> ## Documentation Index
> Fetch the complete documentation index at: https://docs.k16solutions.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Configure SAML

> Add a SAML 2.0 identity provider and map user email addresses.

You need administrative access to both K16 and your SAML identity provider.

## Values K16 provides

After you select **SAML**, the **Service provider values** panel shows:

* **SP entity ID**
* **SAML ACS URL**
* **SAML logout URL**

Configure the entity ID and assertion consumer service URL in your identity provider. Configure the logout URL only when you enable single logout.

## Create the provider

<Steps>
  <Step title="Choose SAML">
    Open **Settings** > **Single sign-on** > **New identity provider**, then select **SAML**.
  </Step>

  <Step title="Name the provider">
    Enter **Provider name**. You cannot rename the provider later.
  </Step>

  <Step title="Choose a metadata method">
    Leave **Upload metadata XML** on to paste the provider's metadata. Turn it off to enter an HTTPS **Metadata URL** instead.
  </Step>

  <Step title="Map email">
    Enter the identity-provider attribute that carries the user's email address in **Email attribute mapping**.
  </Step>

  <Step title="Configure optional trust and logout">
    Download the **SP signing certificate** only when your identity provider requires the public certificate. Turn on **Enable IdP sign-out (SLO)** only when the provider metadata includes a supported logout service.
  </Step>

  <Step title="Create and test">
    Review **Enabled for sign-in**, select **Create**, assign a pilot user in the identity provider, and test the normal K16 sign-in flow.
  </Step>
</Steps>

<Note>
  The metadata upload choice is locked after creation in the current editor. Create a replacement
  provider if you must switch between uploaded metadata and a metadata URL.
</Note>

## Email mapping requirements

The mapped assertion value must resolve to the same email identity K16 expects for the user. If your identity provider uses a custom claim, enter that claim's exact name.

## Edit a SAML provider

Select the provider in **Settings** > **Single sign-on**. You can update metadata content, email mapping, **Enabled for sign-in**, and **Enable IdP sign-out (SLO)**. Select **Save changes**.

<Warning>
  Keep an authorized administrator session open while testing. If the new configuration fails,
  disable or correct the provider from that existing session and contact K16 Support when needed.
</Warning>

See [Troubleshoot SSO](/administration/sso/troubleshoot).