> ## Documentation Index
> Fetch the complete documentation index at: https://docs.anny.co/llms.txt
> Use this file to discover all available pages before exploring further.

# Generic SAML 2.0 SSO

> Set up a company login with any SAML 2.0 identity provider such as Okta, Auth0, Keycloak, or Shibboleth in anny.

In this article, you learn how to set up a company login with any SAML 2.0 identity provider in anny. This is the right path for all systems that do not have their own guide, for example Okta, Auth0, Keycloak, Shibboleth, OneLogin, or Ping Identity.

<Info>
  For Microsoft 365 and Google Workspace there are dedicated articles with screenshots: [Microsoft SAML SSO](/en/microsoft-saml-sso) and [Google Workspace SSO](/en/google-workspace-sso).
</Info>

## Preparation

You can set up the SSO connection yourself in your anny [admin area](https://app.anny.co/organization/settings/sso?o=) under SSO & Security. Besides anny admin rights, you need administrative access to your identity provider.

It is best to keep both systems open in two browser tabs, since you copy values back and forth between anny and your identity provider.

## Setup

<Steps>
  <Step title="Create the identity provider in anny">
    Go to the [SSO settings](https://app.anny.co/organization/settings/sso?o=), select "Add IDP" and then choose "Custom SAML2" as the provider. Enter a name, for example "Company login".
  </Step>

  <Step title="Enter the anny metadata in your identity provider">
    Under "1. Copy application metadata", click "Show details". There you find the values your identity provider needs for anny as a service provider. Create a new SAML application in your identity provider and enter the values.
  </Step>

  <Step title="Enter your identity provider's metadata in anny">
    Switch back to anny and fill in the form under "2. Insert SAML metadata". The easiest option is "URL": there you enter the metadata URL of your identity provider and anny reads all values automatically. Alternatively, select "Manually" and enter the values one by one.
  </Step>

  <Step title="Enable signing of the SAML response">
    Make sure the SAML response is signed in your identity provider. For security reasons, anny only accepts signed responses.
  </Step>

  <Step title="Test the connection and activate it">
    Save the configuration and test the connection via "Test Connection". Once the login works, activate the identity provider via the three dots > Activate.
  </Step>
</Steps>

## Values your identity provider needs from anny

You find all values in the SSO settings under "1. Copy application metadata" > "Show details".

| Value            | Description                                                                                                                                                  |
| ---------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| **Metadata URL** | Contains all details bundled together. Many identity providers can import this URL directly.                                                                 |
| **Entity ID**    | The unique identifier of anny as a service provider. Sometimes also called "Audience" or "Audience URI".                                                     |
| **ACS URL**      | The address your identity provider sends the SAML response to. Sometimes also called "Assertion Consumer Service URL", "Reply URL", or "Single Sign-On URL". |
| **Certificate**  | Only needed if your identity provider should verify the signature of the login request (SAMLRequest).                                                        |

The URLs follow this pattern, where `{id}` is the ID of your organization:

Metadata URL: [**https://auth.anny.co/tenant/\{id}/saml/metadata**](https://auth.anny.co/tenant/\{id}/saml/metadata)

Certificate URL: [**https://auth.anny.co/tenant/\{id}/saml/cert**](https://auth.anny.co/tenant/\{id}/saml/cert)

## Values anny needs from your identity provider

If you use the "Manually" option, you enter the following values:

| Field in anny        | Description                                                                                                     |
| -------------------- | --------------------------------------------------------------------------------------------------------------- |
| **Entity ID**        | The unique identifier of your identity provider. Sometimes also called "Issuer" or "IdP Entity ID".             |
| **X509 certificate** | The signing certificate of your identity provider. Copy the complete content including the BEGIN and END lines. |
| **SSO URL**          | The address anny sends the login request to. Sometimes also called "Single Sign-On Service URL" or "Login URL". |
| **SLO URL**          | The address for logout. Sometimes also called "Single Logout Service URL".                                      |

## Attributes

For the login, anny needs at least an email address as well as first and last name. How to map your identity provider's attributes to anny and derive automatic community assignments from them is described in the [Attribute Mapping](/en/attribute-mapping) article.

<Warning>
  **Important:** anny only accepts signed SAML responses. If signing is not enabled in your identity provider, the login fails with the message "Signature missing".
</Warning>

## Common naming per identity provider

The terms differ between systems. This overview helps you match them.

<AccordionGroup>
  <Accordion title="Okta">
    Under *Applications* > *Create App Integration*, create a new application with "SAML 2.0". Enter the anny ACS URL under "Single sign on URL" and the anny entity ID under "Audience URI (SP Entity ID)". You then find your identity provider's metadata URL under "Identity Provider metadata".
  </Accordion>

  <Accordion title="Auth0">
    Enable the "SAML2 Web App" addon in your Auth0 application. Enter the anny ACS URL as the "Application Callback URL" and the anny entity ID in the "audience" field of the settings. You find the metadata URL in the "Usage" tab.
  </Accordion>

  <Accordion title="Keycloak">
    Create a new client with the type "SAML". Enter the anny entity ID as the "Client ID" and the anny ACS URL as the "Valid Redirect URI" as well as under "Master SAML Processing URL". Make sure "Sign Documents" is enabled. The metadata URL is `https://<your-keycloak>/realms/<realm>/protocol/saml/descriptor`.
  </Accordion>

  <Accordion title="Shibboleth and other federations">
    If your identity provider is part of a federation such as DFN-AAI or eduGAIN, use the [Federated SAML](/en/federated-saml) article instead of this guide. There you select your identity provider directly from the federation.
  </Accordion>
</AccordionGroup>

## After the setup

* Via the three dots, you can generate a wayfless link. With it, your users land directly in the login of your identity provider.
* With [attribute mapping](/en/attribute-mapping), you automatically assign users to communities.
* With [SCIM](/en/scim-user-provisioning), you create user accounts automatically without the people having to log in first.

Here you find an explanation of potential error messages: [SSO Troubleshooting](/en/sso-overview)