# Setup SAML Identity Provider SSO

URL: https://select.dev/docs/reference/using-select/access-management/saml-sso
Index of all SELECT docs: https://select.dev/docs/llms.txt

> Learn how to setup a SAML identity provider SSO connection with SELECT.

## Connecting SAML Identity Provider

> [!NOTE]
> SELECT's SAML integration is an add-on feature. Please contact SELECT to determine your eligibility and receive a quote.

To manage access and authentication to SELECT using a SAML identity provider (IdP), please follow the steps below.

### Step 1: Register SELECT with IdP

Navigate to **Settings** → **Authentication**. Click Add SSO and then select SAML in the dropdown.

![Add SAML IdP flow](https://cdn.sanity.io/images/wn0ylp2c/production/b3bd8cce8893339765e07bc35ac7c132e011fe24-3024x1963.png)

The SAML Connection Details section will display the values ACS URL and entity ID. Please enter both at your IdP. The specific methods for doing so will vary, so please see your IdP's documentation if you need additional assistance.

![Add SAML connection details](https://cdn.sanity.io/images/wn0ylp2c/production/7e75e21a6f145a940677523a6010be43bc841752-3024x1964.png)

### Step 2: Add SSO Connection in SELECT

Once your IdP is configured, complete the form using the following values obtained from the SAML IdP:

- Sign in URL
- X.509 signing certificate (in either PEM or CER format). You will need to convert the contents of the file to Base64 before entering it, which can be done using an [online tool](https://www.base64encode.org/) or with the following Bash command: `cat signing-cert.crt | base64`

![Add SAML connection form filled](https://cdn.sanity.io/images/wn0ylp2c/production/d6073cc758b491655071ce8552be348c08e8d56b-3024x1964.png)

Click Add SSO to complete. You should then see your newly created SSO connection under Authentication Methods.

![Added SAML IdP connection](https://cdn.sanity.io/images/wn0ylp2c/production/8fc262487eeb5fda25bf5929a23506c46cb54350-3024x1964.png)

> [!NOTE]
> Creating an SSO connection will automatically disable manual user invitations. 

### Step 3: Enable login from your Identity Provider portal

In the **SAML Connection Details** section, copy the **IdP-Initiated Login URL** and add it to your identity provider as a bookmark or linked app - for example, a Bookmark App in Okta or a linked app in Entra ID. Do not add it as a SAML application.

![](https://cdn.sanity.io/images/wn0ylp2c/production/0a3b521597d71fcaac2598cb69973f3226f1f6bc-3024x1964.png)

Note that SELECT rejects identity-provider-initiated assertions as a security best practice, as the app cannot verify logins it did not initiate, and accepting unsolicited sign-ins would expose users to login CSRF (an attacker forcing a user into a session). Using the provided login URL ensures a SELECT-initiated login flow that is verified.