SAML

SAML 2.0 is the federation protocol used by corporate suites and SaaS applications (Microsoft 365, Google Workspace, Salesforce). Ironchip acts as the identity provider and issues the assertion with the user’s attributes.

Requirements

• An administrator account in the Ironchip admin console.
• A service that supports SAML 2.0 and whose ACS URL and Entity ID you know.
• The users enrolled in Ironchip, or identity synchronization configured.
• The company created in Ironchip. See Integration protocols for the data to prepare.

Supported SAML attributes

Ironchip currently supports these fields:

Description	Friendly name	SAML name
User name	uid	urn:oid:0.9.2342.19200300.100.1.1
User email	mail	urn:oid:0.9.2342.19200300.100.1.3
User given name	givenName	urn:oid:2.5.4.42
User common name	cn	urn:oid:2.5.4.3

Add the application to the company

The Applications section lists all the protected services that have been added to Ironchip and their integration type.

1. Click New Application. The Add new application window opens.

   

2. In the Application Details step, enter the application name in Name.

3. In Application integration type, select SAML.

4. In Metadata URL, enter the public URL of the metadata document of the service you want to protect: Ironchip downloads it from that URL. You can find it in the service settings, for example in a Metadata public URL field.

5. Click Download metadata file to download Ironchip’s SAML IdP metadata, and load it in the service settings so the service can communicate with Ironchip.

   

6. Click Next and complete the Upload Logo step to finish. The service appears in the Applications section.

Grant access to users and groups

1. In Applications, click Add in the Add access column of the service. The Add a new access window opens.

2. In Select a group, search by name with Search by name, check the Add box of the users or groups that get access and click Next.

   

3. In Select usernames, check the format of the external username (External Username), email by default, and click Next.

   Note

   The username must be the same as the user’s account name in the service.

4. In Select authentication policies, choose the authentication policies required for access, for example Any user devices AND Any user safezones, and click Next.

5. In Review, check the summary and click Add.

The access is created with the selected configuration. You can change it at any time with the access’s Options button. The details of each step are in Grant access to users and groups.