Agent Identity:SAML identity provider management

Overview

A SAML identity provider in a user pool is an external enterprise identity source that you integrate with, such as Microsoft Entra ID or Okta. After you configure a SAML identity provider, users of your AI Agent applications can log on to the user pool through enterprise SSO. The system automatically performs the following operations:

• SSO login: Users are authenticated by the external IdP and then logged on to the user pool with single sign-on (SSO).

• Auto-create users: When a user logs on through SSO for the first time, the system automatically creates a user in the user pool based on the attributes in the SAML assertion (JIT provisioning).

• Auto-update user information: On subsequent SSO logins, the system automatically syncs user attributes with the latest values from the SAML assertion.

Prerequisites

• A user pool is created. For more information, see User pool management.

• An enterprise application is created in the external SAML identity provider with basic SAML SSO configuration (Entity ID and ACS URL). For an example, see Configure SAML SSO with Microsoft Entra ID.

• The federation metadata XML file or URL is obtained from the external SAML identity provider.

Configure the SAML identity provider

By configuring the external IdP information (Entity ID, Login URL, and signing certificate), the user pool can establish a trust relationship with the external IdP to enable SAML SSO login.

1. Log on to the Agent Identity console.

2. In the left-side navigation pane, choose Identity > User Pools.

3. Click the name of the target user pool to go to the user pool details page.

4. On the General Settings tab, find the SAML Identity Provider section and click Configure Identity Provider.

5. In the Configure Identity Provider panel, configure the following parameters:

   • SSO Status: Enable or disable the SAML SSO login feature.

   • Auto Sync to Create Users: When enabled, users who log on through SSO for the first time are automatically created in the user pool (JIT provisioning).

   • Auto-Update User Information: When enabled, user attributes are automatically synced from the SAML assertion when existing users log on through SSO again.

   • Entity ID: The entity identifier of the external SAML identity provider. You can upload a metadata file for automatic parsing or enter the value manually.

   • Login URL: The SAML SSO login endpoint URL of the external IdP.

   • Signing Certificate: The X.509 certificate that the external IdP uses to sign SAML assertions. Click Add Certificate to upload the certificate file.

   Note

   If you have obtained the metadata XML file from the external IdP, you can click Upload Metadata File to Parse. The system automatically fills in the Entity ID, Login URL, and signing certificate.

6. Click OK.

View service provider information

When you configure the external SAML identity provider, you must enter the service provider (SP) information of the user pool in the external IdP. On the General Settings tab, in the SAML Identity Provider section, you can view the following SP information:

• Entity ID: The unique identifier of the user pool as a SAML service provider. Enter this value in the "Identifier" or "Audience" field of the external IdP.

• ACS URL: The URL of the SAML Assertion Consumer Service. Enter this value in the "Reply URL" or "ACS URL" field of the external IdP.

You can also click Download Metadata to obtain the SP metadata file and import it into the external IdP to complete the configuration.

Enable or disable SAML SSO

You can use the toggle in the SAML Identity Provider section to quickly enable or disable the SSO login feature without deleting the configured identity provider information.

After SSO is disabled, users can no longer log on through the SAML identity provider, but existing user records are not affected.

Rotate the SAML signing certificate

We recommend that you regularly rotate the SAML signing certificate of the identity provider (IdP). You can upload a new certificate before the old one expires. When a user performs SSO login, the user pool validates the SAML signature by using both the old and new certificates. The login is trusted as long as either certificate passes validation. After the new certificate takes effect and the old certificate is no longer in use, you can delete the old certificate.

1. On the user pool details page, click the General Settings tab, find the SAML Identity Provider section, and then click Configure Identity Provider.

2. In the Configure Identity Provider panel, rotate the SAML signing certificate.

   1. Click Add Certificate and upload the new certificate obtained from the enterprise IdP.

   2. Confirm that the enterprise IdP starts using the new certificate to sign SAML responses, and then try SSO login to the user pool to make sure login works properly.

   3. After you observe that the new certificate takes effect and the old certificate is no longer in use, click Actions next to the old certificate and then click Delete to delete the old certificate.

   4. Click OK to complete the SAML signing certificate rotation.

Test SSO login

After you configure the SAML identity provider, we recommend that you perform a test login to verify that the configuration is correct.

1. On the user pool details page, click the General Settings tab and copy the Login URL.

2. Open the URL in a browser. The system redirects you to the login page of the external SAML identity provider.

3. Enter the user credentials of the external IdP to complete the login.

4. After a successful login, go back to the Users tab of the user pool and verify that the corresponding user record has been automatically created.

Troubleshooting

If SSO login fails, check the following configurations:

• Verify that the Entity ID and ACS URL configured in the external IdP match the values displayed in the service provider information of the user pool.

• Verify that the federation metadata is the latest version.

• Verify that the signing certificate is valid and up to date.

• Verify that the Login URL correctly points to the SAML SSO endpoint of the external IdP.

Related topics

• User pool management

• User management

• Configure SAML SSO with Microsoft Entra ID