> For the complete documentation index, see [llms.txt](https://docs.docontrol.io/docontrol-user-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.docontrol.io/docontrol-user-guide/system-management/settings/single-sign-on-sso/generic-saml.md).

# Generic SAML

Users can log into DoControl using any identity provider (IdP) that supports SAML 2.0. 

SAML (Security Assertion Markup Language) 2.0 is an open standard that allows DoControl to connect to your organization's IdP, such as Okta or Entra ID.

SAML makes single sign-on (SSO) possible by authenticating a user once and then communicating that authentication to DoControl.

{% hint style="success" %}
After you configure your generic SAML, for example [JumpCloud](/docontrol-user-guide/system-management/settings/single-sign-on-sso/jumpcloud-sso.md), you can use your JumpCloud credentials to login via DoControl. Note that DoControl supports only service provider initiated SSO via DoControl's login page.
{% endhint %}

To set up single sign-on (SSO) in DoControl using a generic SAML, you need to:

* [Create a SAML 2.0 application in your IdP](#create-a-saml-2.0-application-in-your-idp)
* [Add a new generic SAML connection](#add-a-new-generic-saml-connection)
* [Test your connection](#test-your-connection)
* [Enforce login with SSO](#enforce-login-with-sso)

{% hint style="info" %}
Note that DoControl cannot be responsible for the accuracy of content depicted in screenshots of third-party providers.
{% endhint %}

## Prerequisites

The minimum requirements for identity providers (IdPs) that can be integrated with DoControl:

* IdP must conform to SAML 2.0. 
* IdP must provide metadata information (XML or URL) 

## Create a SAML 2.0 application in your IdP

By using the SAML 2.0 protocol, your IdP can verify a user’s identity when they log into DoControl. In this way, you enable single sign-on so users can log in with their corporate credentials.

#### To create a SAML 2.0 application in your identity provider: 

1. In the identity provider, create a new integration with the type set as SAML 2.0. 
2. For the Identifier (Entity ID/ Client ID), enter this value:\
   `urn:amazon:cognito:sp:us-east-1_Tx9u9xQ4d`
3. For the Reply URL (Assertion Consumer Service URL), enter this callback URL:\
   `https://docontrol-main.auth.us-east-1.amazoncognito.com/saml2/idpresponse`
4. For the sign-on URL (optional), enter this value:\
   `https://app.docontrol.io/login`
5. For the logout URL (optional), enter this value:\
   `https://app.docontrol.io/logout`
6. For each SAML attribute, provide the relevant URI attribute value:

   * **Email address** - <http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress>
   * **Given name** - <http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname>
   * **Surname** - <http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname><br>

   Make sure that any SAML attribute configured in the SAML integration is also sent from the identity provider.<br>
7. In your SAML, assign and add the relevant people or groups to connect DoControl with your identity provider.
8. In DoControl, make sure that all listed people and groups exist in DoControl as [team members.](/docontrol-user-guide/integrations/teams.md)&#x20;

{% hint style="info" %}

* Mapping attribute names can vary between providers
* User names are case-sensitive
  {% endhint %}

## Add a new generic SAML connection

In DoControl, you can set up single sign on (SSO) with the generic SAML 2.0 connection that you configured in the [previous step](#create-a-saml-2.0-application-in-your-identity-provider). This means users will log into DoControl using their identity provider credentials.

1. In DoControl, go to **Settings > Admin > SSO > Generic SAML.**<br>

   <div align="left"><figure><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FAWxZ1cZXdEpn3hjvjcVW%2FSSO%20sign-on.png?alt=media&amp;token=7da36947-df4a-4aa8-8224-3b93580de63c" alt=""><figcaption></figcaption></figure></div>
2. Click **Add new**.
3. Give a meaningful name for the provider name, which is displayed to DoControl users when logging in with your IdP.
4. Select the format for providing metadata information:&#x20;
   * **URL** - Enter the URL in the required format\
     For **ForgeRock**, paste the following URL:\
     `https://{{ForgeRock-DOMAIN}}/openam/saml2/jsp/exportmetadata.jsp?entityid=docontrol&realm=/DoControl`&#x20;
   * **XML** - Use the endpoint to download and generate an XML file. Paste the metadata XML text.\
     For **OneLogin**, paste the **Issuer URL** file content into the XML field.<br>
5. Click **Save**.

## Test your connection

You need to test that the SAML connection you defined actually works in DoControl. Once the connection works, you can [enforce users](#enforce-login-with-sso) to always login with your selected SSO.

1. Logout from DoControl.
2. In DoControl, click **Login with SSO.**<br>

   <div align="left"><figure><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2Fic4XiOCwHWNOEVnxP1sI%2Flogin.png?alt=media&amp;token=70d8828c-754e-43b4-939d-4dac6d49395f" alt="" width="386"><figcaption></figcaption></figure></div>
3. Enter your email, and click **Login**.

   <div align="left"><figure><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2F8mEzxSXnnCSwy5aH7SKm%2Femail%20login.png?alt=media&amp;token=1cea8901-6307-4176-bcb8-d9f1a94c57b1" alt="" width="391"><figcaption></figcaption></figure></div>
4. Select your SSO provider.

   <div align="left"><figure><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2F6ZhW2Py5HkNAVU5IdKuj%2FSelect%20provider%20SAML.png?alt=media&amp;token=6bbd10c6-0a9e-4851-b79b-1c800facfdb7" alt=""><figcaption></figcaption></figure></div>

## Enforce login with SSO

After you [test](#test-your-connection) that the SAML connection you defined actually works in DoControl, you can enforce it to meet identity governance and administration requirements.&#x20;

Once enforced, users are obligated to login to DoControl with the selected SSO.

1. In DoControl, go to **Settings > Admin > SSO > Generic SAML.**
2. Next to the SSO name, toggle **Enforce.**<br>

   <div align="left"><figure><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FIqJR3yFaVOAIQdJhbWVT%2Fenforce.png?alt=media&amp;token=d819d53e-134a-4ce6-91db-32922838036a" alt="" width="563"><figcaption></figcaption></figure></div>

{% hint style="success" %}
Users can now leverage identity provider credentials when logging into DoControl.
{% endhint %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.docontrol.io/docontrol-user-guide/system-management/settings/single-sign-on-sso/generic-saml.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.