> For the complete documentation index, see [llms.txt](https://docs.1kosmos.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.1kosmos.com/authentication/admin-portal/settings/identity-provider-idp-configuration.md).

# Identity Provider (IdP) Configuration

***

{% hint style="info" %}
**Note:** Only one identity provider can be added to your tenant at a time.
{% endhint %}

### Add your identity provider

1. Log in to your tenant as a community administrator.
2. Navigate to **Settings > IdP Configuration**. The list page shows any currently configured providers.
3. Click **Create Identity Provider**.

### Configure your identity provider

#### Core configuration

* **Name** — enter a name used to generate an Entity ID (for example, `1Kosmos`).
* **Authentication Request** — choose whether the request is signed. **Signed** is recommended.

#### SAML metadata

Download a copy of your SAML metadata from this section.

#### Service URL endpoints

Identify your SAML service URL endpoints:

* **Single SignOn Service** — your SSO URL endpoint.
* **Single Logout Service** — your SLO URL endpoint.

#### Signing & encryption certificates

The **Signing Certificate** and **Encryption Certificate** sections work the same way: upload a new certificate, generate a self-signed certificate, or view/download your current one (the expiration date is shown if a certificate already exists). For each, open the **Options** menu and choose one of the following.

**View & download the current certificate** — select **Options > View & Download Certificate**, then:

* Click the **copy** icon under **Certificate** to copy the certificate.
* Click the **copy** icon under **Private Key** to copy the private key.
* Click **Download Certificate** to save it.

**Upload a new certificate** — select **Options > Upload New Certificate**, then:

* **PEM-Encoded X.509 Certificate** — paste it in the box, or click the **cloud icon** to upload directly (recommended).
* **PEM-Encoded Private Key** — paste it in the box, or click the **cloud icon** to upload directly (recommended).
* Click **Save**.

**Generate a self-signed certificate** — select **Options > Generate Self-Signed Certificate**, choose your key details, then click **Generate Certificate**. Click **Download Certificate** to save a copy.

* **Algorithm** — SHA1 or SHA256
* **Key Size** — 1024 or 2048
* **Expiry** — 1, 3, or 5 years

#### Create a self-signed certificate using OpenSSL

Prefer the command line? Use `openssl` to generate a PEM-encoded X.509 certificate and private key:

**1. Create a 2048-bit private key**

```shell
openssl genrsa -traditional -out private_key.pem 2048
```

**2. Generate a certificate request (SHA256, 365-day lifetime)**

```shell
openssl req -new -key private_key.pem -out cert_request.pem -sha256 -days 365
```

> 💡 **Tip:** Fill out the metadata correctly to specify the right **Organizational Unit** parameter.

**3. Generate a certificate from the request**

```shell
openssl x509 -req -days 365 -in cert_request.pem -signkey private_key.pem -out signing_certificate.pem
```

**4. Upload your signing certificate and key** — follow the **Upload a new certificate** steps above, clicking the **cloud icon** to upload your files directly, then click **Save**.

### Next steps

Click **Save** at the bottom of the page to finalize your IdP configuration. Then log in to your Service Provider (SP) account and set it up for SSO using the **Signing Certificate**, **Encryption Certificate**, **SAML Metadata**, and **Service URL End Points**. The process differs slightly per provider — refer to your SP's documentation for configuring your IdP from their panel.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.1kosmos.com/authentication/admin-portal/settings/identity-provider-idp-configuration.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.