> For the complete documentation index, see [llms.txt](https://docs-v3.toucantoco.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs-v3.toucantoco.com/self-hosted-toucan/configuration/authentication/saml.md).

# Configure SAML authentication

This document outlines the steps to configure SAML2 authentication.

## Configuration

### SAML2 Identity Provider side (Your Identity Provider)

Go to your OIDC Provider administration console and configure the necessary settings for SAML2 authentication:

1. Create the SAML2 Client in your Identity Provider.
2. Set the Assertion Consumer URL to `https://<app hostname>/api/auth/realms/7bf98083-e4ff-4769-baa7-da4fde86d932/broker/saml2/endpoint`.
   * `7bf98083-e4ff-4769-baa7-da4fde86d932` correspond the the helm chart default value `global.tenantID`. In which, it has no other function beside naming the tenant. This used internally at Toucan.
   * `saml2` (before the `/endpoint`) correspond to the name of the SAML2 authenticator (see below), in the SAML2 client configuration. If you plan to use another name, replace `saml2` by the name of the authenticator.
3. Configure the allowed entity IDs for the SAML2 client (`keycloak` for example). Your identity provider will also provide an entity ID to provide to the SAML2 client.
4. Fetch the Provider's metadata URL.

### SAML2 Service Provider side (Keycloak)

{% hint style="warning" %}
At the moment, the feature is very young and we are not allowing much configuration (SSO methods, etc.).

If you need any specific configuration from Keycloak, please reach out to us.
{% endhint %}

To configure SAML2 authentication, follow these steps:

1. In the Helm Charts, set these parameters:

{% code title="yaml: values.override.yaml" %}

```yaml
keycloak:
  config:
    sso:
      authenticators:
        - id: saml2
          displayName: 'SAML2'
          type: saml
          idpEntityID: 'https://sso.example.com/saml'
          spEntityID: 'keycloak'
          singleSignOnURL: 'https://sso.example.com/saml'
          singleLogoutURL: 'https://sso.example.com/saml'
          # Required for assertion signing verification
          metadataDescriptorURL: 'https://sso.example.com/saml/descriptor'
```

{% endcode %}

2. Deploy the Helm Charts (`helm upgrade -f ./values.override.yaml ...`).

That's it! The SAML2 authentication should be configured and working now.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs-v3.toucantoco.com/self-hosted-toucan/configuration/authentication/saml.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.