Skip to content

Keep Entity ID consistent #37936

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
rachaelshaw merged 8 commits into from
Jan 27, 2026
Merged

Keep Entity ID consistent #37936

Changes from 2 commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
827816e
Clarify what the Entity ID was from the previous examples
spalmesano0 Jan 6, 2026
9abccff
Update Entity ID format
spalmesano0 Jan 6, 2026
a390f17
Fix broken link for JIT settings
spalmesano0 Jan 6, 2026
3d0d5b1
Make Entity ID consistent
spalmesano0 Jan 6, 2026
9f32185
Clarify what Okta calls Entity ID
spalmesano0 Jan 7, 2026
a2e55e4
Correctly reference the Entity ID in the Google steps
spalmesano0 Jan 7, 2026
9ef6bec
Update Google SSO to keep Entity ID the same
spalmesano0 Jan 7, 2026
b5c2383
Fix link
spalmesano0 Jan 21, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions docs/Deploy/single-sign-on-sso.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,7 +41,7 @@ Create a new SAML app in Google Workspace:

4. Configure the **Service provider details**:
- For **ACS URL**, use `https://<your_fleet_url>/api/v1/fleet/sso/callback`. If you're configuring [end user authentication](https://fleetdm.com/guides/setup-experience#end-user-authentication), use `https://<your_fleet_url>/api/v1/fleet/mdm/sso/callback` instead.
- For Entity ID, use **the same unique identifier from step four** (e.g., "fleet.example.com").
- For Entity ID, use **the same unique identifier from step four** (e.g., `fleet`).
- For **Name ID format**, choose `EMAIL`.
- For **Name ID**, choose `Basic Information > Primary email`.
- All other fields can be left blank.
Expand Down Expand Up @@ -132,7 +132,7 @@ IdPs generally requires the following information:

- Assertion Consumer Service - This is the call-back URL that the identity provider will use to send security assertions to Fleet. Use `https://<your_fleet_url>/api/v1/fleet/sso/callback`. If you're configuring end user authentication, use `https://<your_fleet_url>/api/v1/fleet/mdm/sso/callback` instead.

- Entity ID - This value is an identifier that you choose. It identifies your Fleet instance as the service provider that issues authorization requests. The value must match the Entity ID that you define in the Fleet SSO configuration.
- Entity ID - This value is an identifier that you choose. It identifies your Fleet instance as the service provider that issues authorization requests. The value must match the Entity ID that you define in the Fleet SSO configuration. In the previous examples, we used `fleet`.

- Name ID Format - The value should be `urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress`. This may be shortened in the IdP setup to something like `email` or `EmailAddress`.

Expand Down
Loading