SAML 2.0 Applications

Register a third-party service that supports SAML 2.0 as a custom application, so your users can sign in to it with their Prism credentials instead of a separate account.

Prism acts as a SAML Identity Provider (IdP), and custom applications are configured as SAML Service Providers (SPs). When a user accesses a custom application, the application redirects the user to Prism for authentication. After successful authentication, Prism sends a SAML assertion back to the application, granting the user access.

If you are choosing between protocols, see Choosing a Protocol. New integrations should generally use OIDC; SAML is the right choice when the application only supports SAML, or when you already have SAML metadata for it.

Prerequisites

• The target application must support SAML 2.0 for SSO.

Available Actions

Action	Description	Link
Add Application	Configure a new SAML application	Create SAML Application

How SAML SSO Works

1. A user navigates to the custom application.
2. The application detects that the user is not authenticated and redirects to Prism's SAML endpoint.
3. If the user is not already logged in to Prism, they are prompted to authenticate.
4. Prism generates a SAML assertion containing the user's identity and attributes.
5. The SAML assertion is sent to the application's Assertion Consumer Service (ACS) URL.
6. The application validates the assertion and grants the user access.

info

Custom application configurations in Prism are translated to internal SAML client configurations.

caution

Prism authenticates the user; the application decides what that user is allowed to do. Assigning users or groups to the application controls the portal tile and the claims Prism sends. It does not gate the login itself. See Prism Authenticates, Your Application Authorizes.

---

Create SAML Application

Configure a new SAML 2.0 application in Prism to enable single sign-on for a third-party service. This allows your users to access the application using their Prism credentials.

Prerequisites

• You must have administrator access to the target application to configure its SAML settings.
• You need the application's SAML metadata, including the Assertion Consumer Service (ACS) URL.

Step-by-Step Guide

Part 1: Gather Application Metadata

Before configuring the SAML application in Prism, collect the following information from the target application:

1. Log in to the target application's admin console.
2. Navigate to the SSO or SAML configuration section.
3. Note the following values:
   • ACS URL (Assertion Consumer Service URL), The URL where Prism sends the SAML assertion after authentication.
   • Single Logout URL (optional), The URL for SAML Single Logout.
4. Some applications also provide a SAML metadata XML file or URL that contains this information.

Part 2: Configure the Application in Prism

1. Navigate to Admin Portal > Custom Applications from the sidebar.
2. Click the Add Application button. The dialog that opens is titled Create Application.
3. Fill in the application details:
   • Application Name, Enter a descriptive name for the application.
   • Client ID, Enter a unique identifier or URL for the application. This cannot be changed after creation.
   • Description (optional), Enter a description for the application.
   • Application Icon (optional), Upload an icon for the application (PNG, JPEG, SVG, or WebP; max 512KB).
   • Assertion Consumer Service URL, Enter the application's ACS URL where Prism sends SAML responses.
   • Single Logout URL (optional), Enter the application's Single Logout URL.
   • IDP Initiated SSO Relay State (optional), URL to redirect users to after SAML authentication.
   • Name ID Format, Select the Name ID format: Persistent, Email, or Unspecified.
4. Configure the toggle options as needed:
   • Enabled, Enable or disable the application.
   • Sign Assertions, Whether Prism signs SAML assertions.
   • Sign Response, Whether Prism signs the SAML response.
   • Client Signature Required, Whether the application must sign its requests.
5. Click Create to save the application.

Part 3: Configure the Target Application

After creating the SAML application in Prism, you need to configure the target application to trust Prism as its Identity Provider:

1. From the Prism application configuration page, download or copy the following:
   • IdP Metadata, The SAML metadata for Prism's Identity Provider.
   • Certificate, The X.509 signing certificate used by Prism to sign SAML assertions.
   • SSO URL, The Prism SAML endpoint URL.
2. Enter these values in the target application's SAML configuration.
3. Save the configuration in the target application.

Field Reference

Field	Type	Required	Description
Application Name	Text	Yes	A descriptive name for the application in Prism (e.g., "Jira", "Confluence", "Slack").
Client ID	Text	Yes	A unique identifier or URL for the application. Cannot be changed after creation.
Description	Text	No	A description of the application's purpose.
Application Icon	Image	No	An icon for the application. Accepts PNG, JPEG, SVG, or WebP (max 512KB).
Assertion Consumer Service URL	URL	Yes	The ACS URL where Prism sends SAML responses after authentication.
Single Logout URL	URL	No	The application's Single Logout endpoint for SAML logout.
IDP Initiated SSO Relay State	URL	No	URL to redirect users to after SAML authentication. Used for IdP-initiated SSO flows.
Name ID Format	Select	Yes	The format of the Name ID in SAML assertions. The choices are Persistent, Email and Unspecified; Persistent is the default. Transient is not offered.
Enabled	Toggle	Yes	Whether the application is active. Defaults to enabled.
Sign Assertions	Toggle	Yes	Whether Prism signs individual SAML assertions. Defaults to enabled.
Sign Response	Toggle	Yes	Whether Prism signs the overall SAML response. Defaults to enabled.
Client Signature Required	Toggle	Yes	Whether the application must sign its SAML requests. Defaults to disabled.

warning

Use an HTTPS URL for the Assertion Consumer Service URL. SAML assertions contain sensitive authentication data and must not cross the network in the clear.

This is a recommendation, not a rule Prism enforces. The SAML fields are checked only for valid URL characters, so an http:// ACS URL is accepted and saved. That is unlike an OIDC redirect URI, where https:// is enforced and http:// is rejected outright. Nothing will warn you, so check the scheme yourself.

What Happens Next

After creating a SAML application:

1. The application appears in the Custom Applications list.
2. Prism provides its IdP metadata, certificate, and SSO URL for you to configure in the target application.
3. Once both sides are configured, users can access the target application using their Prism credentials.
4. Users will see the application as an available SSO option.

Troubleshooting

Issue	Solution
SAML assertion validation fails	Verify that the certificate configured in the target application matches the one provided by Prism.
ACS URL mismatch	Ensure the ACS URL in Prism exactly matches what the target application expects.
Entity ID mismatch	Verify the Entity ID matches between Prism and the target application configuration.
User attributes not mapped	Check that the SAML attribute mapping in the target application matches the attributes sent by Prism (e.g., email, name).

tip

Start by testing with a single user before rolling out to the entire organization. This allows you to verify the SAML configuration without impacting all users.