---
title: SSO SAML Configuration
slug: sso-saml-configuration
docTags: 
createdAt: 2026-04-09T19:45:27.668Z
---

Flare Supports the following SAML configurations:

- [Microsoft Azure Entra ID](docId\:LbK46kdRtmQF-lE7yOarT)
- [OKTA](docId\:LbK46kdRtmQF-lE7yOarT)
- [JumpCloud](docId\:LbK46kdRtmQF-lE7yOarT)

# Configuring Microsoft Azure Entra ID

:::::WorkflowBlock
:::WorkflowBlockItem
Navigate to **Enterprise Apps** in your Entra ID tenant and click on **New Application**.
:::

:::WorkflowBlockItem
You should now be in the Entra App Gallery, click on **Create your own application**. This should open a drawer similar to the screenshot below.
:::

:::WorkflowBlockItem
Give the application a representative name like *Flare SSO*, leave **Integrate any other application you don't find in the gallery (Non-gallery) **selected in the **What are you looking to do with your application?** section.

::Image[]{src="https://api.archbee.com/api/optimize/wtmLmyh6YG71yn5qVtkMM/jTOv59B0ZNdwg4s5GEZuY_image.png" size="66" width="1118" height="702" position="flex-start" alt="Entra ID Create Application Drawer" showCaption="false"}
:::

:::WorkflowBlockItem
Click **Create Application** and wait for Entra to create it.
:::

:::WorkflowBlockItem
Click on **Set up single sign on**.

::Image[]{src="https://api.archbee.com/api/optimize/wtmLmyh6YG71yn5qVtkMM/tyYY7QnvL4mEuu4UODLFN_image.png" size="44" width="710" height="310" position="flex-start" alt="Single sign on Quickstart" showCaption="false"}
:::

:::WorkflowBlockItem
Click on **SAML**.

::Image[]{src="https://api.archbee.com/api/optimize/wtmLmyh6YG71yn5qVtkMM/l8diCxBCvUtUaS5qIyPSF_image.png" size="42" width="702" height="366" position="flex-start" alt="SAML Option" showCaption="false"}
:::

:::WorkflowBlockItem
Edit the **Basic SAML Configuration**

- Set the Identifier to `urn:amazon:cognito:sp:us-east-1_EdS7l4VuU`.
- Set the **Reply URL** to `https://sso.firework.flared.io`.
- Click **Save** at the top of the drawer.

::Image[]{src="https://api.archbee.com/api/optimize/wtmLmyh6YG71yn5qVtkMM/KZVUKGgG_AbtwBK4rw-X4_image.png" size="86" width="1438" height="366" position="center" showCaption="false"}
:::

::::WorkflowBlockItem
You should now be able to fill out the required fields in the SSO configuration screen in Flare.

:::Paragraph{listStyleType="decimal" indent="2"}
Paste the **App Federation Metadata Url** from the **SAML Certificates** section to the **Metadata (URL) field **in Flare.
:::

::Image[]{src="https://api.archbee.com/api/optimize/wtmLmyh6YG71yn5qVtkMM/oUOaHTftXSeVEs61uNChz_image.png" size="80" width="1438" height="534" position="center" showCaption="false"}

:::Paragraph{listStyleType="decimal" listStart="2" listRestartPolite="2" indent="2"}
Paste the corresponding claim from the **Attributes & Claims** section to the **Mapping Email** field in Flare. The format of this field is `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/$claim_name` where `$claim_name` corresponds to email attribute in Entra. In the example screenshot, this could either be `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name` or `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress` depending on your Entra user distribution.
:::

::Image[]{src="https://api.archbee.com/api/optimize/wtmLmyh6YG71yn5qVtkMM/gpO2pEbR_QhahCVBbhi-c_image.png" size="80" width="1434" height="362" position="center" showCaption="false"}

If you have customized claims, you might need to use a different **Metadata URL**. You can find it by:

- Navigating to the app registration you just created.
- Click on the **Managed application in local directory** link.
- In the left sidebar, under **Manage**, Select **Single sign-on**.
- If a new custom signing has been used, you should see a section called Certificates.
- Copy the value from **Federation metadata document**.
- Set the value **Metadata URL** in Flare to the value you just copied.
::::

:::WorkflowBlockItem
Azure Entra ID should now be correctly configured.
:::
:::::

***

# Configuring Okta

::::WorkflowBlock
:::WorkflowBlockItem
**Flare Settings**

- Metadata URL: Taken from Okta in the "Sign On" subtab of the application
- Mapping Email: `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress`
:::

:::WorkflowBlockItem
**Okta Settings**

- Single sign-on URL: `https://sso.firework.flared.io/saml2/idpresponse`
- Audience URI: `urn:amazon:cognito:sp:us-east-1_EdS7l4VuU`
- Application Username: email
:::

:::WorkflowBlockItem
**Attribute Statement**
Create an attribute statement as follows:

- Name: `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress`
- Format: Basic
- Value: user.email
:::
::::

***

# Configuring JumpCloud

::::WorkflowBlock
:::WorkflowBlockItem
**App Creation**

- User Authentification -> Add New Application -> Custom Application
- Custom Application Features:
  - Manage Single Sign-On (SAML)
- Save Application
:::

:::WorkflowBlockItem
**App Config**

- SP entity ID: `urn:amazon:cognito:sp:us-east-1_EdS7l4VuU`
- ACS URL: `https://sso.firework.flared.io/saml2/idpresponse`
- SAMLSubject NameID: `email`
- SAMLSubject NameID Format: `urn:oasis:names:SAML:1.1:nameid-format:unspecified`
- Declare Redirect Endpoint: Yes
:::

:::WorkflowBlockItem
**Creating a user attribute**

- Service Provider Attribute Name: `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress`
- JC Attribute Name: `email`
:::

:::WorkflowBlockItem
**Flare Config**

- Metadata URL: Obtain from `Copy Metadata URL` in JumpCloud.
- Mapping Email: `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress`
:::
::::