> For the complete documentation index, see [llms.txt](https://docs.currents.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.currents.dev/dashboard/administration/sso-saml2.0/saml2.0-configuration.md).

# SAML2.0 Configuration

Enabling SSO for Currents - manual SAML2.0 configuration

Define the following SAML2.0 configuration on your Identity Provider:

* Call-back URL / ACS URL: `https://auth.currents.dev/saml2/idpresponse`
* Audience / Entity ID: `urn:amazon:cognito:sp:us-east-1_Z9TVEnj0k`
* `NameID` format (`nameIdentifierFormat`)
  * must be `urn:oasis:names:tc:SAML:2.0:nameid-format:persistent`
  * limited to 128 characters
  * **the value must be the user's email address in lowercase** - do not use an opaque persistent identifier (e.g., Azure AD's default object ID). Even though the format is `persistent`, the actual value must be the email.

### SAML Attribute Mapping

<table><thead><tr><th width="155.5">IdP Attribute</th><th align="right">SAML Response Attribute</th></tr></thead><tbody><tr><td>Email</td><td align="right">http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress</td></tr><tr><td>Full Name</td><td align="right">http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name</td></tr><tr><td>Username (usually Email)</td><td align="right">http://schemas.xmlsoap.org/ws/2005/05/identity/claims/identifier</td></tr></tbody></table>

* Prefer sending `Email` in lowercase, to ensure correct integration
* **The `identifier` attribute must contain the exact same value as `NameID`** - both must be the user's lowercase email address. A mismatch (e.g., `NameID` using an opaque ID while `identifier` uses the email) will cause authentication failures.
* Metadata XML must have `HTTP-POST` and `HTTP-Redirect` bindings, for example:

```xml
<md:SingleSignOnService
    Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
    Location="https://sso.jumpcloud.com/saml2/currents"
/>
<md:SingleSignOnService
    Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
    Location="https://sso.jumpcloud.com/saml2/currents"
/>
```

***

### Sharing SAML Configuration

Once the IdP is configured, submit it from the dashboard - see [Setting Up SSO](/dashboard/administration/sso-saml2.0/setting-up-sso.md). The wizard asks for these, plus the role new users get and an optional SCIM provisioning request:

* IdP Metadata or publicly available metadata document endpoint URL
* Domains list that your organization members will use to access the dashboard (for example user@**example.com**)

{% hint style="info" %}
Send `NameID` and `Email` in lowercase. Some IdPs, including Entra ID, send mixed-case emails by default. If yours does, we'll check a mixed-case user with you while we test the setup.

See [Troubleshooting SSO](/dashboard/administration/sso-saml2.0/troubleshooting-sso.md).
{% endhint %}

***

### Common Errors

{% hint style="info" %}
**`Invalid ProviderName/Username combination`**

This error typically occurs when:

* `NameID` contains an opaque identifier instead of the user's email address
* `NameID` and `identifier` attribute values do not match exactly
* Email values contain uppercase characters

Ensure both `NameID` and the `identifier` claim are set to the user's lowercase email address. See [Troubleshooting SSO](/dashboard/administration/sso-saml2.0/troubleshooting-sso.md) for detailed resolution steps.
{% endhint %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.currents.dev/dashboard/administration/sso-saml2.0/saml2.0-configuration.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.