Preparation

Create groups in TrustLogin to map to roles in Claude, and assign members to them. The roles on the Claude side are "Owner," "Admin," and "User."
The group name can be anything, but we recommend using a group name that clearly indicates the role.
After creating the group, be sure to assign the TrustLogin administrator who will configure SSO to the group with the Owner role. If not assigned, it may not be possible to enable the group on the Claude side.

Example TrustLogin group names:

• Owner: Owner
• Admin: Admin
• User: User
  
  

For instructions on how to create groups and assign members, please refer to the page below.
Register a Group
 

TrustLogin Admin Page Settings

1. Log in to TrustLogin, open the "Admin Page > Apps" menu, and click the "Register SAML App" button in the upper right corner of the screen.
   
   
    
2. Configure the "Application Name" and "Icon" (optional).
   
    
3. Note down the values for "Identity Provider URL" and "Issuer/Entity ID" in "Identity Provider Information," then download the certificate using the "Get Certificate" button.
   
    
4. Convert the extension of the downloaded certificate to ".cer."
    

Now, switch to the Claude side settings.
Do not click the "Register" button yet; open Claude in a separate window.

 

Claude Settings

1. Log in to Claude with an Owner or Primary Owner account and open "Organization Settings."
   Click "Organization & Access > Domains > Add or Edit Domain."
   Note: If you have already added the domain for which you want to configure SSO, proceed to step 3.

   

    

2. Add the domain and click "Save."

   
    

3. Click "Verify" next to the domain.

   

    

4. Enter the domain to verify and click "Continue."

   

    

5. Set the displayed DNS record for the domain.
   Note: The method for configuring DNS records varies depending on your domain registrar. Please refer to your domain registrar's help documentation. It may take up to 72 hours for the DNS record changes to take effect.

   

    

6. Once the domain is verified, the following screen will be displayed.

   

    

7. Return to the "Organization & Access" screen and click "SSO Setup" under "Authentication > Single Sign-On."

   

    

8. On the "Select your identity provider" screen, select "Custom SAML."

   

    

9. Set the name of the identity provider. The name can be anything.
   Example: TrustLogin, GMO TrustLogin

   

    

10. In "Step 2: Create a SAML application," note down the "Assertion consumer service (ACS) URL" and "Service provider entity ID," then click "Continue."

    

     

11. In Step 3: Set Identity Provider Metadata, select "Manual configuration" and configure as follows.
    After configuring, click "Continue."

    Identity provider Single Sign-On URL	The "Identity Provider URL" noted from TrustLogin
    Identity provider issuer	The "Issuer/Entity ID" noted from TrustLogin
    X.509 certificate	Upload the "certificate" obtained from TrustLogin Note: the one converted to .cer

    

     

12. No configuration is required for "Step 4: Configure SAML Attributes." Proceed by clicking "Continue."

    

Leaving the Claude settings screen open, return to the TrustLogin Admin Page again.

 

TrustLogin Admin Page Settings (Continued)

1. Configure "Service Provider Settings" as follows.

   Value for Name ID	Member - email
   Entity ID	The "Service provider entity ID" noted from Claude
   Name ID Format	unspecified
   ACS URL to the Service	The "Assertion consumer service (ACS) URL" noted from Claude

   

    

2. In "SAML Attribute Settings," click the "Specify Custom Attributes" button, then use the "Add SAML Attribute" button to add rows (attributes) and configure them as follows.

   Service Provider Attributes			TrustLogin (IdP) Attributes
   Specified Attribute Name	Attribute Type	Attribute Name		Attribute Value
   id	Unspecified	id	Member	Email address
   email	Unspecified	email	Member	Email address
   firstName	Unspecified	firstName	Member	First name
   lastName	Unspecified	lastName	Member	Last name
   groups	Unspecified	groups	Group	Select the configured group names and add them all using the "+" button

   
    

3. Click the "Register" button to save.
    
4. Add and assign the administrator who is configuring SSO using "Add Member" in the SAML app. Note: This will be used later for SSO testing.
    

Return to the Claude settings screen again.
 

Claude Settings (Continued)

1. In "Step 5: Test Single Sign-On," click "Continue to sign-In" to run the SSO connection test.

   

    

2. If the SSO connection test succeeds, the following screen will be displayed.
   Note: The connection test result may open in a separate browser window.

   

    

3. Return to the "Organization & Access" screen and select "Just-in-Time (JIT)."
   Turn on the "Enable Group Mapping" toggle, and from the "+" button, set the same group name as the TrustLogin group name created in "Preparation", then click "Save."
   
    
4. If you want to enforce SSO-only login, turn on the "Require SSO for Claude" toggle under "Authentication."
   Note: This setting is optional. If you turn on the toggle, we recommend doing so after confirming the connection and notifying your organization internally.
   

TrustLogin User Settings

① When a user adds it from My Page

Note: The administrator must have configured the SAML app in advance.

1. Click the "Add App" button on "My Page."
2. On the "Register App" screen, select the custom SAML app you created, and click the "Next" button in the upper right of the screen.
3. If you want to change the "Display Name," enter it, then click the "Register" button.

② When an administrator adds a member

1. Search for and click the custom SAML app you created in the "Admin Page > Apps" menu.
2. Click "Add Member," select the user to add from the member list, and click the "Register" button to add them.
    

Login Method

① When logging in via "IdP-initiated"

When logging in via IdP-initiated, an email address confirmation screen will be displayed. Confirm the email address and click "Continue as XXXX@XXXX.com."

② When logging in via "SP-initiated"

Open the Claude login URL and enter your email address. If the email address is subject to SSO, the "Continue with SSO" button will be displayed. Click "Continue with SSO" to log in via SSO.
Note: If the "Require SSO for Claude" toggle is turned on in the Claude settings, the "Continue with Email" button will not be displayed.
Note: For login from the desktop app as well, please log in using "Continue with SSO."

③ How to log in from the native app

1. Open the app and enter your email address.
   
    

2. Click "SSO" to start SSO login.