Completing the Form: Add SAML Account

Here's how to complete "Add SAML Account" form, which is required when you configure SAML between Coverity on Polaris and your SSO Identify Provider.

This form must be completed to add a SAML account. The required fields are described in the table below.

Table 1. The Fields in Add SAML Account . The following table describes each field of the form in Coverity on Polaris that you must use to set up SAML with your identity provider. To obtain some of the information described here, it's necessary to download the identity provider metadata file from your SSO provider. See the example XML file after this table. (In Okta, you can get most of the data you need by navigating to the Sign On screen and then View Setup Instructions.)
Field Name	Description	Validation Requirements
Single Sign-On URL	This is the URL of the Identity Provider that Coverity on Polaris will redirect the user to authenticate. The URL is found in the `@location` attribute of the `<SingleSignOnService>` element in the XML metadata file. (See example XML file below.) Sometimes there are two options, one for the POST method and one for Redirect; If so, choose the option that says "Redirect."	Required Must use the HTTPS protocol Must be a URL Must be globally unique in Coverity on Polaris Maximum length of 1000 characters
Single Log-Out URL	Leave this field blank.
Identity Provider Issuer	This is the unique identifier for the Identity Provider. Use the value found in the `@entityID` attribute of the `<EntityDescriptor>` element in the XML metadata file. (See example XML file below.)	Required Must be a URI following the standards set by https://www.ietf.org/rfc/rfc2396.txt Must be globally unique in Coverity on Polaris
Checkbox: Keep Coverity on Polaris groups synced with the Identity Provider Issuer groups.	Allows for Groups to be synced to Coverity on Polaris through the "Groups" Attribute in the AuthnResponse. Defaults to true.	None
Organization Email Domain	This simplifies self-registration. Non-registered users who provide an email with this domain will be referred to your identity provider.	Required Max length of 252 characters Each domain must be globally unique in Coverity on Polaris
Signature Algorithm	The hashing algorithm Coverity on Polaris uses to sign assertions. Any of the three options should work regardless of your other service providers.	Required Must be one of: SHA-1 SHA-256 SHA-512
Public Vendor Certificate	The contents of the `<X509Certificate>` element. (See example XML file below.)	Required Must be in the PEM format. Must be active and not expired. If decoded, the certificate will include `notbefore` (active) and `notafter` (not expired) properties that are used for this validation.

Example XML metadata file


          <EntityDescriptor entityID="https://sso.example.org">
   <IDPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
     <KeyDescriptor use="signing">
       <KeyInfo>
       <ds:X509Data>
       <ds:X509Certificate>
       MIICqzCCAhQCCQCvcGdwVDoJ8DANBgkqhkiG9w0BAQsFADCBmTELMAkGA1UEBhMC
dXMxEzARBgNVBAgMCmNhbGlmb3JuaWExEDAOBgNVBAcMB09ha2xhbmQxHDAaBgNV
BAoME1ZhbmRlbGF5IEluZHVzdHJpZXMxEDAOBgNVBAsMB3Rlc3RpbmcxDzANBgNV
BAMMBmxhcHRvcDEiMCAGCSqGSIb3DQEJARYTbGFwdG9wQHZhbmRlbGF5LmNvbTAe
Fw0yMTAxMjgyMzQzMDZaFw0yMjAxMjgyMzQzMDZaMIGZMQswCQYDVQQGEwJ1czET
MBEGA1UECAwKY2FsaWZvcm5pYTEQMA4GA1UEBwwHT2FrbGFuZDEcMBoGA1UECgwT
VmFuZGVsYXkgSW5kdXN0cmllczEQMA4GA1UECwwHdGVzdGluZzEPMA0GA1UEAwwG
bGFwdG9wMSIwIAYJKoZIhvcNAQkBFhNsYXB0b3BAdmFuZGVsYXkuY29tMIGfMA0G
CSqGSIb3DQEBAQUAA4GNADCBiQKBgQCbJMINde0RJJpifRk3I/hVx2ThnHEelVIO
Ytmj7WJkG/6eWqDzIcl1Qak4jm/qbC3/LJh2YA1ruHumkPcXvQw3TI4SAYmH9WOC
IZo9bCYeNTL5aNuY0NYLpTg3k97GQ2evLv0Jn8PHdbaRubd8dmibPRM5P11baQ4i
M6FC6JvHswIDAQABMA0GCSqGSIb3DQEBCwUAA4GBAC2J4YneFvEGOsjNB2XJ31SY
Hf3lAkgFFjxcPNVIIfNZxXLcdTlMofVwAdL8p+NdstpoELBOJyMLCLFpY7ZLNUDQ
pmXGsDOii0F7xIFpcizjqDfVGmi12fBFnE4m4aX5bvdd74T2Wd5vOTwtS+s05HRg
lcn9jf+gFf5k/ELfU8oa
</ds:X509Certificate>
</ds:X509Data>
       </KeyInfo>
     </KeyDescriptor>
     <SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" 
Location="https://subdomain.example.org/SAML2/SSO/Redirect"/>

     <SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" 
Location="https://subdomain.example.org/SAML2/SSO/POST"/>
   </IDPSSODescriptor>

 </EntityDescriptor>

The bolded text in the example indicates the elements or attributes described in the table above: the @entityID, <X509Certificate>, and the @Location. (Copy only the value into the Coverity on Polaris form – not the XML element or attribute that encloses it.)