> For the complete documentation index, see [llms.txt](https://help.sentinelsoftware.com/sentinel-help-center/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://help.sentinelsoftware.com/sentinel-help-center/installation-and-updates/single-sign-on.md).

# Single Sign-On

The preferred and recommended login method is SAML 2.0 for exchanging authentication and authorization data between security domains—specifically, between an Identity Provider (IdP) (e.g., Okta, Azure AD/Entra ID, Ping Identity, OneLogin, or your enterprise IdP).

* **Cross-domain single sign-on**: Users authenticate once via their enterprise IdP and gain access to Sentinel without re-entering credentials.
* **Centralized identity management**: Leverages existing corporate credentials, reducing password fatigue and improving compliance.
* **Stronger security**: Supports federated authentication, attribute mapping (e.g., roles/groups), and protocols for secure assertion exchange (signed/encrypted as configured).
* **Web-based scenarios**: Enables SP-initiated (user accesses Sentinel directly) or IdP-initiated (starts from corporate portal) SSO flows.
* Sentinel acts as the **SAML Service Provider (SP)**.
* Integration requires configuring Sentinel with your IdP's metadata (or vice versa) — typically involving:
  * Entity IDs
  * Assertion Consumer Service (ACS) URLs
  * Signing certificates
  * Attribute mappings (e.g., for user provisioning or role assignment)
* Once set up, Sentinel redirects unauthenticated users to the IdP for login; successful authentication returns a SAML assertion, granting access with appropriate permissions.
* Fallback to local Sentinel credentials remains available if needed (e.g., for admin recovery).
* No custom code or modifications to PeopleSoft core are required — Sentinel handles SAML independently via its web layer (Nginx-proxied).

{% hint style="info" %}
An IDP Certificate and IDP URL are required to complete the setup.
{% endhint %}

<details>

<summary>IDP Attributes</summary>

* The following data attributes should be sent from your IDP Provider:&#x20;

  <figure><img src="/files/f4VQ2Rnkg439T06dGgdB" alt=""><figcaption></figcaption></figure>

</details>

<details>

<summary>Set Up Single Sign-On</summary>

1. Navigate to **Settings - Single Sign-On.**
2. Input the '**Identity Provider URL.'**
3. Input the ' **Identity Provider Certificate.'**
4. Once a configuration is saved, Sentinel will generate a **Metadata URL, Sentinel Callback URL,** and **Sentinel Direct Login Link.** *\*These are used to complete the IDP setup and service connection.*&#x20;
5. Set up attributes mapping on your IDP to match Sentinel IDP attributes:

   <figure><img src="/files/bZTfq7x4sQ8TitReHvK7" alt=""><figcaption><p><em>*If your IDP uses different field names in the Attributes section, map the IDP field names to the corresponding Sentinel field names.</em> </p></figcaption></figure>
6. Save changes.
7. Toggle the **'SAML ON/OFF'** switch after updating settings.

* *After a successful configuration,* a new SSO Login button will appear on the login screen. Sentinel also provides a direct SSO login URL that can be used to initiate login through your IDP. This URL can be found under the **Sentinel Direct Login Link.**

  <figure><img src="/files/RBbtTknvTtlLfNIKbCko" alt=""><figcaption></figcaption></figure>

</details>

<details>

<summary>Assign Default Access for New SSO Users </summary>

**First-time** users that use the single sign-on (SSO) login may be automatically given access to one or more PeopleSoft environments in Sentinel.&#x20;

&#x20;A Sentinel user will only receive access to environments for which they have [**access profiles**](broken://pages/9cRPM0iQbHunOujEQnQj).&#x20;

* Default Profiles will be assigned to all signed-up users via SAML integration.

  <figure><img src="/files/phHo1Fu4wPL3zjM6UXWb" alt=""><figcaption></figcaption></figure>

</details>