This article explains how to register a SAML authentication app that is not already registered in TrustLogin, on your own.
Note: The SP (service provider) must support SAML 2.0 authentication.
Note: Prior application/configuration on the SP side may be required.Note: For the latest configuration steps, please refer to the manual provided by the SP.
Note: If you are using the Free Plan, configuration support for SAML authentication apps that are not in the template is not provided.

TrustLogin Admin Page Settings

Add a New SAML App

1. Log in to TrustLogin and select the "Admin Page > Apps" menu.
2. Click the "Register SAML App" button in the upper right of the screen.
   
   
   
   
3. Register the "Application Name" and "Icon" (optional).
   
   
   
   
   

Configure TrustLogin Information in the SP

1. Log in to the SP's admin page and open the SAML authentication settings screen.
2. Enable the SAML authentication setting.
3. Register TrustLogin's information with the SP.
   
   ① If using metadata
   From "Identity Provider Information" on TrustLogin's company app registration screen,
   　　download the "Metadata" and upload it to the SP's settings page.
   
   
   
   ② If not using metadata
   　　From "Identity Provider Information" on TrustLogin's company app registration screen,
   　　copy/download the "Identity Provider URL," "Issuer/Entity ID," and "Certificate,"
   　　and register each of them in the corresponding SP settings fields.
   
   

Configure SP Information

Register the information provided by the SP in TrustLogin's "Service Provider Settings" fields.

① If using metadata
　Upload the metadata downloaded from the SP.
　Note: Depending on the SP, additional information beyond the metadata may need to be entered.

② If not using metadata
Register the "Entity ID," "NameID Format," "ACS URL for the Service," and "Logout URL."
Note: If registering multiple ACS URLs, click the "+" button on the right side of the form.
Note: For IdP-initiated SSO, the first registered ACS URL is used as the default.

Value for NameID

This links the NameID used to identify the SP's users with data in TrustLogin.
Select and register the applicable item from the dropdown, or if there is no applicable item, use "Custom Attribute." To use "Custom Attribute," you must first configure the member information.

1. Open the "Admin Page > Members" menu, and click the edit button that appears on the right when you hover over the name of the applicable user.
   
   
   
   
   
2. Open "Custom Attribute" and click the "Add Attribute" button.
   
   
   
   
   
3. Enter the "Attribute Name" and "Attribute Value," then click "Save."
   
   
   
   
4. You can now select it from "Custom Attribute" in the dropdown.
   
   
   
   

Specify SAML Attributes (Optional)

Some SPs may require SAML attribute configuration separately.
Alternatively, configuring this allows more detailed user information to be passed.

1. Click the "Specify Custom Attribute" button in "SAML Attribute Settings."
   
   
   
   
   
2. Click "Add SAML Attribute."
   
3. Register the Service Provider Attribute's "Attribute Specification Name," "Attribute Type," and "Attribute Name," as well as the TrustLogin (IdP) Attribute's "Attribute Value."
   

   

   ・Attribute Specification Name
   　Enter the attribute name defined on the SP side.

   ・Attribute Type
   　Select the attribute type (format) defined on the SP side.

   ・Attribute Name
   　This is the attribute display name shown within the SAML assertion. (In general, it is fine to set the same value as the "Attribute Specification Name.")
   　If the parameter set in "Attribute Specification Name" is complex and difficult to understand, enter an easier-to-understand name here.

   <Configuration Example>

   If the attribute name and attribute type defined on the SP side are as follows

   Attribute Name Defined by SP	Attribute Type
   email	Email
   Firstname	Basic
   Lastname	Basic
   Group	Basic

   Configure the TrustLogin side as follows

   Service Provider Attribute			TrustLogin (IdP) Attribute
   Attribute Specification Name	Attribute Type	Attribute Name		Attribute Value
   email	Email	email	Member	Member - Email Address
   Firstname	Basic	Firstname	Member	Member - First Name
   Lastname	Basic	Lastname	Member	Member - Last Name
   Group	Basic	Group	Group	Select the group name to use as the attribute value and add it with the "+" button

   ・About the behavior when specifying a group
   　You can specify multiple pieces of group information as SAML attributes to pass to the SP.
   　Note: After selecting the group you want to add, you can select additional groups using the "+" button on the right.

   
   
   　<Configuration Example>
   　・GroupA, GroupB, and GroupC are specified as SAML attributes on the SAML app
   　・UserA belongs to GroupA and GroupB; UserB belongs to GroupC and GroupD
   　Note: Example member status

   Member	Group Membership
   UserA	GroupA
   	GroupB
   UserB	GroupC
   	GroupD

   　　Given the above conditions, the behavior is as follows.

   　・For UserA, GroupA and GroupB are passed as SAML attributes; GroupC information is not passed
   　・For UserB, GroupC is passed as a SAML attribute; GroupD is not passed because it is not specified in the configuration

   
   TrustLogin (IdP) Attribute Value List

   Attribute Category	Attribute Value
   Company	name
   	address
   	country
   Member	Member - Last Name
   	Member - First Name
   	Member - Email Address
   	Member - Sub Email Address
   	Member - Company Name
   	Member - Department
   	Member - Phone Number
   	Member - Postal Code
   	Member - Prefecture
   	Member - City
   	Member - Street Address
   	Member - Role
   Custom Attribute	The attribute name is arbitrary.
   Fixed Value	Enter a fixed value.
   Group	Specify from an already created group. Select a group from the dropdown list and add it with the "+" button.

4. Add further attributes as needed using "Add SAML Attribute."
   
   

5. Once all settings are complete, click the "Register" button in the upper right of the page.

   

6. In the "Admin Page > Apps" menu, search for the app name you added and click it.
7. Click "Add Member," select the user to add from the member list, and click the "Register" button to add them.
8. Click the app in My Page (browser extension) and confirm that login succeeds.