--- title: "SSO: SAML 2.0" slug: "sso-saml-20" tags: ["single sign-on"] updated: 2024-10-01T18:33:30Z published: 2024-10-01T18:33:30Z canonical: "support.smarteru.com/sso-saml-20" --- > ## Documentation Index > Fetch the complete documentation index at: https://support.smarteru.com/llms.txt > Use this file to discover all available pages before exploring further. # SSO: SAML 2.0 To set up SAML 2.0 with SmarterU, do the following from the [External Authorization section of your account settings](/v1/docs/account-external-authorization-sso): 1. Select **Enable External Authorization**. 2. Expand the SAML 2.0 section and specify the [SAML settings](/v1/docs/sso-saml-20#saml-settings). ![Graphical user interface, text, application, email Description automatically generated](https://cdn.document360.io/7efaadab-fef6-4186-806a-2ca14c9ce9ea/Images/Documentation/sso-saml-2.0-image-8cl5j1aq.png) 1. Click **Save**. ## SAML Settings ### Login URL This setting is only applicable if the [**Master Login Control**](/v1/docs/account-external-authorization-sso#master-login-control) and [**User Default Login settings**](/v1/docs/account-external-authorization-sso#user-default-login) are set to a value other than *SmarterU*. This is the URL that users will be redirected to when they click the Login button on the portal page. ### Customize Login Button Text This setting is only applicable if the [**Master Login Control** setting](/v1/docs/account-external-authorization-sso#master-login-control) is set to a value other than *SmarterU*. This is the label that displays on the login button. ### Customize Portal Login Text This setting is only applicable if the [**Master Login Control** setting](/v1/docs/account-external-authorization-sso#master-login-control) is set to *Both* or *User-Specified*. This is the label that displays on the portal's login button. ### Enable SAML Select to enable SAML. ### IdP Metadata This setting is only enabled if the [**Enable SAML** setting](/v1/docs/sso-saml-20#enable-saml) is enabled. Enter your IdP metadata. If you do not know your metadata or how to get it, we have several [Identity Providers](/v1/docs/sso-saml-20#tested-identity-providers) that you can use. ### Identifier Attribute/Claim This setting is only enabled if the [**Enable SAML** setting](/v1/docs/sso-saml-20#enable-saml) is enabled. Select the identifier/claim to use as a login credential. ### Identifier Type This setting is only enabled if the [**Enable SAML** setting](/v1/docs/sso-saml-20#enable-saml) is enabled. The identifier type tells SmarterU whether the Identifier Attribute/Claim represents the email, or the employee ID of a user in SmarterU. ### Perform Single Logout on Session Timeout This setting is only enabled if the [**Enable SAML** setting](/v1/docs/sso-saml-20#enable-saml) is enabled and [**IdP Metadata**](/v1/docs/sso-saml-20#idp-metadata) has been provided. Select to log users out from all applications where SSO was used when they log out of SmarterU, or their SmarterU session times out. ### Enable Just-in-Time User Creation Select to create a user account just before the user is logged into SmarterU. When a user attempts to connect to SmarterU, SmarterU uses the [Identifier Attribute/Claim setting](/v1/docs/sso-saml-20#identifier-attributeclaim) to determine if they exist in the system. If the user exists, they are logged in. If the user does not exist and the Enable Just-In-Time User Creation setting is enabled, SmarterU will create their user account prior to logging them in. - Enabling this setting allows you to set the user's given name, surname, and home group. All other updates to a user's profile will need to be done outside the just-in-time user creation feature. - The [account invitation email](https://support.smarteru.com/docs/account-email-template-options#account-invitation) is not sent to users created with Just-in-Time User Creation. ### Given Name Attribute/Claim This setting is only enabled if the **Enable Just-In-Time User Creation** setting is enabled. Select the field from the metadata that should be used for the [user's given name](/v1/docs/user-login-information#given-names-required). ### Surname Attribute/Claim This setting is only enabled if the **Enable Just-In-Time User Creation** setting is enabled. Select the field from the metadata that should be used for the [user's surname](/v1/docs/user-login-information#surname-required). ### Alternate Email Attribute/Claim This setting is only enabled if the **Enable Just-In-Time User Creation** setting is enabled and the Identifier Type is set to *Employee ID*. Select the field from the metadata that should be used for the [user's alternate email](/v1/docs/user-login-information#send-email-to). ### Home Group This setting is only enabled if the **Enable Just-In-Time User Creation** setting is enabled. Select the [home group](/v1/docs/home-groups) to which just-in-time users are added. ## **Tested Identity Providers** - [Microsoft ADFS](/v1/docs/sso-active-directory-federation-services) - [Okta](/v1/docs/sso-okta) - [Salesforce](/v1/docs/sso-salesforce) ## Related - [Account: External Authorization (SSO)](/account-external-authorization-sso.md) - [Editing Your Account Settings](/editing-your-account-settings.md) - [External Authorization (SSO)](/external-authorization-sso.md) - [Just-In-Time User Creation](/just-in-time-user-creation.md) - [Just-In-Time User Creation with Okta](/just-in-time-user-creation-with-okta.md) - [SSO: Active Directory Federation Services](/sso-active-directory-federation-services.md) - [SSO: Okta](/sso-okta.md) - [SSO: Salesforce](/sso-salesforce.md) - [User: Login Information](/user-login-information.md) - [User Sync Integrations](/user-sync-integrations.md)