# SAML Identity Provider Reference This page provides details on the SAML identity provider available in Teleport. ## What is the SAML identity provider? The SAML identity provider allows Teleport users to authenticate and authorize to external applications, both inside and outside of Teleport, that support SAML Single Sign-On. ## Basic definitions The following definitions are paraphrased and summarized from OASIS's SAML specification documents, referenced at the bottom of this page. ### Assertions A package of information that supplies zero or more statements made by an identity provider. Assertions are usually made about a subject, which in Teleport's case will be Teleport users. These can be viewed as statements of fact about a user, e.g. "user *bob* belongs to roles *editor*, *access*." ### Service Provider A service provider can make use of assertions about a subject in order to control access and provide customized service. They rely on the **identity provider** for these assertions. In Teleport's case, service providers are typically applications like Slack, Vercel, etc. that allow SAML Single Sign-On. ### Identity Provider A service that makes assertions about a subject. ### Service/identity provider initiated SSO The login process can be initiated by either the service provider or the identity provider. The processes to trigger either of these are subtly different. The service provider is responsible for initiating the SSO process for service provider initiated SSO. The identity provider is responsible for initiating the process for identity provider initiated SSO. ## Endpoints ### Metadata URL `https:///enterprise/saml-idp/metadata` This is the URL where the identity provider XML metadata can be retrieved from. Service providers will require information from this file to establish the trust between the service provider and identity provider. ### Single Sign-On Service URL `https:///enterprise/saml-idp/sso` This is the URL that service providers will use to exchange assertions with the identity provider. This URL supports the following bindings: - `HTTP-Redirect` - `HTTP-POST` ### Identity provider initiated SSO URL `https:///enterprise/saml-idp/login/` This URL triggers identity provider initiated SSO. `sp-name` matches the `metadata.name` of the service provider object for a particular service provider. ## Teleport SAML service provider object Below is a service provider object. These objects must be added to Teleport in order for Teleport to trust external service providers. ``` kind: saml_idp_service_provider metadata: # The friendly name of the service provider. This is used to manage the # service provider as well as in identity provider initiated SSO. name: saml-service-provider spec: # The entity_descriptor is the service provider XML. entity_descriptor: |