> ## Documentation Index
> Fetch the complete documentation index at: https://docs.api.ignitehealth.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Configure SAML

> Exchange SAML metadata and register Ignite as a service provider.

Ignite must register your connection before SAML sign-in can be tested.

Ignite starts SAML sign-in at a browser launch URL, redirects to your IdP, and receives an HTTP POST at the assertion consumer service (ACS). Start with [SSO setup](https://docs.api.ignitehealth.com/sso-setup.md) for the environment URLs and the `providerId` assigned to your connection.

## Connection handoff

Exchange these details for each environment. If your IdP requires service-provider (SP) metadata before it can issue IdP metadata, contact Ignite to exchange the details in that order.

### You provide Ignite

* SAML as the protocol and the target environment (sandbox or production).
* IdP metadata, or the IdP entity ID, SSO URL, and certificate used to verify its SAML signatures.
* Proposed mapping for the user's email attribute.
* Proposed NameID format and the stable IdP identifier that will populate NameID.
* IdP test identities for sign-in and access testing.

### Ignite confirms before you complete IdP registration

* The connection's `providerId`, confirmed browser launch URL, exact assertion consumer service (ACS) URL, and SP metadata for this environment.
* The accepted NameID format and identifier source, and required SAML signature settings, including whether the IdP expects signed authentication requests.
* The agreed email mapping, mapped test identities and invitations, and that this environment is ready for testing.

Configure the IdP with the exact ACS URL and SP metadata Ignite confirms, then test a service-provider-initiated sign-in from the browser launch URL.

## Identity attributes

| Attribute | Behavior |
| - | - |
| NameID | Stable identifier used to link repeat sign-ins to the same identity. The format and source are confirmed for each connection. |
| `email` | Default email attribute for first sign-in. |
| Name attributes | `givenName`, `surname`, or `displayName` can be supplied. |

Use the browser launch flow. First sign-in also depends on [Ignite account and invitation access](https://docs.api.ignitehealth.com/sso-access.md).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.