> For the complete documentation index, see [llms.txt](https://docs-v3.toucantoco.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs-v3.toucantoco.com/self-hosted-toucan/configuration/authentication/saml.md).

# Configure SAML authentication

This document outlines the steps to configure SAML2 authentication.

## Configuration

### SAML2 Identity Provider side (Your Identity Provider)

Go to your OIDC Provider administration console and configure the necessary settings for SAML2 authentication:

1. Create the SAML2 Client in your Identity Provider.
2. Set the Assertion Consumer URL to `https://<app hostname>/api/auth/realms/7bf98083-e4ff-4769-baa7-da4fde86d932/broker/saml2/endpoint`.
   * `7bf98083-e4ff-4769-baa7-da4fde86d932` correspond the the helm chart default value `global.tenantID`. In which, it has no other function beside naming the tenant. This used internally at Toucan.
   * `saml2` (before the `/endpoint`) correspond to the name of the SAML2 authenticator (see below), in the SAML2 client configuration. If you plan to use another name, replace `saml2` by the name of the authenticator.
3. Configure the allowed entity IDs for the SAML2 client (`keycloak` for example). Your identity provider will also provide an entity ID to provide to the SAML2 client.
4. Fetch the Provider's metadata URL.

### SAML2 Service Provider side (Keycloak)

{% hint style="warning" %}
At the moment, the feature is very young and we are not allowing much configuration (SSO methods, etc.).

If you need any specific configuration from Keycloak, please reach out to us.
{% endhint %}

To configure SAML2 authentication, follow these steps:

1. In the Helm Charts, set these parameters:

{% code title="yaml: values.override.yaml" %}

```yaml
keycloak:
  config:
    sso:
      authenticators:
        - id: saml2
          displayName: 'SAML2'
          type: saml
          idpEntityID: 'https://sso.example.com/saml'
          spEntityID: 'keycloak'
          singleSignOnURL: 'https://sso.example.com/saml'
          singleLogoutURL: 'https://sso.example.com/saml'
          # Required for assertion signing verification
          metadataDescriptorURL: 'https://sso.example.com/saml/descriptor'
```

{% endcode %}

2. Deploy the Helm Charts (`helm upgrade -f ./values.override.yaml ...`).

That's it! The SAML2 authentication should be configured and working now.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs-v3.toucantoco.com/self-hosted-toucan/configuration/authentication/saml.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.