SAML2.0 Configuration

Enabling SSO for Currents - manual SAML2.0 configuration

Define the following SAML2.0 configuration on your Identity Provider:

• Call-back URL / ACS URL: https://auth.currents.dev/saml2/idpresponse

• Audience / Entity ID: urn:amazon:cognito:sp:us-east-1_Z9TVEnj0k

• NameID format (nameIdentifierFormat)

  • must be urn:oasis:names:tc:SAML:2.0:nameid-format:persistent

  • limited to 128 characters

  • the value must be the user's email address in lowercase — do not use an opaque persistent identifier (e.g., Azure AD's default object ID). Even though the format is persistent, the actual value must be the email.

SAML Attribute Mapping

IdP Attribute	SAML Response Attribute
Email	http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress
Full Name	http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Username (usually Email)	http://schemas.xmlsoap.org/ws/2005/05/identity/claims/identifier

• Prefer sending Email in lowercase, to ensure correct integration

• The identifier attribute must contain the exact same value as NameID — both must be the user's lowercase email address. A mismatch (e.g., NameID using an opaque ID while identifier uses the email) will cause authentication failures.

• Metadata XML must have HTTP-POST and HTTP-Redirect bindings, for example:

<md:SingleSignOnService
    Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
    Location="https://sso.jumpcloud.com/saml2/currents"
/>
<md:SingleSignOnService
    Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
    Location="https://sso.jumpcloud.com/saml2/currents"
/>

---

Sharing SAML Configuration

Once you configured the IdP, contact Currents support via in-app chat or email, and provide the following details:

• IdP Metadata or publicly available metadata document endpoint URL

• Domains list that your organization members will use to access the dashboard (for example [e-mail])

Send NameID and Email in lowercase. Some IdPs, including Entra ID, send mixed-case emails by default. If yours does, we'll check a mixed-case user with you while we test the setup.

See Troubleshooting SSO.

---

Common Errors

Invalid ProviderName/Username combination

This error typically occurs when:

• NameID contains an opaque identifier instead of the user's email address

• NameID and identifier attribute values do not match exactly

• Email values contain uppercase characters

Ensure both NameID and the identifier claim are set to the user's lowercase email address. See Troubleshooting SSO for detailed resolution steps.