5e074956ee8ba1fea26e30d28c190495?s=300 avatar

5e074956ee8ba1fea26e30d28c190495?s=300

Full stack developer creating content at Auth0. I love taking a deep dive into hard-to-understand concepts and creating content that makes them easier to grasp. In my free time you can usually find me reading, hanging out with my dogs, or curling in the squat rack.

Former Developer Content Manager

Holly Guevara

Learn what SAML is and how to set up a SAML identity provider

In this article, you'll learn what SAML is, how it works, and how you can configure a SAML identity provider using Auth0.

<AmpContent>
<amp-youtube
    data-videoid="eaIGGO_NQJA"
    layout="responsive"
    width="480" height="270">
</amp-youtube>
</AmpContent>
<NonAmpContent>
<div class='embed-container' style="position: relative; padding-bottom: 56.25%; height: 0; overflow: hidden; max-width: 100%;margin-bottom:40px;"><iframe style="position: absolute; top: 0; left: 0; width: 100%; height: 100%;" src='https://www.youtube.com/embed/eaIGGO_NQJA' frameborder='0' allowfullscreen></iframe></div>
</NonAmpContent>

## What is SAML

Before jumping into the technical jargon, let's look at an example that demonstrates _what_ SAML is and _why_ it's beneficial.

You just started working at a new company, Wizova. They've given you a work email address and access to a dashboard. Once you sign in to this dashboard, you're presented with the icons of all of the external services the company uses: Salesforce, Expensify, Jira, AWS, and more.

You click on the Salesforce icon, some magic happens in the background, and before you know it, you're signed into Salesforce without ever entering any credentials.

As you might have guessed, the "magic" was actually SAML in action. So what's going on here?

SAML stands for Security Assertion Markup Language. It is an XML-based open-standard for transferring identity data between two parties: an identity provider (IdP) and a service provider (SP).

Identity Provider — Performs authentication and passes the user's identity and authorization level to the service provider.

Service Provider — Trusts the identity provider and authorizes the given user to access the requested resource.

In the scenario above, the identity provider would be the IdP that Wizova uses, Auth0. The service provider would be [Salesforce](https://www.salesforce.com/blog/sales-management-dashboards/). The Wizova employee signs into the Wizova dashboard with Auth0. They click on the Salesforce icon, and Salesforce recognizes that the user wants to log in via SAML. Salesforce sends the employee back to Auth0 with a SAML Request that asks Auth0 to authenticate the user. Since the employee has already authenticated with Auth0, Auth0 verifies the session and sends the user back to Salesforce with a SAML Response. Salesforce checks this response, and if it looks good, the employee is granted access.

## Benefits of SAML Authentication

- **Improved User Experience** — Users only need to sign in one time to access multiple service providers. This allows for a faster authentication process and less expectation of the user to remember multiple login credentials for every application. In the example above, that user could have clicked on any of the other icons in their dashboard and been promptly logged in without ever having to enter more credentials.

- **Increased Security** — SAML provides a single point of authentication, which happens at a secure identity provider. Then, SAML transfers the identity information to the service providers. This form of authentication ensures that credentials are only sent to the IdP directly.

- **Loose Coupling of Directories** — SAML doesn't require user information to be maintained and synchronized between directories.

- **Ability to Alter, Audit, or Revoke Access Centrally** — Because SAML doesn’t require synchronization between directories for each application, it isn’t necessary to notify each service provider to revoke or change access levels, meaning that access can be revoked quickly if necessary for a single service or across an enterprise. Similarly, auditing who has access to which services is easy with SAML because authentication logs are centralized.

- **Fewer Password Reset Requests** — Users only need to remember one set of credentials, so IT can focus on supporting your workforce without having to respond to numerous password reset requests.

- **Scalability** — Adding new users, applications, or services is straightforward, minimizing the overhead necessary for your organization to grow.

- **Reduced Costs for Service Providers** — With SAML, you don't have to maintain account information across multiple services. The identity provider bears this burden.

![how saml works separator 1](https://images.ctfassets.net/23aumh6u8s0i/21h3c71TFRMhR4nbU7AIkY/1c70c92d02ad10a334ab90144721d809/how-saml-works-1)

## How Does SAML Authentication Work?

Now that you've seen the high-level overview of how SAML authentication works, let's look at some of the technical details to see how everything is accomplished.

SAML single sign-on authentication typically involves a service provider and an identity provider. The process flow usually involves the _trust establishment_ and _authentication flow_ stages.

Consider this example:

- Our identity provider is **Auth0**
- Our service provider is a fictional service, **Zagadat**

> **Note**: The identity provider could be any identity management platform. 

Now, a user is trying to gain access to **Zagadat** using SAML authentication.

Let's break down how the different components of the diagram interact with each other to make authentication with SAML possible. The following diagram gives you a high-level overview of how SAML works:

![Process flow diagram](https://images.ctfassets.net/23aumh6u8s0i/3R8llxfSq6UuhWdagCaJjZ/1b2fd3d2e3645d35697b2016e25d3dd3/01_saml_flow.png)

Here is a description of each numbered step in the diagram:

1. The user tries to log in to Zagadat from a browser.
2. Zagadat responds by generating a SAML request. ![Typical SAML Authentication request](https://images.ctfassets.net/23aumh6u8s0i/2q3DgHFxiJCn8OB57rIaZ3/9b6da4bcbab9987d88dedc1bd42dbb8d/samlrequestzg)
3. The browser redirects the user to a [Single Sign-On (SSO) URL](https://auth0.com/docs/authenticate/single-sign-on), **Auth0**.
4. **Auth0** parses the SAML request and authenticates the user. This could be with username and password or even social login. If the user is already authenticated on Auth0, this step will be skipped. Once the user is authenticated, Auth0 generates a SAML response. ![Typical SAML Authentication response](https://images.ctfassets.net/23aumh6u8s0i/60UOe2pqoOcYFJqeGMzfA7/e0dd3cdd9a12b682fa648f27869b9588/SAMLResponse)
5. **Auth0** returns the encoded SAML response to the browser.
6. The browser sends the SAML response to **Zagadat** for verification.
7. If the verification is successful, the user will be logged in to **Zagadat** and granted access to the resources that they are authorized to view/modify.

Note the attributes that are highlighted in the SAML request and response. Here's a glossary of these parameters:

- **ID**: Newly generated number for identification
- **IssueInstant**: Timestamp to indicate the time it was generated
- **AssertionConsumerServiceURL**: The SAML URL interface of the service provider, where the Identity provider sends the authentication token.
- **Issuer**: The EntityID (unique identifier) of the service provider
- **InResponseTo**: The ID of the SAML request that this response belongs to
- **Recipient**: The EntityID (unique identifier) of the service provider

## SAML Authentication with Auth0

When it comes to implementing SAML, Auth0 is extremely extensible and able to handle several scenarios:

- Auth0 as the [identity provider](https://auth0.com/docs/protocols/saml/saml-configuration/auth0-as-identity-provider)
- Auth0 as the [service provider](https://auth0.com/docs/protocols/saml/saml-configuration/auth0-as-service-provider)
- Auth0 as the [identity and service provider](https://auth0.com/docs/protocols/saml/saml-configuration/auth0-as-identity-and-service-provider)

For this example, you'll learn how to implement SAML authentication using Auth0 as the identity provider.

<include src="TweetQuote" quoteText="When implementing SAML, Auth0 can serve as the identity provider, service provider, or both!"/>

### Prerequisites

- **An [Auth0](https://auth0.com/) account** &mdash; If you don't already have one, you can [sign up for a free account here](https://a0.to/blog_signup).

- **An account with a service provider that supports SAML** &mdash; Generally, most service providers require you to have a business account or some paid plan to configure SAML.

<include src="SignupCTA" text="Try out the most powerful authentication platform for free." linkText="Get started →" />

The following image shows a list of the service providers Auth0 supports out-of-the-box, but you also have the option of [**configuring a custom service provider**](https://auth0.com/docs/protocols/saml/saml-configuration/auth0-as-identity-provider#manually-configure-a-sso-integration) in the dashboard.

![configuring a custom service provider](https://images.ctfassets.net/23aumh6u8s0i/1oKJfsjlupfnWeTZ013s31/2ab99a5fd2bcc7be780b530d6fdecbb2/03_saml_flow.png)

### Configure the service provider

This tutorial will use [Zendesk](https://zendesk.com/) as the service provider, but you can follow along with any SP of your choice.

To configure your chosen service provider, run through the following steps in your [Auth0 dashboard](https://manage.auth0.com/):

1. Click on SSO Integrations in the sidebar under **account > security**
2. Click on the **blue** button in the top right corner, Create SSO Integration
3. Select **SAML**
4. Enter the name and/or any identifying information required and press Save ![Configure the service provider](https://images.ctfassets.net/23aumh6u8s0i/3x0opMZ7nl5I5UYazGT3dk/c57eae72f111740c979170a80c065cf9/04_saml_flow.png)
5. Follow the instructions under Tutorial for your specific service provider

> **Note**: This step will require you to input some values on the service provider's side.

Here's what that looks like for **Zendesk**.

First, go into the **Admin Center** in the _Zendesk dashboard_ and click on Security. Next, click on SSO, and you'll find the SAML configuration settings. This is where you'll paste in those values from the Auth0 dashboard.

![Zendesk SAML setup](https://images.ctfassets.net/23aumh6u8s0i/3ghqY6FLvOLKAJwUfFTMpD/7d3192482acdb9039642446a5d04a1e9/05_saml_flow.png)

![Auth0 Zendesk tutorial setup](https://images.ctfassets.net/23aumh6u8s0i/3hEM5UYnYgHZ98uzhtKfBm/3546f05a32fac11df4a380fae1e41d5c/06_saml_flow.png)

Once these values are copied over, the last step is to enable external authentication for the users that should be able to login with SAML. Zendesk allows you to enable this for end-users, staff users, or both.

![Zendesk Auth0 end-user external authentication](https://images.ctfassets.net/23aumh6u8s0i/1GSsL2KvJFBlG4nhfqT4s3/67b635d77b4fcbd31c33d39049181700/07_saml_flow.png)

### Test it out

Now that everything is set up on both ends, it's time to test it out! See the video below for a demonstration of what the final flow should look like.

<AmpContent>
<amp-video controls
    layout="responsive"
    width="480" height="270">
    <source src="https://cdn.auth0.com/blog/what-is-saml/zendesk-auth0-demo.mp4"
    type="video/webm" />
</amp-video>
</AmpContent>
<NonAmpContent>
<video controls="controls">
  <source type="video/mp4" src="https://cdn.auth0.com/blog/what-is-saml/zendesk-auth0-demo.mp4" />
</video>
</NonAmpContent>

As you can see, once you go to your Zendesk URL, you're redirected back to Auth0, the identity provider, to sign in. Once authenticated, Auth0 sends this information back to Zendesk. Zendesk verifies the response, determines it valid, and grants you access to your Zendesk dashboard.

> **Note**: You may have noticed that in the video, the user signed in with Google SSO. This can be enabled in the Auth0 dashboard. You'll see how to implement this in the next section.

If you go back to your Auth0 dashboard, you'll now see a record of the user that just signed in.

![Auth0 SAML Zendesk new user login](https://images.ctfassets.net/23aumh6u8s0i/75LHYuDkJSmqGqSFYcGo1c/0be08541c1f08ba6950e8f2568ba5191/08_saml_flow.png)

> **Note**: If you'd like to debug a SAML response, check out [https://samltool.io](https://samltool.io/). This tool can decode a SAML response and serves as a useful debugging resource.

### Enable SSO (optional)

Now that your service provider is set up with Auth0, your users can sign in using an email and password by default. A common use case, especially with SAML authentication, is to have users sign in using single sign-on (SSO) with a social provider.

Auth0 supports several [social identity providers](https://auth0.com/docs/connections/identity-providers-social) that you can enable with the click of a button.

In your dashboard, click on Connections > Social in the sidebar. Select the provider you'd like to use and fill in the details required for that provider.

> **Note**: Make sure you [use your own keys](https://auth0.com/docs/connections/social/devkeys) for the selected provider. You may use the default Auth0 developer keys for testing, but they should not be used in production.

![Auth0 social connections](https://images.ctfassets.net/23aumh6u8s0i/2UTEiyqothV4PS6Ia6F2gp/f2a7e2a5d73ffc09c815149ab3f4c52b/09_saml_flow.png)

Once you've selected the social connections you want to use, go back to the SP you configured under SSO Integrations. Select the SP, and under Connections, you should see the social connection you just created. Click on the switch to enable it, and now your users are ready to sign in with any of the connections listed.

> **Note**: Some SSO integrations are very easy, and simply require the user to enable them as described above; however, a few of the SSO options require additional steps that are specific to the social network. For example, Facebook requires the user to create an app on the Facebook Developers site, and requires some additional fields and steps like supplying an App ID. Some applications may require a review process. While a comprehensive guide to all of these processes is out of scope for this tutorial, each network typically publishes their own guide for configuring SSO. Facebook’s guide can be found here: [Enable single sign-on for your organization’s managed Meta accounts in Admin Center](https://www.facebook.com/help/624731485413747).

![Auth0 SAML SSO connections](https://images.ctfassets.net/23aumh6u8s0i/6NEsKC1MtjzRjkcw7Ur1vz/ab52ae9016b48836218f0ffcf3efef25/10_saml_flow.png)

## More Auth0 SAML Configurations

Auth0 is adaptable when it comes to SAML configuration. Here are some of the other ways you can configure Auth0:

- Configure [Auth0 as a Service Provider](https://auth0.com/docs/protocols/saml/saml-configuration/auth0-as-service-provider) in a SAML federation
- SAML Configurations for SSO Integrations such as Google Apps, Hosted Graphite, [Litmos](https://auth0.com/docs/protocols/saml/saml-apps/litmos), [Cisco Webex](https://auth0.com/docs/protocols/saml/saml-apps/cisco-webex), [Sprout Video](https://auth0.com/docs/protocols/saml/saml-apps/sprout-video), [FreshDesk](https://auth0.com/docs/protocols/saml/saml-apps/freshdesk), Tableau Server, [Datadog](https://auth0.com/docs/protocols/saml/saml-apps/datadog), and more
- Configure Auth0 to use other identity Providers such as [Okta](https://auth0.com/docs/protocols/saml/identity-providers/okta), [OneLogin](https://auth0.com/docs/protocols/saml/identity-providers/onelogin), [PingFederate 7](https://auth0.com/docs/protocols/saml/identity-providers/ping7), [SalesForce](https://auth0.com/docs/protocols/saml/identity-providers/salesforce), [SiteMinder](https://auth0.com/docs/protocols/saml/identity-providers/siteminder), and [SSOCircle](https://auth0.com/docs/protocols/saml/identity-providers/ssocircle)
- Configure Auth0 as both the [service provider and identity provider](https://auth0.com/docs/protocols/saml/saml-configuration/auth0-as-identity-and-service-provider)

![how saml works separator 3](https://images.ctfassets.net/23aumh6u8s0i/3JxeMOsMizQrSavWXxZ3Ud/84c3b1775f4de7ac78860dea7f9aae1b/how-saml-works-3)

## Conclusion

You have covered how SAML authentication works, the benefits SAML provides, and how to implement SAML with Auth0 as the identity provider. If you have any questions, feel free to reach out below.


How SAML Authentication Works

df6c864847fba9687d962cb80b482764?size=200 avatar

df6c864847fba9687d962cb80b482764?size=200

Martin Gontovnikas, a.k.a Gonto, is a software engineer at heart who moved to the ‘dark side’ and became VP of Marketing at Auth0. He considers himself lucky to have found a way to combine his two passions and apply his engineering thinking model to marketing.<br/><br/> Gonto’s analytical thinking is a huge driver of his data-driven approach to marketing strategy and experimental design. He is based in the Bay area, and in his spare time, can be found eating gourmet food at the best new restaurants, visiting every local brewery he can find, or traveling the globe in search of new experiences.

Former SVP of Marketing and Growth at Auth0

Martin Gontovnikas

How the right fit can help you source more value from your IT team and secure critical data.



Many believe managed service providers (MSPs) [can’t add value](https://auth0.com/blog/managed-service-providers-myths/) to an IT team. Because MSPs are outsourced providers, some managers and engineers feel an MSP won’t truly have a stake in maintaining the quality of their systems and protecting their [sensitive user data](https://auth0.com/blog/the-6-billion-reason-your-business-needs-advanced-fraud-protection/).

While some risks do exist when shifting control to an external group, [strong evidence](https://auth0.com/blog/managed-service-providers-myths/) shows that outsourcing some or all of your IT operations can up your ability to deter cyberthreats and improve your company’s overall level of expertise. What’s more, although MSPs may charge a high upfront cost, they can reduce maintenance charges by [40%](https://www.cisco.com/c/dam/en_us/services/downloads/why-managed-services.pdf) over time, leading to enormous company savings over the long haul.

This article will help you decide when and how to bring in these experts. When you do, we'll show you specific ways they can make your IT operations more efficient so you can continue to grow your core business.

<include src="TweetQuote" quoteText="Learn to know when and how to bring in external expertise to make your IT operations more efficient!"/>

---

## What Is a Managed Service Provider?
Managed service providers are third-party technology experts, hired to help scale, monitor, and update various aspects of an organization's IT systems.

MSP roles have evolved over the past decade from simply maintaining legacy systems to taking responsibility for repairs and patches and delivering new software, cloud services, and specific expertise, such as data security services. Top full-service MSPs like Accenture, Cognizant, and IBM have teams of experts, dedicated to remotely managing their customers’ entire IT infrastructure. These and other MSPs can allow companies to quickly expand by offering to host operations at a more robust and powerful external data center. By shouldering the majority of routine maintenance work, MSPs allow IT teams to focus on vital tasks instead of using up valuable resources to keep systems from crashing.

MSPs can also help a company stay up-to-date with the latest tools and emerging trends, such as how to efficiently transition to the cloud and access [energy-saving technologies](https://www.energy.gov/eere/femp/energy-efficiency-data-centers). Finally, they can secure organizations against [data breaches](https://www.ibm.com/security/data-breach), which have the potential to significantly set a company back financially and damage its reputation among customers.

## How a Managed Service Provider Can Improve Your IT Operations
A managed service provider can help your team in several specific ways. Whether it's a specialized MSP (e.g., offering only cloud services) or an all-inclusive provider, the decision to hire an MSP and the subsequent management of this external provider will bring some key changes and benefits to your team.

### Source More Value From Your IT Team
Hiring an MSP can propel you to streamline your workflow and dedicate more manpower to mission-critical tasks. To make sure your [outsourcing](http://www.rethinkstaffing.com/smart-staffing-solutions/dont-lose-control-over-outsourcing-actively-managed-services) is efficient, start by parsing out which parts of your IT team's work you want to offload to the MSP and which you'd like to remain in-house. The following sequence will help you through the process:

1. Figure out what parts of your IT operations are causing the biggest drain — in both human and financial resources. Many find this to be maintenance. A report by Cisco finds that [65%](https://www.cisco.com/c/dam/en_us/services/downloads/why-managed-services.pdf) of IT budgets go towards just keeping systems powered up. For this reason you might consider outsourcing your network support so you don't spend all day reacting to and troubleshooting issues as they arise.
2. Decide on an MSP that will be the best match for your specific needs. Further criteria to consider are the vendor's size, its location, its ability and experience in offering hybrid solutions (if that's your team's trajectory), its data center capabilities, and price.
3. Once you've made your decision, a strong and effective MSP relationship requires the customer (you) to set clear expectations in a scope of services or [service level agreement](https://www.continuum.net/europe/blog/5-ways-to-strengthen-your-service-level-agreement-sla) (SLA). You can begin with a template SLA, then customize it based on your unique needs. For example, if you need coverage 24-hours a day, the SLA is the place to say so.

A wide range of organizations relies on SLAs when outsourcing their IT needs — from growing companies to government agencies to large non-profits and universities like UC Santa Cruz (below). The following is an overview of their SLA for data center services, 2017-2019, along with a breakout of their service scope:

![Service Level Agreement](https://images.ctfassets.net/23aumh6u8s0i/1nKypCC7AhUEYR9iT2U7TV/e92ca4386bc1589e9b20001ff6bcd784/1-sla)

> [Source.](https://its.ucsc.edu/sla/data-center.html)

In the Quicklinks bar on the right, it's clear that the full SLA digs into everything at a granular level — from the MSP's roles and responsibilities to hours of coverage and response times, pricing, reporting, and more. The services scope details the suite of services the provider will deliver, including authentication for the campus active directory, data backup and recovery, and hosting. It is comprehensive and reflects the time UC Santa Cruz put into understanding its own needs and clearly spelling them out for the external provider.

With a team of well-supported experts who are highly dedicated to customer service, managed service providers have the capacity to take an enormous load off of your IT team's shoulders and deliver value over and above your current state. Figuring out how to manage this relationship correctly can drive enormous efficiencies within your IT operations and secure a strong technology base for your company's overall expansion.

### Tighter Security
One of the _top reasons_ that companies hire MSPs is for their security expertise and ability to deter cyberthreats. [Identity and access management](https://auth0.com/blog/5-reasons-your-company-needs-identity-and-access-management/) is a key service that certain specialized MSPs like [Auth0](https://auth0.com) provide. This service is particularly critical for organizations undergoing a digital transformation.

For example, when shifting operations to the cloud — whether a public, private, or hybrid model — managing the number of permissions and access points to your most critical workstreams is essential. With a myriad of off-premises users now accessing this sensitive information, making sure you have a sharp eye on who, when, and how each of them is logging in will go a long way towards mitigating [user fraud](https://auth0.com/blog/the-6-billion-reason-your-business-needs-advanced-fraud-protection/).

A specialized managed service provider, Auth0 offers "Rules" to customize user access. [Rules](https://auth0.com/docs/rules/current) are JavaScript functions, which run on Auth0 servers to create a customized login process. Rules allow Auth0 customers to build robust checks and log user behavior throughout the system (i.e., password re-sets, date, locations, and devices of all log-ins).

Auth0's centralized dashboard allows you to manage your users in a variety of ways:

![Auth0 Dashboard](https://images.ctfassets.net/23aumh6u8s0i/3fA99OTS2zD1WkndaDa2YS/7513d96ccf2c71d9d391e408f9af5d30/2-auth0-dashboard)

For example, as you observe current and past activities, you could deny certain users access, request password re-sets, enable multi-factor authentication for enhanced security, and more. In 2017 the average cost of a data breach was [$3.62 million](https://www.ibm.com/security/data-breach), yet you can significantly decrease this risk by implementing better identity security measures. In 2017 Deloitte could have avoided its [massive data breach](https://www.theguardian.com/business/2017/sep/25/deloitte-hit-by-cyber-attack-revealing-clients-secret-emails) just by tracking its users more carefully.

<include src="TweetQuote" quoteText="In 2017 the average cost of a data breach was $3.62 million!"/>

These features are complex and time-consuming to build in-house; plus, they require continual updates to ensure they remain as tight as possible. Outsourcing identity and access management needs to a specialized MSP is a great strategy for securing your most sensitive information as you transition to a digital environment.

## Ready to Scale? Time to Call in an MSP
If your team is ready to move to the cloud and has market traction and funding for further growth, your IT needs will only escalate. Bringing in an MSP will help you to scale efficiently and sustainably. A managed service provider is perfect for a small or medium-sized business with limited in-house abilities yet the resources to pay up-front costs.

Over time you'll pay back a significant portion of this capital expenditure. (Studies show MSPs can save you [50% of your annual IT costs](https://www.webroot.com/shared/pdf/wp-transitioning_to_managed_services.pdf).) However, companies without the ability to pay the initial costs and/or that do not have a present need for enhanced security measures and organizational support (such as a startup beginning to pilot test a new app) might do without.

In addition, if you lack expertise in a certain critical area, such as securing user data, particularly as [GDPR and subsequent privacy regulations](https://auth0.com/blog/gdpr-effect/) loom, it's time to consider hiring outside support.

<include src="TweetQuote" quoteText="Bringing in an MSP where it matters will help you to scale efficiently and sustainably!"/>


"service-provider"