--- title: "Defining SAML 2.0 SSO for a CTERA Portal" slug: "defining-saml-20-sso-for-a-ctera-portal-4" tags: ["8.2", "Portal"] updated: 2026-07-26T15:15:34Z published: 2026-07-26T15:15:34Z canonical: "kb.ctera.com/defining-saml-20-sso-for-a-ctera-portal-4" --- > ## Documentation Index > Fetch the complete documentation index at: https://kb.ctera.com/llms.txt > Use this file to discover all available pages before exploring further. # Defining SAML 2.0 SSO for a CTERA Portal Before setting up SAML in the portal you must make sure that the username for every user in the portal is that user’s email. **To check a username:** 1. Select **Users > Users** in the navigation pane. The **Users** page is displayed. ![image.png](https://cdn.document360.io/30792387-cdcb-4791-aa14-94929bbcd3fe/Images/Documentation/image-HLGDL3Q1.png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A34%3A39Z&se=2026-11-11T05%3A34%3A39Z&sr=c&sp=r&sig=dF2Uz4SHWIwunBNfj1mbh3%2FiXz7IxbyrqtC%2B15XMQRM%3D) 2. Click the user's name. The user window is displayed with the user name as the window title. ![image.png](https://cdn.document360.io/30792387-cdcb-4791-aa14-94929bbcd3fe/Images/Documentation/image-BESOQYS1.png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A34%3A39Z&se=2026-11-11T05%3A34%3A39Z&sr=c&sp=r&sig=dF2Uz4SHWIwunBNfj1mbh3%2FiXz7IxbyrqtC%2B15XMQRM%3D) 3. Make sure that the email address for the user is the email address used by the SAML identity provider. **To configure SAML single sign-on:** 1. Select **Settings** in the navigation pane. The **Control Panel** page is displayed. ![image.png](https://cdn.document360.io/30792387-cdcb-4791-aa14-94929bbcd3fe/Images/Documentation/image-W6Q5JAN1.png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A34%3A39Z&se=2026-11-11T05%3A34%3A39Z&sr=c&sp=r&sig=dF2Uz4SHWIwunBNfj1mbh3%2FiXz7IxbyrqtC%2B15XMQRM%3D) 2. Select **SSO** under **USERS** in the **Control Panel** page. The **Single Sign On** window is displayed. ![image.png](https://cdn.document360.io/30792387-cdcb-4791-aa14-94929bbcd3fe/Images/Documentation/image-USS8DCFI.png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A34%3A39Z&se=2026-11-11T05%3A34%3A39Z&sr=c&sp=r&sig=dF2Uz4SHWIwunBNfj1mbh3%2FiXz7IxbyrqtC%2B15XMQRM%3D) 3. Select **SAMLv2** from the drop-down box. Additional fields are displayed. ![image.png](https://cdn.document360.io/30792387-cdcb-4791-aa14-94929bbcd3fe/Images/Documentation/image-WD43IG8E.png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A34%3A39Z&se=2026-11-11T05%3A34%3A39Z&sr=c&sp=r&sig=dF2Uz4SHWIwunBNfj1mbh3%2FiXz7IxbyrqtC%2B15XMQRM%3D) 4. Enter the details of the SAML identity provider: **Entity ID/Issuer ID** – The identity provider that issues the SAML assertion. This is a free text string that uniquely identifies your SAML identity provider and must match the entity ID that you choose when signing up for the identity provider's SSO service. **Sign-in page URL** – The URL that CTERA Portal redirects to when signing in. You need to get this from the provider. **Log-out page URL** – The URL that CTERA Portal redirects to when logging out of the portal. Without this URL configured, a logout will redirect to the sign-in page URL and log the user back into the portal. **Identity Provider Certificate** – The authentication certificate issued by the provider. You need to get this from the provider, usually by download from the provider's site. .pem and .cer certificates are valid. Click **Upload** to upload your provider's certificate to the portal. - **ADFS** – The **Relying party trust identifier** value from the procedure described in [Microsoft ADFS](/v1/docs/microsoft-adfs-8). For example, *ctera-adfs*. The value must be exactly the same as the **Relying party trust identifier** value, and is case sensitive. - **Entra ID** – The **Identifier (Entity ID)** value from the procedure described in [Microsoft Entra ID](https://kb.ctera.com/docs/microsoft-entra-id-azure-active-directory-3). For example, *ctera-azureAD*. The value must be exactly the same as the **Identifier (Entity ID)** value, and is case sensitive. - **Okta** – The **Service Provider Entity Id** value. - **OneLogin** – The **SAML Audience** value. - **Swivel AuthControl Sentry** – The Identity ID, from the procedure described in [Swivel AuthControl Sentry](/v1/docs/swivel-authcontrol-sentry-9). - **ADFS** – The ADFS server URL. For example, `https://exampleAD.adfs.local/adfs/ls` - **Entra ID** – The **Login URL** from the fourth part of the **SAML-based Sign-on** blade, from the procedure described in [Microsoft Entra ID](/v1/docs/microsoft-entra-id-azure-active-directory-3). - **Okta** – The **EMBED LINK** value. - **OneLogin** – The **SAML 2.0 Endpoint (HTTP)** value. - **Swivel AuthControl Sentry** – The AuthControl Sentry start page. - **ADFS** – The logout URL. This is the same as the **Sign-in Page URL**. - **Entra ID** – The **Logout URL** from the fourth part of the **SAML-based Sign-on** blade, from the procedure described in [Microsoft Entra ID](/v1/docs/microsoft-entra-id-azure-active-directory-3). - **Okta** – Either the default Okta sign-out page is used or a customized sign-out page defined in Okta. - **OneLogin** – The **SAML Single Logout URL** value. This is optional. - **Swivel AuthControl Sentry** – The logout page. - **ADFS** – The Token-signin certificate from the ADFS .cer certificates saved to a file. This certificate must be a known root CA and not a self-signed certificate. - **Entra ID** – The **Certificate (Base64)** that you downloaded from the third part of the **SAML-based Sign-on** blade, from the procedure described in [Microsoft Entra ID](/v1/docs/microsoft-entra-id-azure-active-directory-3). - **Okta** – The certificate downloaded from Okta and converted to .pem. - **OneLogin** – The X.509 PEM certificate downloaded from OneLogin. - **Swivel AuthControl Sentry** – The Identity ID, from the procedure described in [Swivel AuthControl Sentry](/v1/docs/swivel-authcontrol-sentry-9). 5. Click **Save**. **Note** When the SAML identity provider is also connected to Active Directory, the user name to log in to the portal must be defined in the portal. The SAML response can be the user name or a unique customized filed, such as the user email and UPN (user principal name).