> For the complete documentation index, see [llms.txt](https://docs.sonarsource.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.sonarsource.com/sonarqube-server/9.8/instance-administration/authentication/saml/overview.md).
# Overview
In SonarQube Server 9.8, you can delegate authentication to a SAML 2.0 identity provider using SAML authentication.
{% hint style="info" %}
**For AI agents:** You're in the SonarQube Server 9.8 documentation. For a list of all 9.8 pages, see the [SonarQube Server 9.8 page index](https://739659627-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FwuQmJTVPOsx7zNT5Aqwl%2Fuploads%2FCuKwdsA66vRPOgZVhybb%2Fsonarqube-server-9.8-llms.txt?alt=media). For the whole site, see the [page index](https://docs.sonarsource.com/llms.txt) or the [full text](https://docs.sonarsource.com/llms-full.txt). For another version, replace 9.8 in the URL with that version. The [latest version](https://docs.sonarsource.com/sonarqube-server/) has no version number in its URL.
{% endhint %}
You can delegate authentication to a SAML 2.0 identity provider using SAML authentication.
## SAML authentication flow
1. When a user requests a SonarQube Server web page and is not already authenticated, SonarQube Server will start a SAML authentication process.
2. SonarQube Server creates a SAML request for the configured identity provider and sends it back to the user’s browser.
3. The user’s browser automatically relays the SAML request to the identity provider.
4. The identity provider authenticates the user and creates a SAML assertion containing the user information and privilege. Optionally, it can encrypt this assertion with the SonarQube Server certificate.
5. The identity provider sends a SAML assertion back to the web browser.
6. The user’s browser then relays the SAML assertion to SonarQube Server to authenticate and authorize the user.
7. SonarQube Server responds with the originally requested resource.
illustrate the looping conditions initiated by a user’s SAML authentication process
During the process, certificates are used to authenticate the identity provider and, optionally, SonarQube Server. The identity provider public certificate is necessary to ensure that the SAML assertion is genuine. The SonarQube Server certificate is optionl, but ensures that only SonarQube Server can use the assertion provided.
## Settings
| | | | |
| ---------------------------------------- | ----------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------- |
| **Property** | **UI Name** | **Description** | **Required** |
| `sonar.auth.saml.enabled` | Enabled | Controls whether SAML authentication is enabled on SonarQube Server. | Yes |
| `sonar.auth.saml.applicationId` | Application ID | The ID under which SonarQube Server is known to the identity provider. | Yes |
| `sonar.auth.saml.providerName` | Provider Name | The name of the identity provider displayed in the login page when SAML authentication is active. | Yes |
| `sonar.auth.saml.providerId` | Provider ID | The ID of the identity provider. | Yes |
| `sonar.auth.saml.loginUrl` | SAML login url | The URL at which the identity provider expects to receive SAML requests. | Yes |
| `sonar.auth.saml.certificate.secured` | Identity provider certificate | The public X.509 certificate used by the identity provider to authenticate SAML messages. | Yes |
| `sonar.auth.saml.user.login` | SAML user login attribute | The name of the attribute that the identity provider will use to store the authenticated user login. | Yes |
| `sonar.auth.saml.user.name` | SAML user name attribute | The name of the attribute that the identity provider will use to store the authenticated user name. | Yes |
| `sonar.auth.saml.user.email` | SAML user email attribute | The name of the attribute that the identity provider will use to store the authenticated user email. | No |
| `sonar.auth.saml.group.name` | SAML group attribute | The attribute defining the user group in SAML. If this attribute is not defined, users are associated with the default group. | No |
| `sonar.auth.saml.signature.enabled` | Sign requests | Controls whether SonarQube Server is expected to sign the SAML requests. If enabled, both the service provider’s private key and certificate must be provided. | No |
| `sonar.auth.saml.sp.privateKey.secured` | Service provider private key | The PKCS8 private key without password used by SonarQube Server to sign SAML requests and to decrypt encrypted SAML responses. | This is only required if `sonar.auth.saml.signature.enabled` is set to `true` or the Identity Provider sends encrypted SAML responses. |
| `sonar.auth.saml.sp.certificate.secured` | Service provider certificate | The public key part of the previously provided private key. | This is only required if `sonar.auth.saml.signature.enabled` is set to `true`. |
### Testing
After all the mandatory settings are filled, the SAML integration with the identity provider can be tested by clicking the **Test configuration** button. A new tab will open with more information regarding the success of the integration, attributes received from the identity provider, and any warnings or errors that occur.
## SAML configuration related information and limitations
* **SAML and reverse proxy configuration**: When using SAML, make sure your reverse proxy is properly configured. See [Operating the server](/sonarqube-server/9.8/setup-and-upgrade/configure-and-operate-a-server/operating-the-server.md) for more information.
* **Migrating from LDAP to SAML as Identity Provider**: A guide on how to perform this migration is available [here](https://community.sonarsource.com/t/migrating-sonarqube-users-between-identity-providers-with-a-focus-on-ldap-saml/48653).
* **Identity Provider initiated authentication is not supported**: This is a known limitation of SonarQube Server when using SAML as the authentication mechanism. Only service provider-initiated authentication is fully supported.
* **SAML Single Sign Out is not supported**: Logging off from SonarQube Server when SAML authentication is enabled, will not result in a disconnection from the other services linked to the same identity provider.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://docs.sonarsource.com/sonarqube-server/9.8/instance-administration/authentication/saml/overview.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.