SAML

Connect any identity provider that supports SAML 2.0 to SurrealDB. Use this connection when your provider is not listed by name. You create a SAML application in your identity provider, add a connection in SurrealDB Studio, and then finish the application with values from the connection.

Before you start, verify the email domain your company uses.

A SAML connection is set up in this order because the values your identity provider needs from SurrealDB include the connection's name, which exists only after you create the connection.

Step 1: Create a SAML application

1. 1.

   In your identity provider, create a SAML 2.0 application.

2. 2.

   Send each person's email address as the NameID, or as an email attribute.

3. 3.

   Copy the provider's single sign-on URL and its X.509 signing certificate.

Some providers ask for an ACS URL and an entity ID before they save the application. If yours does, enter a temporary value such as https://auth.surrealdb.com/login/callback and replace it in step 3.

Step 2: Add the connection in SurrealDB

1. 1.

   Open Single sign-on in your enterprise and add a new connection.

2. 2.

   Select SAML.

3. 3.

   Under Name the connection, enter a Display name. Members see this name on the sign-in screen.

4. 4.

   Under Enter the SAML details, enter:

   • ◦

     Sign-in URL: the provider's single sign-on URL, for example https://idp.example.com/sso/saml.

   • ◦

     Sign-out URL: optional. The provider's single logout URL.

   • ◦

     X.509 signing certificate: the PEM-encoded certificate, starting with -----BEGIN CERTIFICATE-----.

5. 5.

   Under Route sign-in domains, select the verified domains to send to this connection. This is optional, and you can change it later.

6. 6.

   Select Create connection.

Studio opens the Sign-on tab of the new connection.

Step 3: Finish the SAML application

The Set up SAML section of the Sign-on tab shows three values, with a copy button beside each. <connection> is the connection's name, which is also shown on the General tab.

Enter the ACS URL and the entity ID in the SAML application. If your provider can import service provider metadata, give it the metadata URL instead, which contains both.

Copy the values from Studio rather than building them by hand, so the connection name is exact.

Next steps

If you did not route a domain when you created the connection, route one now. Then choose the applications that people can sign in to with this connection.