> ## Documentation Index > Fetch the complete documentation index at: https://docs.iru.com/llms.txt > Use this file to discover all available pages before exploring further. # Single Sign-On with OneLogin (SAML) > Configure SAML-based SSO between OneLogin and Iru Endpoint. Create the SAML application in OneLogin and map user attributes for admin authentication. ### About OneLogin SAML Integration Single Sign-On with OneLogin (SAML) in Iru Endpoint lets you set up SAML-based SSO integration with OneLogin for users accessing Iru Endpoint through their OneLogin credentials. #### How It Works OneLogin SAML integration lets users authenticate to Iru Endpoint using their existing OneLogin credentials. Once configured, users can access Iru Endpoint through a single sign-on experience. The integration works by establishing a trusted relationship between Iru Endpoint and OneLogin, where OneLogin acts as the identity provider (IdP) and Iru Endpoint acts as the service provider (SP). When users attempt to access Iru Endpoint, they're redirected to OneLogin for authentication, and upon successful login, OneLogin sends a SAML assertion back to Iru Endpoint confirming the user's identity. SSO can be used for [Iru Endpoint Web App](/en/endpoint/getting-started/foundation/admins-and-access) sign-in and for [Require Authentication with Automated Device Enrollment](/en/endpoint/enrollment/configure-require-authentication-for-enrollment). ### Setting Up the SAML Connection You'll need to complete the initial setup in Iru Endpoint first to get the configuration information required for OneLogin. After copying the Entity ID and ACS URL, switch to the [**OneLogin Configuration**](#onelogin-configuration) tab and continue with [**Configuring OneLogin Application**](#configuring-onelogin-application). In Iru Endpoint, in the sidebar, click the [**Account Menu Button**](/en/iru/platform-overview/account-menu). Click the **Access** option in the menu. Screenshot of the account menu with Access option highlighted Select the **Admin and authentication** tab (selected by default) and scroll down to **Authentication methods**. Click **+ Authentication method**. Enter a display name for the SSO Connection. Select **SAML** for the Authentication method. Click **Create**. Click **Configuration information** if that section is not already expanded. Copy the **Service provider entity ID** into a text document for later use. You'll need this for the OneLogin configuration. Copy the **Assertion consumer service (ACS) URL** into a text document for later use. You'll need this for the OneLogin configuration. Configuration Information, Service provider entity ID, and Assertion consumer service (ACS) URL Keep the Iru Endpoint configuration modal open, then switch to the [**OneLogin Configuration**](#onelogin-configuration) tab to continue with [**Configuring OneLogin Application**](#configuring-onelogin-application). ### Configuring Iru Endpoint SAML Connection After completing the OneLogin configuration, return here to finish [**Configuring Iru Endpoint SAML Connection**](#configuring-iru-endpoint-saml-connection) in Iru Endpoint. You'll need the Single Sign-on URL, IdP Entity ID, and certificate from OneLogin. Go back to the Custom SAML modal in Iru Endpoint. Set **IdP attribute** to **Subject**. Leave **Attribute name** blank. Set **User attribute** to **User Principal Name (UPN)**. Paste the **Issuer URL** you copied from OneLogin into the **IdP Entity ID** field. Paste the **SAML 2.0 Endpoint (HTTP)** URL you copied from OneLogin into the **IdP Single Sign-on URL** field. Upload the OneLogin certificate you downloaded earlier. Iru Endpoint upload OneLogin certificate Set the **Protocol Binding** to **HTTP-POST**. Ensure that the **Request Algorithm** is set to **RSA-SHA256**. Ensure that **Sign Request Algorithm Digest** is set to **SHA256**. Ensure that **Sign Request** is enabled. Set the **Response Signature Verification** to **Assertion**. Leave the **Destination** field blank. Set **Allowed Signature Algorithm** to **RSA-SHA256**. Set **Allowed Digest Algorithm** to **SHA256**. Click **Save**. Iru Endpoint Save for SAML configuration ### Allow for Tenant Authentication Once you have configured the SAML connection in Iru Endpoint and your identity provider, you can allow its use for tenant authentication. For step-by-step instructions, please refer to the **Allowing Tenant Authentication and Managing Connections** section in our [Single Sign-on support article](/en/endpoint/integrations/single-sign-on-integrations/single-sign-on). ### Limit Authentication to Domain When configuring the SAML connection, you can optionally limit authentication to one or more domains. This can be useful when the SSO connection could authenticate to multiple domains. You can limit the authentication to your Iru tenant to a subset of the available domains. ### Enforcing Single Sign-On Once you have configured at least one Single Sign-on connection, you can disable Passkey, Google Social, and Microsoft Social connections. Disabling these connections will disable the ability for Iru Endpoint administrators in your tenant to authenticate via those methods. Please refer to our [Single Sign-on support article](/en/endpoint/integrations/single-sign-on-integrations/single-sign-on) for step-by-step instructions. ### Testing the Integration Add a test user to the **Admin Team** in Iru Endpoint by clicking **New User**. Fill in all of the corresponding user information. This user must exist in OneLogin and must be assigned to the Iru Endpoint SSO app in your OneLogin tenant. Click **Submit**. Once the invite is submitted, close the Invite User window. Refresh the Access page in Iru Endpoint. You should see the user you added. Go to the user's email to accept the invite and log in with the new SAML SSO connection. Before starting the OneLogin configuration, complete [**Setting Up the SAML Connection**](#setting-up-the-saml-connection) in the [**Iru Web App Configuration**](#iru-web-app-configuration) tab to get the Service Provider Entity ID and ACS URL. You'll need these values to configure the OneLogin application. ### Configuring OneLogin Application In OneLogin, create a new app using the **Add SAML Custom Connector (Advanced)** app. Navigate to: ``` https://{YourSubdomain}.onelogin.com/apps/new/110016 ``` Set the **name**. Set whether the app should be visible in the portal. Set the **icons** for the app. Set the **Description**. Click **Save**. OneLogin app name portal visibility icons description Save Click the **Configuration** tab. Paste the **Iru Entity ID** (Service provider entity ID) into the **Audience (EntityID)** field. Paste the **Iru ACS URL** (Assertion consumer service URL) into the **Recipient**, **ACS (Consumer) URL Validator**, and **ACS (Consumer) URL** fields. OneLogin Configuration Audience Entity ID Recipient ACS URL Set the **SAML initiator** to **OneLogin**. Set the **SAML nameID format** to **Email**. Set the **SAML issuer type** to **Generic**. Set the **SAML signature element** to **Assertion**. OneLogin SAML initiator nameID format issuer signature Assertion Click the **Parameters** tab. Ensure that the **Name ID** value is set to **Email**. OneLogin Parameters Name ID set to Email Click the **SSO** tab. Set the **SAML Signature Algorithm** to **SHA-256**. Copy the **Issuer URL** and save it. You will paste this into the **IdP Entity ID** field in Iru Endpoint. Copy the **SAML 2.0 Endpoint (HTTP)** URL and save it. You will use this for the **IdP Single Sign-on URL** in the Iru configuration. Click **Save**. OneLogin SSO tab Issuer URL SAML 2.0 Endpoint Save Click the **SSO** tab. Click **View Details**. OneLogin SSO tab View Details for certificate Click **Download**. OneLogin Download certificate After completing the OneLogin Configuration, return to the **Iru Web App Configuration** tab to finish setting up the SAML connection using the SSO URL, Entity ID, and certificate you copied from OneLogin.