> For the complete documentation index, see [llms.txt](https://docs.couchdrop.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.couchdrop.io/administration/scim-and-sso/saml-single-sign-on.md). # SAML Single Sign-On Learn how to configure SAML Single Sign-On for Couchdrop ## Overview Couchdrop supports SAML Single Sign-On for access to the Couchdrop web interface. You can connect Couchdrop to a SAML identity provider such as Microsoft Entra ID and use your existing organizational identities to sign in to Couchdrop. {% hint style="info" %} SAML SSO applies to **web interface authentication only**. It does not replace passwords or SSH keys used for SFTP, SCP, FTP, or other file transfer protocols. Users must already exist in Couchdrop before they can sign in using SAML. {% endhint %} ## Configure SAML SSO with Microsoft Entra ID {% hint style="warning" %} ### Before you start To configure SAML SSO, you will need: * Owner access to Couchdrop * Access to configure an Enterprise Application in Microsoft Entra ID * Existing Couchdrop users for everyone who will sign in using SAML * Passwords configured for those users if they also require protocol access such as SFTP or FTP {% endhint %} {% stepper %} {% step %} ### Create an Enterprise Application In the Microsoft Entra admin center, navigate to **Enterprise applications** > **New application** > **Create your own application**. Enter a meaningful name for the application. This name is only used to identify the application within Microsoft Entra. Select **Integrate any other application you don't find in the gallery (Non-gallery)**, then create the application. {% endstep %} {% step %} ### Assign users and groups In the Enterprise Application, navigate to **Manage** > **Users and groups**. Select **Add user/group**, choose the users or groups that should be able to access Couchdrop, then select **Assign**. {% endstep %} {% step %} ### Enable SAML in Couchdrop In Couchdrop, navigate to **Administration** > **SSO** > **SAML SSO**. Enable **SAML SSO**. Couchdrop will display two Service Provider values: * **Couchdrop Entity ID** * **Couchdrop ACS URL** These values are unique to your Couchdrop account. You will use them to configure the Microsoft Entra Enterprise Application in the next step. {% endstep %} {% step %} ### Configure SAML in Microsoft Entra ID In your Enterprise Application, navigate to **Manage** > **Single sign-on** and select **SAML**. Update **Step 1 — Basic SAML Configuration** with the following required fields: | Microsoft Entra field | Couchdrop value | | ---------------------------------------------- | ----------------------- | | **Identifier (Entity ID)** | **Couchdrop Entity ID** | | **Reply URL (Assertion Consumer Service URL)** | **Couchdrop ACS URL** | Go to **Step 3 — SAML Certificates**. Download **Certificate (Base 64)**. You will need to open this in a text editor and copy/paste into the **SAML IDP Certificate in** the next step. Go to **Step 4 — Set up ``**. Microsoft Entra provides the identity provider details Couchdrop requires for the SAML connection. Copy the following values to use in Couchdrop in the next step: * **Login URL** * **Microsoft Entra Identifier** You will use the **Login URL** and **Microsoft Entra Identifier** when configuring the Couchdrop SAML IDP settings. {% endstep %} {% step %} ### Configure the identity provider in Couchdrop Return to **Administration** > **SSO** > **SAML SSO** and enter the identity provider details from Microsoft Entra ID. | Couchdrop setting | Microsoft Entra value | Description | | --------------------------------- | -------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------- | | **SAML IDP Entity ID** | Microsoft Entra Identifier | Identifies your SAML identity provider. | | **SAML IDP SSO URL** | Login URL | The SAML login endpoint Couchdrop sends authentication requests to. | | **SAML IDP Certificate** | Certificate (Base64) | The certificate Couchdrop uses to validate SAML responses from your identity provider. | | **SAML IDP Email Attribute Flag** | `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress` | Identifies the SAML attribute containing the user's email address. This is the standard value used by Microsoft Entra SAML applications. | An example configuration is:
SettingExample
SAML IDP Entity IDhttps://sts.windows.net/<tenant-id>/
SAML IDP SSO URLhttps://login.microsoftonline.com/<tenant-id>/saml2
SAML IDP Certificate-----BEGIN CERTIFICATE----- ... -----END CERTIFICATE-----
SAML IDP Email Attribute Flaghttp://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress
{% endstep %} {% step %} ### Save and test SAML login Save the SAML configuration and test signing in to the Couchdrop web interface using a user that: * Already exists in Couchdrop * Has been assigned to the Microsoft Entra Enterprise Application * Has an email address that matches the value provided through the configured SAML email attribute {% endstep %} {% endstepper %} ## SAML settings ### Login settings | Setting | Description | | -------------------- | ------------------------------------------------------------------------------- | | **Enable SAML SSO** | Enables SAML authentication for the Couchdrop web interface. | | **Force SAML Login** | Requires web users to authenticate using the configured SAML identity provider. | ### Identity provider configuration | Setting | Description | | --------------------------------- | ----------------------------------------------------------------------------- | | **SAML IDP Entity ID** | The Entity ID supplied by your identity provider. | | **SAML IDP SSO URL** | The SAML Single Sign-On URL supplied by your identity provider. | | **SAML IDP Certificate** | The Base64 certificate used to validate responses from the identity provider. | | **SAML IDP Email Attribute Flag** | The SAML attribute Couchdrop uses to identify the user's email address. | ### Couchdrop Service Provider details Couchdrop displays the values required when configuring Couchdrop as a SAML Service Provider with your identity provider. | Setting | Example | | ----------------------- | ---------------------------------------------------------- | | **Couchdrop Entity ID** | `https://my.couchdrop.io/login/saml/` | | **Couchdrop ACS URL** | `https://my.couchdrop.io/login/saml/callback/` | --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.couchdrop.io/administration/scim-and-sso/saml-single-sign-on.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.