# SAML

> Protect an application with SAML 2.0: supported attributes, adding the application with its metadata, and granting users and groups access with policies.

URL: https://docs.ironchip.com/en/identidad/protocolos/saml/

SAML 2.0 is the federation protocol used by corporate suites and SaaS applications (Microsoft 365, Google Workspace, Salesforce). Ironchip acts as the identity provider and issues the assertion with the user's attributes.

## Requirements

- An administrator account in the Ironchip admin console.
- A service that supports SAML 2.0 and whose **ACS URL** and **Entity ID** you know.
- The users enrolled in Ironchip, or [identity synchronization](https://docs.ironchip.com/en/identidad/administracion/sincronizacion/) configured.
- The company created in Ironchip. See [Integration protocols](https://docs.ironchip.com/en/identidad/protocolos/) for the data to prepare.

## Supported SAML attributes

Ironchip currently supports these fields:

| Description      | Friendly name | SAML name                           |
| ---------------- | ------------- | ----------------------------------- |
| User name        | `uid`         | `urn:oid:0.9.2342.19200300.100.1.1` |
| User email       | `mail`        | `urn:oid:0.9.2342.19200300.100.1.3` |
| User given name  | `givenName`   | `urn:oid:2.5.4.42`                  |
| User common name | `cn`          | `urn:oid:2.5.4.3`                   |

## Add the application to the company

The **Applications** section lists all the protected services that have been added to Ironchip and their integration type.

1. Click **New Application**. The **Add new application** window opens.

   [Image: Applications section with the New Application button highlighted]

2. In the **Application Details** step, enter the application name in **Name**.
3. In **Application integration type**, select **SAML**.
4. In **Metadata URL**, enter the public URL of the metadata document of the service you want to protect: Ironchip downloads it from that URL. You can find it in the service settings, for example in a **Metadata public URL** field.
5. Click **Download metadata file** to download Ironchip's SAML IdP metadata, and load it in the service settings so the service can communicate with Ironchip.

   [Image: Add application form with the SAML type, the Metadata URL field and the Download metadata file button]

6. Click **Next** and complete the **Upload Logo** step to finish. The service appears in the **Applications** section.

## Grant access to users and groups

1. In **Applications**, click **Add** in the **Add access** column of the service. The **Add a new access** window opens.
2. In **Select a group**, search by name with **Search by name**, check the **Add** box of the users or groups that get access and click **Next**.

   [Image: Select a group step of the Add a new access window, with the list of users and groups]

3. In **Select usernames**, check the format of the external username (**External Username**), email by default, and click **Next**.

   :::note
   The username must be the same as the user's account name in the service.
   :::

4. In **Select authentication policies**, choose the [authentication policies](https://docs.ironchip.com/en/identidad/conceptos/politicas/) required for access, for example **Any user devices** AND **Any user safezones**, and click **Next**.
5. In **Review**, check the summary and click **Add**.

The access is created with the selected configuration. You can change it at any time with the access's **Options** button. The details of each step are in [Grant access to users and groups](https://docs.ironchip.com/en/identidad/administracion/aplicaciones/#grant-access-to-users-and-groups).