> ## Documentation Index
> Fetch the complete documentation index at: https://docs.alex.com/llms.txt
> Use this file to discover all available pages before exploring further.

# SAML

Integrating with SAML 2.0 allows your team members to access their accounts through your organization's identity provider (IdP). This streamlines the login process and centralizes user authentication, enhancing security and simplifying user management.

To begin the setup, you will need administrator access to your organization's identity provider and the ability to manage certificates.

### Information to Provide

To configure the SAML integration, you will need to provide the following details from your identity provider (IdP):

* **Sign In URL (SSO URL):** The endpoint where we will send SAML authentication requests.
* **X.509 Signing Certificate:** Your IdP's public certificate in PEM or CER format. It must use a SHA-256 digest algorithm.
* **Entity ID (Issuer):** The unique identifier for your IdP.
* **Sign Out URL (Optional):** The URL where users are redirected after logging out.

### Information for Your Identity Provider

You will need to configure your identity provider with the following information that we provide:

* **Assertion Consumer Service (ACS) URL:** The endpoint that accepts and processes SAML assertions from your IdP.
* **Service Provider Entity ID:** The unique identifier for our service.
* **Callback URLs:** A list of URLs for post-authentication redirects.

### User Attributes

For the integration to work correctly, your IdP must send specific user attributes in the SAML assertion.

**Required Attributes:**

* `email`
* `firstName`
* `lastName`

**Optional Attributes:**

* `groups`

### Security Requirements

Our SAML integration adheres to the following security standards to protect your data:

* **Encryption and Signing:** All assertions must be signed using the `RSA-SHA256` algorithm. All communication must use `TLS 1.2` or higher.
* **Certificate Requirements:**
  * **Algorithm:** Must use SHA-256.
  * **Key Size:** Must be at least 2048-bit.
  * **Validity:** Maximum validity period of 2 years.
  * **Renewal:** Certificates must be renewed at least 30 days before expiration.

### Next Steps

Once you have gathered the required information from your identity provider, please email it to our support team to complete the setup process.

* **Email:** [support@alex.com](mailto:support@alex.com)