Add a generic single sign-on provider

The generic identity provider configuration enables Genesys Cloud customers to integrate with most identity providers that support SAML 2.0. 

Configure your organization’s identity provider

Get the certificate for Genesys Cloud configuration

Find and download your identity provider’s encoded public certificate for SAML signature validation.

Get the metadata for Genesys Cloud configuration

Find and download your identity provider’s metadata file containing the issuer (entityID), single sign-on URL, and Single Logout URL for configuring Genesys Cloud in your organization’s identity provider account.

Provide the Assertion Consumer Service (ACS) URL

When prompted to enter the Assertion Consumer Service (ACS) URL, select the appropriate URL based on your AWS deployment region.

Provide the Single Logout URL

When prompted to enter the Single Logout URL, select the appropriate URL based on your AWS deployment region.

Provide the Service Provider Entity ID

When prompted to enter the Service Provider Entity ID, the value can be any unique string that you want to use to identify your Genesys Cloud organization. The field is also sometimes called Issuer or Audience URI.

Provide the Genesys Cloud Signing Certificate

When prompted to enter a signing certificate, upload the file obtained from Genesys cloud.

1. In Genesys Cloud, click Admin.
2. Under Integrations, click Single Sign-on.
3. Click the Generic SSO Provider tab.
4. Under Genesys Cloud Signing Certificate, click Download Certificate.
5. Save the file.

Configure user attributes and claims

Configure these Genesys Cloud user attributes for your identity provider. The attributes are case-sensitive. 

Configure Genesys Cloud

1. In Genesys Cloud, click Admin.
2. Under Integrations, click Single Sign-on.
3. Click the Generic SSO Provider tab.

4. Enter the metadata gathered from your organization’s identity provider.

   Field	Description
   Provider Logo	Insert an SVG image, no larger than 25 KB.
   Provider Name	Type the identity provider name.
   The Provider’s Certificate	To upload X.509 certificates for SAML signature validation, do one of the following. To upload a certificate, click Select Certificates to upload. Select the X.509 certificate. Click Open. Optionally, to load a backup certificate, repeat steps 1–3. Or you can: Drag and drop your certificate file. Optionally, to load a backup certificate, repeat the first step. Uploaded certificates appear with their expiration date. To remove a certificate, click X. Note: To renew or update an expiring certificate, follow these instructions to upload X.509 certificates, repeating steps 1--3. You can upload up to five certificates to Genesys Cloud per SSO configuration, and Genesys Cloud chooses the correct certificate during single sign-on and logout.
   The Provider’s Issuer URI	Enter the entityID provided in the identity provider’s metadata file.
   Target URL	Enter the Single Sign On URL provided in the identity provider’s metadata file.
   Single Logout URI	Enter the Single Logout URL provided in the identity provider’s metadata file.
   Single Logout Binding	Choose the same binding as the one selected in the identity provider. If no binding is specified, choose HTTP Redirect.
   Relying Party Identifier	Enter the string to identify Genesys Cloud to the identity provider.  Note: If the identity providers expect the service provider to specify the relying party identifier, enter a string to input both Genesys Cloud and the identity provider. If the identity providers generate a relying party identifier in their metadata file, enter that string.
   Name Identifier Format	Choose the Name Identifier Format that your identity provider supports. If your provider supports EmailAddress, that is the preferred format. If no Name Identifier Format is known, choose Unspecified.

5. (Optional) Select Endpoint Compression to compress the Genesys Cloud authentication request. Make sure to select and clear this field only if the identity provider does not support compression for the HTTP Redirect binding.
6. Click Save.