> ## Documentation Index
> Fetch the complete documentation index at: https://docs.getcollate.io/llms.txt
> Use this file to discover all available pages before exploring further.

# SAML SSO for Bare Metal

# SAML SSO for Bare Metal

## Update conf/openmetadata.yaml

Follow this sections in this guide to set up Saml for almost any IDP. In OpenMetadata the SAML configuration
are divided into the following three sections:-

* Identity Provide (IDP) Configuration

```yaml theme={null}
    idp:
      entityId: ${SAML_IDP_ENTITY_ID:-"https://mocksaml.com/api/saml/sso"}
      ssoLoginUrl: ${SAML_IDP_SSO_LOGIN_URL:-"https://saml.example.com/entityid"}
      idpX509Certificate: ${SAML_IDP_CERTIFICATE:-""}
      authorityUrl: ${SAML_AUTHORITY_URL:-"http://localhost:8585/api/v1/saml/login"}
      nameId: ${SAML_IDP_NAME_ID:-"urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"}
```

* Service Provider (SP) Configuration (SP is OpenMetadata)

```yaml theme={null}
  sp:
    entityId: ${SAML_SP_ENTITY_ID:-"http://localhost:8585/api/v1/saml/acs"}
    acs: ${SAML_SP_ACS:-"http://localhost:8585/api/v1/saml/acs"}
    spX509Certificate: ${SAML_SP_CERTIFICATE:-""}
    callback: ${SAML_SP_CALLBACK:-"http://localhost:8585/saml/callback"}

```

* Security Config

```yaml theme={null}
  security:
    strictMode: ${SAML_STRICT_MODE:-false}
    tokenValidity: ${SAML_SP_TOKEN_VALIDITY:-"3600"}
    sendEncryptedNameId: ${SAML_SEND_ENCRYPTED_NAME_ID:-false}
    sendSignedAuthRequest: ${SAML_SEND_SIGNED_AUTH_REQUEST:-false}
    signSpMetadata: ${SAML_SIGNED_SP_METADATA:-false}
    wantMessagesSigned: ${SAML_WANT_MESSAGE_SIGNED:-false}
    wantAssertionsSigned: ${SAML_WANT_ASSERTION_SIGNED:-false}
    wantAssertionEncrypted: ${SAML_WANT_ASSERTION_ENCRYPTED:-false}
    wantNameIdEncrypted: ${SAML_WANT_NAME_ID_ENCRYPTED:-false}
    keyStoreFilePath: ${SAML_KEYSTORE_FILE_PATH:-""}
    keyStoreAlias: ${SAML_KEYSTORE_ALIAS:-""}
    keyStorePassword: ${SAML_KEYSTORE_PASSWORD:-""}
```

## Configure Ingestion

Once your server security is set, it's time to review the ingestion configuration. Our bots support JWT tokens
to authenticate to the server when sending requests.

Find more information on [**Enabling JWT Tokens**](/deployment/security/enable-jwt-tokens) and [**JWT Troubleshooting**](/deployment/security/jwt-troubleshooting) to ensure seamless authentication.