> ## Documentation Index > Fetch the complete documentation index at: https://tonelloandco.mintlify.site/llms.txt > Use this file to discover all available pages before exploring further. # SAML > Sysdig supports SAML authentication for your Identity Provider (IdP) of choice. # SAML (SaaS) Sysdig supports SAML authentication for your Identity Provider (IdP) of choice. Ordinarily, the Sysdig platform maintains a database to hold username and password hash data. When SAML is enabled, users can instead be redirected to your organization’s IdP to validate username, password and other policies necessary to grant access to the Sysdig platform. Upon successful authentication via SAML, a corresponding user record in the Sysdig platform’s user database is automatically created, though the password that was sent to the IdP is never seen nor stored by the Sysdig platform. ## Prerequisites This topic is specific to cloud-based (SaaS) Sysdig environments. To configure an On-Premises Sysdig environment, see [SAML (On-Prem)](https://docs.sysdig.com/en/docs/administration/on-premises-deployments/authentication-and-authorization-on-prem-options/saml-on-prem). If you want to set up SAML for both Sysdig Monitor and Sysdig Secure, you need to complete the setup process twice. Setting up SAML on one will not automatically set it up on the other. To configure SAML Single Sign-On (SSO), you need: * An Administrator role. * `Customer ID` and `Customer Name`: See [Find Your Customer ID, Name, and External ID](https://docs.sysdig.com/en/docs/administration/administration-settings/find-your-customer-id-and-name). Sysdig does not support signed AuthNRequests for `AuthNRequest with embedded signature (HTTP-POST binding)` requirements. For a possible alternative, see [OpenID Connect](https://docs.sysdig.com/en/openid-connect-saas/). ## Redirect URLs for Authentication | Region | App | Single Sign-on URL | Service Provider Entity ID | | - | - | - | - | | au1 | Monitor | [https://app.au1.sysdig.com/api/saml/auth](https://app.au1.sysdig.com/api/saml/auth) | [https://app.au1.sysdig.com](https://app.au1.sysdig.com) | | au1 | Secure | [https://app.au1.sysdig.com/api/saml/secureAuth](https://app.au1.sysdig.com/api/saml/secureAuth) | [https://app.au1.sysdig.com](https://app.au1.sysdig.com) | | eu1 | Monitor | [https://eu1.app.sysdig.com/api/saml/auth](https://eu1.app.sysdig.com/api/saml/auth) | [https://eu1.app.sysdig.com](https://eu1.app.sysdig.com) | | eu1 | Secure | [https://eu1.app.sysdig.com/api/saml/secureAuth](https://eu1.app.sysdig.com/api/saml/secureAuth) | [https://eu1.app.sysdig.com/secure/](https://eu1.app.sysdig.com/secure/) | | in1 | Monitor | [https://app.in1.sysdig.com/api/saml/auth](https://app.in1.sysdig.com/api/saml/auth) | [https://app.in1.sysdig.com](https://app.in1.sysdig.com) | | in1 | Secure | [https://app.in1.sysdig.com/api/saml/secureAuth](https://app.in1.sysdig.com/api/saml/secureAuth) | [https://app.in1.sysdig.com/secure/](https://app.in1.sysdig.com/secure/) | | me2 | Monitor | [https://app.me2.sysdig.com/api/saml/auth](https://app.me2.sysdig.com/api/saml/auth) | [https://app.me2.sysdig.com](https://app.me2.sysdig.com) | | me2 | Secure | [https://app.me2.sysdig.com/api/saml/secureAuth](https://app.me2.sysdig.com/api/saml/secureAuth) | [https://app.me2.sysdig.com/secure/](https://app.me2.sysdig.com/secure/) | | us | Monitor | [https://app.sysdigcloud.com/api/saml/auth](https://app.sysdigcloud.com/api/saml/auth) | [https://app.sysdigcloud.com](https://app.sysdigcloud.com) | | us | Secure | [https://secure.sysdig.com/api/saml/secureAuth](https://secure.sysdig.com/api/saml/secureAuth) | [https://secure.sysdig.com](https://secure.sysdig.com) | | us2 | Monitor | [https://us2.app.sysdig.com/api/saml/auth](https://us2.app.sysdig.com/api/saml/auth) | [https://us2.app.sysdig.com](https://us2.app.sysdig.com) | | us2 | Secure | [https://us2.app.sysdig.com/api/saml/secureAuth](https://us2.app.sysdig.com/api/saml/secureAuth) | [https://us2.app.sysdig.com/secure/](https://us2.app.sysdig.com/secure/) | | us4 | Monitor | [https://app.us4.sysdig.com/api/saml/auth](https://app.us4.sysdig.com/api/saml/auth) | [https://app.us4.sysdig.com](https://app.us4.sysdig.com) | | us4 | Secure | [https://app.us4.sysdig.com/api/saml/secureAuth](https://app.us4.sysdig.com/api/saml/secureAuth) | [https://app.us4.sysdig.com/secure/](https://app.us4.sysdig.com/secure/) | If multiple integrations are used with the same IdP, make sure to enable **Unique Entity ID**. It appends a hash to the Entity ID which is unique for each integration. Examples for EU1: * Monitor 1: [https://eu1.app.sysdig.com/225992664c8fb69dd4cc7c12d158b1289d40eeae](https://eu1.app.sysdig.com/225992664c8fb69dd4cc7c12d158b1289d40eeae) * Monitor 2: [https://eu1.app.sysdig.com/f0f703fede16e024e28c6fc77c715815d1e79124](https://eu1.app.sysdig.com/f0f703fede16e024e28c6fc77c715815d1e79124) * Secure 1: [https://eu1.app.sysdig.com/secure/7d1fc014f0d7501a1fb150b7ef94a0404ea7af0e](https://eu1.app.sysdig.com/secure/7d1fc014f0d7501a1fb150b7ef94a0404ea7af0e) * Secure 2: [https://eu1.app.sysdig.com/secure/348917fddb39b5bdcf286615a00ea705df295a11](https://eu1.app.sysdig.com/secure/348917fddb39b5bdcf286615a00ea705df295a11) ## Basic Enablement Workflow Contact Sysdig Support to set your company name on the account. This is applicable to all supported IdPs. To obtain your Company Name, See [Find Your Customer ID, Name, and External ID](https://docs.sysdig.com/en/docs/administration/administration-settings/find-your-customer-id-and-name). ### Which IdP to Use? Determine which IdP your company uses and will be configuring. The following IdPs have been tested: * [Okta (SAML)](https://docs.sysdig.com/en/docs/administration/administration-settings/authentication-and-authorization-saas/saml-saas/okta-saml) * [OneLogin (SAML)](https://docs.sysdig.com/en/docs/administration/administration-settings/authentication-and-authorization-saas/saml-saas/onelogin-saml) * [Microsoft Entra ID (SAML)](https://docs.sysdig.com/en/docs/administration/administration-settings/authentication-and-authorization-saas/saml-saas/azure-active-directory-saml) * [Google Workspace (SAML)](https://docs.sysdig.com/en/google-workspace-saml.html) Unlisted IdPs might work with the Sysdig platform. For help, contact [Sysdig Support](https://sysdig.com/support/submit-ticket/). ### Which Login Flow to Use? Decide which login flow you want users to experience from the following options: #### Login From the Sysdig Login Page Click the **SAML** button on the login page and enter Company Name. Open the [domain URL](https://docs.sysdig.com/en/docs/administration/saas-regions-and-ip-ranges/#redirect-urls-for-authentication) corresponding to your Sysdig application and region and enter your company name. For example, domain URLs of Monitor and Secure for US East are [app.sysdigcloud.com](https://app.sysdigcloud.com/) and [secure.sysdig.com](https://secure.sysdig.com/) respectively. For other regions, see [Redirect URLs for Authentication](https://docs.sysdig.com/en/administration/saml-saas/#redirect-urls-for-authentication). #### Type or Bookmark a URL Type or bookmark a URL in the browser. Examples (with no integration name): * US East * Monitor: `https://app.sysdigcloud.com/api/saml/COMPANY_NAME?redirectRoute=%2F&companyName=` * Secure: `https://secure.sysdig.com/api/saml/COMPANY_NAME?product=SDS&redirectRoute=%2F&companyName=` * EU * Monitor: `https://eu1.app.sysdig.com/api/saml/COMPANY_NAME?redirectRoute=%2F&companyName=` * Secure: `https://eu1.app.sysdig.com/api/saml/COMPANY_NAME?product=SDS&redirectRoute=%2F&companyName=` If multiple integrations are used, the integration name must be appended. Examples (WITH integration name): * US East * Monitor: `https://app.sysdigcloud.com/api/saml/COMPANY_NAME?redirectRoute=%2F&companyName=&integrationName=` * Secure: `https://secure.sysdig.com/api/saml/COMPANY_NAME?product=SDS&redirectRoute=%2F&companyName=&integrationName=` * EU * Monitor: `https://eu1.app.sysdig.com/api/saml/COMPANY_NAME?redirectRoute=%2F&companyName=&integrationName=` * Secure: `https://eu1.app.sysdig.com/api/saml/COMPANY_NAME?product=SDS&redirectRoute=%2F&companyName=&integrationName=` #### Access from IdP interface Log in from an IdP interface. The individual IdP integration pages describe how to add Sysdig to the IdP interface. You need your [Customer ID](https://docs.sysdig.com/en/docs/administration/administration-settings/find-your-customer-id-and-name). ### Configure IdP Perform the configuration steps in your IdP interface and collect the resulting configuration attributes. Collect metadata URL (or XML) and test it. If you intend to configure IdP-initiated login flow, have your `Customer ID` ready (see [Prerequisites](https://docs.sysdig.com/en/administration/saml-saas/#prerequisites)). Select your IdP from the list below, and follow the instructions: * [Okta (SAML)](https://docs.sysdig.com/en/docs/administration/administration-settings/authentication-and-authorization-saas/saml-saas/okta-saml) * [OneLogin (SAML)](https://docs.sysdig.com/en/docs/administration/administration-settings/authentication-and-authorization-saas/saml-saas/onelogin-saml) * [Microsoft Entra ID (SAML)](https://docs.sysdig.com/en/docs/administration/administration-settings/authentication-and-authorization-saas/saml-saas/azure-active-directory-saml) * [Google Workspace (SAML)](https://docs.sysdig.com/en/google-workspace-saml.html) ### Configure Sysdig Log in to Sysdig Monitor or Sysdig Secure Settings as Admin, enter the necessary configuration information in the UI and enable the integration. Ensure that you enter a separate redirect URL in your IdP for each product; otherwise, the integration processes are the same. ### Adding or managing existing SAML SSO configuration To enable baseline SAML functionality: #### Create New SAML SSO Configuration If you are a Platform customer, make sure to repeat the process in both Sysdig Monitor and Sysdig Secure. 1. Log in to Sysdig Monitor or Sysdig Secure as administrator. 2. Select **Settings** from the User Profile button in the left navigation. 3. Select **Authentication (SSO)**. 4. Select **New Configuration**. 5. Select type **SAML** and click **Add**. 6. (Optional) **Integration Name** - Integration name must be provided if more than one SSO configuration of the same type is required. 7. Enter the relevant parameters (see table below) and click **Save Settings**. | Connection Setting | Options | Description | | - | - | - | | **Metadata Discovery** | URL | The URL provided at the end of the IdP configuration steps. | | | XML | An option you can use for an IdP that doesn’t support extracting metadata XML via URL. | | **Unique Entity ID** | off/on | When enabled Entity ID becomes unique for each integration to allow the usage of multiple SAML integrations with the same IdP. | | **Verify Signed Assertion** | off/on | Specify whether Sysdig should check for assertions signed in responses (to assist in validating correct IdP). We strongly recommend you toggle this on to increase security. | | **Email Parameter** | email | The parameter for the user email in SAML response. Sysdig uses this to extract the user’s email from the response. | | **Validate Signature** | off/on | Specify whether Sysdig backend should verify that the response is signed. We strongly recommend you toggle this on to increase security. | | **Verify Destination Field** | off/on | Specify whether Sysdig should check the “destination” field in the SAMLResponse. We recommend you toggle this on to increase security. You may toggle it off in special cases, such as when there is a proxy in front of the Sysdig back end. | | **Create User on Login** | off/on | Specify whether a user record should be created in the Sysdig database after the first successful SAML login. | | **SAML Single Logout** | off/on | Specify whether to use SAML single logout. See [Configure SAML Single Logout](https://docs.sysdig.com/en/administration/saml-saas/#configure-saml-single-logout). | | **SAML Encryption** | off/on | Specify whether to enable encrypted SAML response. See [Encrypted SAML response](https://docs.sysdig.com/en/administration/saml-saas/#encrypted-saml-response). | | **Username and Password Login** | off/on | Specify whether to enable user name and password login. | #### Control if SSO Integration is in Use Make sure at least one integration is enabled to be able to use it for logging users in. 1. Find the integration that you want to control. 2. Select the toggle on the left side of the integration and slide it to the right to enable or left to disable. 3. If you want to manage multiple integrations, repeat the process. #### Editing existing SSO Integration 1. Log in to Sysdig Monitor or Sysdig Secure as administrator. 2. Select **Settings** from the User Profile button in the left navigation. 3. Select **Authentication (SSO)**. 4. Select the pen icon on the right-hand side of the window to edit the existing integration. ## Configure SAML Single Logout Sysdig supports SAML Single Logout (SLO). SLO is a feature in federated authentication where Sysdig users can sign out of both their Sysdig session (Service Provider) and associated IdP (Identity Provider) simultaneously. SLO lets you terminate all sessions established via SAML SSO with a single logout process. This prevents unauthorized users from gaining access to Sysdig resources. ### SLO Process When you initiate a logout, Sysdig sends a digitally signed logout request to the IdP. The IdP validates the request and terminates the current login session, then redirects you back to the Sysdig login page. ### Configure IdP 1. Configure logout URLs: * Monitor: `/api/saml/slo/logout` * Secure: `/api/saml/slo/secureLogout` 2. Choose `HTTP Redirect` as the binding method. This option is an alternative to the `HTTP POST` method, which Sysdig does not support. 3. If your IdP mandates, upload the `signing` certificate for Sysdig. For more information, see [Retrieving the Public Keys](https://docs.sysdig.com/en/administration/saml-saas/#retrieving-the-public-keys). Certain IdPs, such as [Microsoft Entra ID](https://docs.sysdig.com/en/docs/administration/authentication-and-authorization-saas/saml-saas/microsoft-entra-id-saml/), don’t require you to upload the public key. ## Encrypted SAML response Enable encryption of SAML assertions to add an extra layer of security to your SSO authentication. To enable encrypted SAML response: 1. Obtain the `encryption` certificate. For information on obtaining the key, see [Retrieving the Public Keys](https://docs.sysdig.com/en/administration/saml-saas/#retrieving-the-public-keys). 2. Upload the certificate to your IdP. 3. Enable encryption on IdP. Some IdPs require the certificate in `.crt` format. You need to convert the `X509Certificate` from metadata to `.crt` format before uploading. ## Retrieving the Public Keys You can retrieve the public key from metadata. You can obtain the metadata as follows: * Monitor: `/api/saml/metadata/{customerName}` * Secure: `/api/saml/secureMetadata/{customerName}` If you provided an integration name or multiple integrations are used, you can obtain the metadata as follows: * Monitor: `/api/saml/metadata/{customerName}?integrationName=` * Secure: `/api/saml/secureMetadata/{customerName}?integrationName=` `{customerName}` must be URL encoded. Follow [these instructions](https://docs.sysdig.com/en/find-your-customer-id-and-name) to find your `{customerName}`. Two types of **KeyDescriptor** `` are provided: * **Signing certificate**: `` - Used to sign the SLO request. * **Encryption certificate**: `` - Used to decrypt the encrypted assertions that we receive from the IdP. If you are having issues retrieving the key, contact [**Sysdig Support**](https://sysdig.com/support/) to retrieve the public key associated with your deployment. ## End User Login to Sysdig You can offer users three ways to log in with a SAML configuration: * They can begin at the Sysdig SaaS URL and click the **SAML** button. See [SaaS Regions and IP Ranges](https://docs.sysdig.com/en/docs/administration/saas-regions-and-ip-ranges) and identify the correct Sysdig SaaS URL associated with your Sysdig application and region. For example, URLs of Monitor and Secure for US East are: Monitor: [app.sysdigcloud.com](https://app.sysdigcloud.com/) Secure: [secure.sysdig.com](https://secure.sysdig.com/) They will be prompted to enter a Company Name, so the Sysdig platform can redirect the browser to your IdP for authentication. Contact Sysdig Support to set your company name on the account. * You can provide an alternative URL to avoid the user having to enter a company name, in the format: Sysdig Monitor: `https://us2.app.sysdig.com/api/saml/` Sysdig Secure: `https://us2.app.sysdig.com/api/saml/?product=SDS` Replace `` with your company name. If you are using multiple integrations and/or the integration name is not null, the integration name should be included in this information: Sysdig Monitor: `https://us2.app.sysdig.com/api/saml/?integrationName=` Sysdig Secure: `https://us2.app.sysdig.com/api/saml/?integrationName=&product=SDS` For other regions, the format is `https://.app.sysdig.com/api/saml/`. Replace `` with the region where your Sysdig application is hosted. For example, for Sysdig Secure in the EU, you use [https://eu1.app.sysdig.com/api/saml/secureAuth](https://eu1.app.sysdig.com/#/login). * You can configure an IdP-initiated login flow when configuring your IdP. The users then select the Sysdig application from your IdP’s app directory and do not browse directly to a Sysdig application URL at all. Users that complete their first successful SAML login to Sysdig Secure may receive the error message “User doesn’t have permission to log in to Sysdig Secure”. This is because only members of the **Secure Operations** team are permitted access to Sysdig Secure, and newly-created logins are not in this team by default. Such a user should contact an Administrator for the Sysdig environment to be added to the **Secure Operations** team. Environments that wish to have all the users access Sysdig Secure by default could use [this sample Python script](https://raw.githubusercontent.com/draios/python-sdc-client/master/examples/add_users_to_secure.py) to frequently “sync” the team memberships. See [Developer Documentation](https://docs.sysdig.com/en/administration/saml-saas/) for tips on using the sample Python scripts provided by Sysdig.