## Before you begin

You will need your **socure_public_account_id**, available in the RiskOS™ Dashboard on the **Developer Workbench > API Keys** page under the **Customer ID** section.

- Access Sandbox socure_public_account_id
- Access Production socure_public_account_id.

## Set Up Single Sign-On (SSO) with Salesforce

### 1. Configure SAML in Salesforce

Follow these steps to create a SAML 2.0 integration in Salesforce:

01. Log into your Salesforce account.
02. Click **Setup** in the top right corner.
03. In the **Quick Find** box, type **Identity**, then select **Identity Provider**.
04. On the **Identity Provider** page, click **Enable Identity Provider**.
05. From the dropdown menu, select the **default certificate**, then click **Save**.
06. When prompted, click **OK**.
07. Go to **Identity > Identity Provider**, then click **Download Metadata** to save the file.
08. Under **Service Providers**, click **Service Providers are now created via Connected Apps. Click here to add a service provider**.
09. On the **New Connected App** page, configure the **Web App Settings** as follows:

- **Start URL**: Use the start URL from the metadata file.
    - Check the box for **Enable SAML**.
    - **Entity ID**: Enter one of the following:
      - **Sandbox environment**: `https://riskos.sandbox.socure.com/saml2/socure_public_account_id`
      - **Production environment**: `https://riskos.socure.com/saml2/socure_public_account_id`
    - **ACS URL**: Enter `https://api-dashboardv2.socure.com/saml2/SSO`.
10. Click **Save**.
11. Click **Manage**, then expand the **Custom Connected App Handler** section.
12. Under **Profiles**, click **Manage Profiles**.
13. Select the profile you want to grant access to Socure, then click **Save**.

### 2. Add custom attributes to the app

After setting up the Connected App, you can add custom attributes:

1. Click **Manage**, then expand the **Custom Connected App Handler** section.
2. Under **Custom Attributes**, click **New**. Each attribute must have a unique key and use fields available from the **Insert Field** menu.

| Name | Name Format | Value | Required? |
| --- | --- | --- | --- |
| `urn:oid:2.5.4.42` | Unspecified | `user.firstName` | **Yes** |
| `urn:oid:2.5.4.4` | Unspecified | `user.lastName` | **Yes** |
| `urn:oid:2.5.4.20` | Unspecified | `user.phoneNumber` | **Yes** |
| `urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress` | Unspecified | `user.email` | **Yes** |
| `https://dashboard.socure.com/attributes/role` | URI Reference | `String.join(",", appuser.RoleName)` | **Optional** |

3. Click **Save**.

To manage what role(s) a user should have when they access RiskOS™, add a **new custom attribute**:  
- **Data type:** string array  
- **Display Name:** `https://dashboard.socure.com/attributes/role`  
- **Variable Name:** RoleName  
- **Enum:** Checked  
- **Attribute Members:**  
  
The following table lists the valid role names available in RiskOS™:

| Example Display Name | Value |
| --- | --- |
| Admin | administrator |
| Acc Owner | account owner |
| Dev | developer |
| Fraud Analyst | fraud analyst |
| Compliance Analyst | compliance analyst |
| Compliance Officer | compliance officer |
| Compliance Supervisor | compliance supervisor |

### 3. Send the SAML metadata to Socure

After setting up the Connected App and adding custom attributes, generate the **SAML metadata file** and securely share it with Socure.

#### Steps to retrieve and send metadata:
1. Go to **Apps > Connected Apps > Manage Connected Apps**.
2. Select the **SAML app**, then click **Manage**.
3. Under **SAML Login Information**, click **Download Metadata**.
4. Send the metadata file to Socure using a secure communication method.

**Important: Customers must provide two separate metadata files to Socure:**
- One for the RiskOS™ Sandbox environment
- One for the RiskOS™ Production environment

### 4. Test the integration

To test the SAML integration, go to the IdP Admin Console, create a user, assign Socure's RiskOS™ app to the user and assign role(s) via the custom RoleName SAML attribute. When the user launches the RiskOS™ app from the IdP dashboard, the following occurs:

The **Users** tab on the **Users** page in RiskOS™ is populated with the user's name, email address, and phone number.

### 5. Assign users to RiskOS™

If you are planning to manage role assignment to users and you have configured the custom SAML attribute for RoleName, you can assign role(s) to the user when assigning the application. If a role is not assigned, the system will default to assigning Analyst role to the user.