Creating an Identity Provider

Create a SAML2 Identity Provider for single sign-on

Prerequisites

  • An existing approval set in SplitSecure
  • Web App paired with mobile app
  • Knowledge of which service providers will use this IdP

Navigate to Identity Providers

In the Web App:

  1. Click Secure Accounts in the sidebar
  2. Click SAML2 Identity Providers
  3. Click Create Identity Provider

Configure IdP Settings

Select Controlling Approval Set

Choose which approval set will control this Identity Provider:

Field Description
Approval Set The approval set whose members can approve authentication requests

Enter IdP Details

Field Description Example
Name A descriptive name for this IdP “Production SSO”
Valid From When the certificate becomes valid Today’s date
Valid Until When the certificate expires 10 years from now (default)

The validity period determines how long the IdP’s certificate is trusted. Most organizations use a 10-year validity for convenience.

Submit for Approval

  1. Review your settings
  2. Click Create
  3. A threshold proposal is created for approval set approval

Threshold Approval

Approval Set Members Approve

Creating an IdP requires approval from approval set members:

  1. Approval set members receive a notification on their mobile devices
  2. They review the IdP creation details
  3. They approve or reject the request

Monitor Approval Progress

The roundtrip page shows:

  • Which approval set members have approved
  • Which are still pending
  • Overall progress toward threshold

Once the required threshold is reached, the IdP is created.

Download Metadata

Access IdP Details

After approval:

  1. Navigate to Secure Accounts → SAML2 Identity Providers
  2. Click on your newly created IdP
  3. The details page shows IdP configuration

Download SAML Metadata

On the IdP details page:

  1. Click Download Metadata
  2. Save the XML file to your computer

This metadata file contains:

Element Purpose
Entity ID Unique identifier for your IdP
Certificate Public key for signature verification
SSO URLs Endpoints for SAML requests

Next Steps

Use the downloaded metadata to configure your service providers:

Troubleshooting

Issue Possible Cause Solution
“No approval set selected” error Approval set not chosen Select an approval set from the dropdown
Approval stuck at “Waiting” Approval set members haven’t approved Contact approval set members to approve on their devices
Metadata download fails IdP not yet created Wait for threshold approval to complete
Service provider rejects metadata Metadata format issue Ensure metadata is downloaded as XML, not HTML

Last updated:

Previous page

Overview

Next page

AWS