# CyberArk Identity

Steps not yet verified in the identity provider's current admin console.

Recommended protocol: SAML 2.0.

## SAML 2.0

### Connect CyberArk Identity with SAML 2.0

1. Log in to the CyberArk Identity Admin Portal and select Web Apps in the left-side navigation.
2. Select Add Web Apps, open the Custom tab, add SAML and select Yes to begin setting up the SAML app. (If the app already exists, select it from the list and continue with the Trust tab.)
3. Enter a descriptive App Name and Description and select Save.
4. Open the Trust tab. In the Service Provider Configuration section enter the KeenAuth Entity ID **SP entity ID** in SP Entity Id / Issuer / Audience and the KeenAuth ACS URL **ACS URL** in Assertion Consumer Service (ACS) URL. Check Both under Sign Response or Assertion?.
5. Open the SAML Response tab, use Add to add the attributes id → LoginUser.Uuid, email → LoginUser.Email, firstName → LoginUser.FirstName and lastName → LoginUser.LastName, and select Save. Optionally add an attribute named groups mapped to LoginUser.GroupNames for group-to-role mapping.
6. Open the Permissions tab, select Add, choose the users and groups that may sign in, and select Add. The Status of the app changes to Deployed.
7. On the Trust tab, in the Service Provider Configuration section select Metadata and then Copy URL to copy the Metadata URL. Enter it in KeenAuth and run the connection test.

Values in bold are shown on the connection's page in the Admin Portal, where this guide has them filled in.