āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā ā š shadcn/directory/clerk/clerk-docs/guides/configure/auth-strategies/enterprise-connections/saml/custom-provider ā āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā
<TutorialHero beforeYouStart={[ { title: "Add the Enhanced authentication add-on to your Pro plan", link: "/pricing", icon: "plus-circle", }, { title: "Enable email for your application.", link: "/docs/guides/configure/auth-strategies/sign-up-sign-in-options", icon: "key", } ]} />
Clerk supports Enterprise SSO via the SAML protocol, enabling you to create authentication strategies for an Identity Provider (IdP). Currently, Clerk offers direct integrations with the following IdPs: Microsoft Azure AD, Google Workspace, and Okta Workforce. However, you can also integrate with any other IdPs that supports the SAML protocol.
This guide shows you how to set up a SAML connection with a custom IdP in Clerk.
<Steps> ## Set up an enterprise connection in ClerkTo create a SAML connection in Clerk:
Create a new application in your IdP. In the next steps, you'll configure your IdP with the settings provided by your Service Provider (Clerk), and configure Clerk with the settings provided by your IdP. Keep both the IdP and Clerk Dashboard open.
There are two options for configuring your IdP:
If you choose to manually input the configuration settings for your IdP, you will need to fill these three fields in the Clerk Dashboard:
To configure your Service Provider (Clerk), your IdP will either ask for the Assertion Consumer Service (ACS) URL and Entity ID or it will ask for the Metadata URL. If your IdP gives you the option to choose between the two, it is recommended to choose the Metadata URL as it is the quickest and most reliable way to configure your Service Provider.
Here are what these settings mean:
To find the values for these settings:
[!TIP] If you closed the connection's configuration page in the Clerk Dashboard, you can find it by navigating to the SSO connections page and selecting the settings icon next to the connection you want to configure.
Mapping the claims in your IdP to the attributes in Clerk ensures that the data from your IdP is correctly mapped to the data in Clerk.
In the Clerk Dashboard, find the Attribute mapping section. Here, you are shown what properties on the User object in Clerk are being mapped to the claims in your IdP.
In your IdP dashboard, there should be a section where you can map the IdP's claims to the attributes in Clerk. For example, Google has a Primary email claim that needs to be mapped to Clerk's mail property. During SAML configuration in the Google dashboard, Google provides a section where these claims can be mapped.
If you have additional claims that you would like to map to Clerk that are not listed in the Attribute mapping section, you can do so by following the steps in the Map other claims section.
In Clerk, the User object has a publicMetadata property that you can use to store additional information about your users.
To map other claims from your IdP that do not have a direct mapping to Clerk attributes, you can map them to the publicMetadata property. To do this, prepend the Clerk claims with public_metadata_ during the mapping process.
For example, say you were using Google as your IdP. Google users have the "Phone number" attribute. Clerk does not have a direct mapping for this attribute, as you can see in the Clerk Dashboard in the Attribute mapping section. Instead, in the Google dashboard, you would map Google's "Phone number" claim to public_metadata_phone_number. Then, in Clerk, the value for the user's phone number would be saved in the user's User.publicMetadata under the key phone_number.
Learn more about how to access the metadata from our APIs.
To make the connection available for your users to authenticate with:
ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā