [Image: Metadata URL field of the new application form]

4. Click **Add service** to finish the configuration in Ironchip.
5. Back in Keeper Security, edit the SSO Connect Cloud method again. Under **Identity Provider**, set **IDP Type** to **GENERIC**, click **Browse Files** under **SAML Metadata**, and select the metadata file you downloaded from Ironchip.

   [Image: Identity Provider section with the GENERIC IDP type and the Browse Files link under SAML Metadata]

## Verify the integration

Before you test, give the user you will sign in with access to the Ironchip application. The steps are in [Add users to the service](https://docs.ironchip.com/en/identidad/protocolos/saml/#grant-access-to-users-and-groups).

1. Open the Keeper Security sign-in page and sign in with SSO using an email address from a domain associated with your organization.
2. Keeper Security redirects you to Ironchip to authenticate.
3. Complete the authentication on your device. Ironchip returns you to Keeper Security with your session started.

## Troubleshooting

### Node error

Keeper shows this error when the user does not belong to the node where SSO Connect is configured:

> For security reasons, any user who logs in with SSO must be provisioned to the SSO-enabled node in the Keeper Admin Console.

Move the user to the node where you configured SSO Connect.

[Image: SSO Connect error message for a user outside the configured node]

### Email domain error

Keeper shows this error when the email domain is not associated with your organization:

> Just-in-time provisioning is only allowed on reserved domains, and the domain (example.com) is not associated to your enterprise.

Keeper Security only accepts domains associated with your organization. Associate the domain in Keeper or use another email address.

[Image: SSO Connect error message for an email domain that is not associated]