---
schema_version: "1"
id: 8da9982185e0af31b8d94780d13514f8aa01b63590ca389fb97f5b6c56de5278
title: Configuring SSO
collection: mulesoft
version: current
locale: en-us
portal_url: https://docs.salesforce.com/mulesoft/current/en-us/api-experience-hub/configuring-sso.md
canonical_url: https://docs.mulesoft.com/api-experience-hub/configuring-sso
source_site: docs.mulesoft.com
content_type: documentation
content_hash: 2a58be4f538ef885668b4e0de4cfcbaf9c29ce451af5cea507d1c7e259c9493b
description: MuleSoft Documentation Site
latest: true
---
---
product: API Experience Hub
---

# Configuring SSO

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

Configure identity management in Anypoint Platform and Salesforce to set up users for single sign-on
(SSO).

API Experience Hub supports multiple IdPs for SSO.

## Before You Begin

Before configuring SSO, ensure you have the following permissions, context, and setup:

- Organization Administrator permission or role in the main Anypoint Platform organization.

- System Administrator role in Salesforce.

- Experience with identity management and setting up identity providers for SSO.

- Review Access Management’s [Identity Provider](https://docs.mulesoft.com/access-management/external-identity)
  documentation to understand identity management for Anypoint Platform.

- In the identity provider of your choice, the users or identities must exist for the users with
  access to the application. For information, see the identity provider’s documentation.

- Review the information in [Gathering Setup Information for SSO](https://docs.mulesoft.com/api-experience-hub/gathering-set-up-information).

## Step 1: Enable SSO for Your Portal

To enable SSO, an identity provider is required for Anypoint Platform to create identities in
Anypoint Platform for Salesforce users.

In this step, you create an application in the identity provider for the API Experience Hub portal,
enable the ability to send group information in the application configuration, configure groups, and
configure the default identity provider. Performing these steps require you to move back and forth
between applications and the identity provider application to copy or add information.

### Create and Configure an Application

Create and configure an application using one of these example methods:

Okta OpenID Connect

Create a new application for the API Experience Hub portal in the identity provider using OpenID
Connect.

1.  In Okta, create an OpenID Connect Web application. For more information, see
    [Create OIDC app integrations](https://help.okta.com/oie/en-us/content/topics/apps/apps_app_integration_wizard_oidc.htm).

2.  From the **General Settings** section, complete these fields:

    <table><colgroup><col> <col></colgroup><thead><tr><th>Field</th><th>Value</th></tr></thead><tbody><tr><td><div><div><p><strong>App integration name</strong></p></div></div></td><td><div><div><p>Enter a name for the app.</p></div></div></td></tr><tr><td><div><div><p><strong>Grant type</strong></p></div></div></td><td><div><div><p>Select <strong>Authorization Code</strong>.</p></div></div></td></tr><tr><td><div><div><p><strong>Assignments</strong></p></div></div></td><td><div><div><p>Select <strong>Limit access to selected groups</strong>.</p></div></div></td></tr><tr><td><div><div><p><strong>Selected group(s)</strong></p></div></div></td><td><div><div><p>Enter the name of the group who must have access to the application.</p></div></div></td></tr></tbody></table>

3.  Verify that your identity provider sends the expected claims listed in the
    [Required Claims and Attributes](https://docs.mulesoft.com/api-experience-hub/gathering-set-up-information#required-claims-and-attributes-for-sso).

4.  Configure the claims that the application sends.

    For example, for OpenID Connect for Okta, configure the groups claim using these steps:

    1.  From the **Sign On** tab, click **Edit** from the **OpenID Connect ID Token** section.

    2.  From **Groups claim type**, select **Filter**.

    3.  From **Groups claim filter**, enter `groups`.

    4.  Select **Matches regex for the expression** then enter `.*` for wildcard.

        ![An example of the Groups Claim Filter](/mulesoft/current/en-us/api-experience-hub/_images/aeh-groups-claim-filter.png)

5.  Configure an authentication provider for Salesforce using OpenID Connect.

    You set up the auth provider or SSO settings in Salesforce with the identity provider
    application information.

    1.  From the OpenID Connect application, get these configuration values:

        - **Client ID**

        - **Client Secret**

        - **Authorize Endpoint URL**

        - **Token Endpoint URL**

        - **User Info Endpoint URL**

    2.  In **Salesforce**, go to **Setup**.

    3.  In the **Quick Find** box, enter `Auth`, and then select **Auth. Providers**.

    4.  Click **New** and select **OpenID Connect** for the **Provider Type**.

    5.  Complete these fields:

        <table><colgroup><col> <col></colgroup><thead><tr><th>Field</th><th>Value</th></tr></thead><tbody><tr><td><div><div><p><strong>Provider Type</strong></p></div></div></td><td><div><div><p><strong>OpenID Connect</strong></p></div></div></td></tr><tr><td><div><div><p><strong>Name</strong></p></div></div></td><td><div><div><p>Enter a name for the provider.</p></div></div></td></tr><tr><td><div><div><p><strong>Consumer Key</strong></p></div></div></td><td><div><div><p>Enter the client ID from the identity provider.</p></div></div></td></tr><tr><td><div><div><p><strong>Consumer Secret</strong></p></div></div></td><td><div><div><p>Enter the client secret from the identity provider.</p></div></div></td></tr><tr><td><div><div><p><strong>Authorize Endpoint URL</strong></p></div></div></td><td><div><div><p>Enter <code><a href="https://{domainofOktaorg}.okta.com/oauth2/v1/authorize*">https://{domainofOktaorg}.okta.com/oauth2/v1/authorize*</a></code>.</p></div></div></td></tr><tr><td><div><div><p><strong>Token Endpoint URL</strong></p></div></div></td><td><div><div><p>Enter <code><a href="https://{domainofOktaorg}.okta.com/oauth2/v1/token">https://{domainofOktaorg}.okta.com/oauth2/v1/token</a></code>.</p></div></div></td></tr><tr><td><div><div><p><strong>User Info Endpoint URL</strong></p></div></div></td><td><div><div><p>Enter <code><a href="https://{domainofOktaorg}.okta.com/oauth2/v1/userinfo">https://{domainofOktaorg}.okta.com/oauth2/v1/userinfo</a></code>.</p></div></div></td></tr><tr><td><div><div><p><strong>Default Scopes</strong></p></div></div></td><td><div><div><p><strong>profile openid email groups</strong></p></div></div></td></tr><tr><td><div><div><p><strong>Registration handler</strong></p></div></div></td><td><div><div><p><strong>AEHPortalRegistrationHandler</strong></p></div></div></td></tr><tr><td><div><div><p><strong>Execute Registration As</strong></p></div></div></td><td><div><div><p>Select an administrator user.</p></div></div></td></tr></tbody></table>

        ![An example of Salesforce Auth. Provider](/mulesoft/current/en-us/api-experience-hub/_images/aeh-salesforce-auth-provider.png)

    6.  Click **Save**.

6.  Configure the redirect URIs for the portal.

    To configure the redirects, use your 15-digit organization ID and 18-digit org ID and add a URL
    for each organization ID.

    1.  In the Okta application, select the **General** tab. Add the following URLs for **Sign-in
        redirect URIs**:

        - `https://login.salesforce.com/services/authcallback/${15DigitSalesforceOrganizationId}/${authProviderURLSuffix}`

        - `https://login.salesforce.com/services/authcallback/${18DigitSalesforceOrganizationId}/${authProviderURLSuffix}`

        - `https://${domain}.my.site.com/aeh/services/authcallback/${authProviderURLSuffix}`

          ![An example of Redirect URIs](/mulesoft/current/en-us/api-experience-hub/_images/aeh-sso-redirect-uris.png)

          To find the URLs:

        - For salesforceOrganizationId, go to **Setup > Company Information**.

        - For authProviderURLSuffix, go to **Setup > Auth Providers**, click your auth provider, and
          select **URL Suffix**.

        - For domain, go to **Setup > My Domain > Current My Domain URL**.

**Map the Application to the Identity Provider for Anypoint Platform** NOTE: Skip this step if
you’re configuring a new identity provider for Anypoint Platform. Go to
[Step 2: Add Salesforce Identity Providers](#step-2-add-salesforce-identity-providers).

If there’s an existing identity provider already configured for Anypoint Platform, you must map the
identity provider ID with the anypoint\_idp\_id by adding and configuring a new custom attribute
called anypoint\_idp\_id.

If usernames for the portal and Anypoint Platform don’t match, add another custom attribute called
anypoint\_username to force an update for existing identity provider users to match the identity in
the portal to the users in Anypoint Platform.

To map anypoint\_idp\_id to with the Anypoint Platform identity provider ID for Okta:

1.  In the Okta application, go to **Directory > Profile Editor** and select the portal application
    that you just configured.

2.  Click **Add Attributes** to create a new attribute called **anypoint\_idp\_id**.

3.  Complete these fields:

    <table><colgroup><col> <col></colgroup><thead><tr><th>Field</th><th>Value</th></tr></thead><tbody><tr><td><p><strong>Display name</strong></p></td><td><p><strong>anypoint_idp_id</strong></p></td></tr><tr><td><p><strong>Value name</strong></p></td><td><p><strong>anypoint_idp_id</strong></p></td></tr></tbody></table>

4.  Save your changes.

5.  Go to **Access Management > Identity Providers** and click the identity provider.

6.  From the browser URL, copy the 32 digit ID.

    ![An example of the 32-digit ID located in the browser URL.](/mulesoft/current/en-us/api-experience-hub/_images/aeh-sso-32-digit-id.png)

7.  Go to **Okta > Directory > Profile Editor** and click **Mappings**

8.  Paste the ID into the empty field for the new anypoint\_idp\_id attribute. The ID must be in
    quotes.

9.  From the yellow arrow drop-down menu, select **Apply mapping on user create and update**.

    ![An example of a mapped anypoint\_idp\_id attribute](/mulesoft/current/en-us/api-experience-hub/_images/aeh-sso-mapped-anypoint-idp-id-attribute.png)

10. Save your changes.

11. Apply the mappings to all users in the profile.

    If the user already exists and logs in to the portal before the anypoint\_idp\_id is set, the
    default identity provider AEH Users - ${salesforceOrganizationId} is used. To prevent the user
    from being duplicated, the user isn’t added to the new identity provider specified in the
    anypoint\_idp\_id field.

    If the user already exists in Salesforce and uses SSO to log in to the portal, the API
    Experience Hub Member User permission set is assigned to that user (if no permission set is
    already assigned).

12. To reconcile the usernames assignment for a single identity in the portal and Anypoint Platform:

    1.  In the Okta application, go to **Directory > Profile Editor** and select the portal
        application that you just configured.

    2.  Click **Add Attributes** to create a new attribute called **anypoint\_username**.

    3.  Complete these fields:

        <table><colgroup><col> <col></colgroup><thead><tr><th>Field</th><th>Value</th></tr></thead><tbody><tr><td><p><strong>Display name</strong></p></td><td><p><strong>anypoint_username</strong></p></td></tr><tr><td><p><strong>Value name</strong></p></td><td><p><strong>anypoint_username</strong></p></td></tr></tbody></table>

    4.  Save your changes.

    5.  Click **Mappings**.

    6.  In the empty field of the new **anypoint\_username** attribute, enter
        `String.substringBefore(user.login, "@")`. Since Okta usernames are email-based, this
        expression removes the email domain.

13. From the yellow arrow drop-down menu, select **Apply mapping on user create and update**.

    ![Example of a mapped anypoint\_username attribute](/mulesoft/current/en-us/api-experience-hub/_images/aeh-sso-mapped-anypoint-username-attribute.png)

    1.  Save your changes.

Okta SAML

Create a new application for the API Experience Hub portal in the identity provider using SAML. For
more information, see
[Create SAML app integrations](https://help.okta.com/oie/en-us/content/topics/apps/apps_app_integration_wizard_saml.htm)
in the Okta documentation.

1.  From Okta, create a SAML application and enter a name for your SAML application in **General
    Settings**.

2.  Select **Do not display application icon to users** and click **Next**.

3.  In **SAML Settings**, complete these fields:

    <table><colgroup><col> <col></colgroup><thead><tr><th>Field</th><th>Value</th></tr></thead><tbody><tr><td><div><div><p><strong>Single Sign-On URL</strong></p></div></div></td><td><div><div><p>Enter the URL for the portal login.</p></div></div></td></tr><tr><td><div><div><p><strong>Use this for Recipient URL and Destination URL</strong></p></div></div></td><td><div><div><p>Select this option.</p></div></div></td></tr><tr><td><div><div><p><strong>Audience URI (SP Entity ID)</strong></p></div></div></td><td><div><div><p>Enter https with the Salesforce domain for example, <code>https://{salesforcedomain}.com</code>.</p></div></div></td></tr><tr><td><div><div><p><strong>Name ID format</strong></p></div></div></td><td><div><div><p><strong>EmailAddress</strong></p></div></div></td></tr><tr><td><div><div><p><strong>Application username</strong></p></div></div></td><td><div><div><p><strong>Okta username</strong></p></div></div></td></tr><tr><td><div><div><p><strong>Update application username on</strong></p></div></div></td><td><div><div><p><strong>Create and update</strong></p></div></div></td></tr></tbody></table>

    ![An example of SAML Settings](/mulesoft/current/en-us/api-experience-hub/_images/aeh-sso-saml-settings.png)

4.  Review the
    [gathering-set-up-information.adoc#required-claims-and-attributes-for-sso](https://docs.mulesoft.com/api-experience-hub/gathering-set-up-information#required-claims-and-attributes-for-sso)for
    information about what API Experience Hub expects for claims to properly map users in the
    identity provider.

5.  In the **Attribute Statements (optional)** section, configure the SAML integration by adding
    these custom attributes. For supported formats, see the supported format for user attributes
    listed in
    [gathering-set-up-information.adoc#required-claims-and-attributes-for-sso](https://docs.mulesoft.com/api-experience-hub/gathering-set-up-information#required-claims-and-attributes-for-sso):

    <table><colgroup><col> <col> <col></colgroup><thead><tr><th>Name</th><th>Name format</th><th>Value</th></tr></thead><tbody><tr><td><div><div><p><strong>first_name</strong></p></div></div></td><td><div><div><p><strong>Unspecified</strong></p></div></div></td><td><div><div><p><strong>user.firstName</strong></p></div></div></td></tr><tr><td><div><div><p><strong>last_name</strong></p></div></div></td><td><div><div><p><strong>Unspecified</strong></p></div></div></td><td><div><div><p><strong>user.lastName</strong></p></div></div></td></tr><tr><td><div><div><p><strong>email</strong></p></div></div></td><td><div><div><p><strong>Unspecified</strong></p></div></div></td><td><div><div><p><strong>user.email</strong></p></div></div></td></tr><tr><td><div><div><p><strong>groups</strong></p></div></div></td><td><div><div><p><strong>Unspecified</strong></p></div></div></td><td><div><div><p><strong>(",", getFilteredGroups({"00gdkat3p5RCvkQQC5d7", "00gdjgk337kYDxtE35d7"}, "group.name", 40))</strong></p></div></div></td></tr></tbody></table>

    ![An example of the SAML Attribute Statements](/mulesoft/current/en-us/api-experience-hub/_images/aeh-sso-saml-attribute-statements.png)

    The example IDs, 00gdkat3p5RCvkQQC5d7 and 00gdjgk337kYDxtE35d7 correspond to the groups that you
    want to send. Ensure that you send all Anypoint Platform groups when you’re configuring Okta in
    Anypoint Platform. Otherwise, the user can lose access.

6.  Enable multi-valued SAML attributes when sending multiple groups in the groups claim.

    Sending groups as a comma-separated list isn’t required.

    1.  Navigate to **Salesforce** > **Setup**.

    2.  From **Setup**, in the Quick Find box, enter `Custom Metadata Types`, and then select
        **Custom Metadata Types**.

    3.  Click **Manage Records** for **API Experience Hub Configuration**.

    4.  Click **Edit** for the **Default** record, select the **Enable Multi-Valued SAML
        Attributes** checkbox, and then click **Save**.

7.  Click **Next**, select **I’m an Okta customer adding an internal app**, and then click
    **Finish**.

8.  Select the **Assignments** tab and select **Groups**.

9.  Click **Assign** and select **Assign to groups**.

10. From the list, click **Assign** from the row of the specific group and click **Done**.

11. Select the **Sign On** tab, and click **View SAML setup instructions** to see instructions about
    how to configure SAML for your application.

    ![A button that shows the SAML setup instructions](/mulesoft/current/en-us/api-experience-hub/_images/aeh-sso-view-saml-setup-instructions.png)

12. Get this information from the instructions page to configure the **Single Sign-on Settings** tab
    in Salesforce:

    - **Identity Provider Single Sign-On URL**

    - **Identity Provider Issuer**

    - **X.509 Certificate (download the certificate)**

      ![SAML instructions to configure SAML](/mulesoft/current/en-us/api-experience-hub/_images/aeh-sso-saml-setup-instructions-page.png)

13. Go to **Salesforce > Setup** and search for **Single Sign-On Settings**.

14. From **Single Sign-On Settings** in the **Federated Single Sign-On Using SAML** section, select
    **SAML Enabled** and click **Save**.

15. From **Single Sign-On Settings**, click **Edit** and complete these fields:

    <table><colgroup><col> <col></colgroup><thead><tr><th>Field</th><th>Value</th></tr></thead><tbody><tr><td><div><div><p><strong>Issuer</strong></p></div></div></td><td><div><div><p>Match the <strong>Identity Provider Issuer</strong> from the <strong>View SAML setup instructions</strong>.</p></div></div></td></tr><tr><td><div><div><p><strong>Entity ID</strong></p></div></div></td><td><div><div><p>Match the <strong>Audience Restriction</strong> you set in the application.</p></div></div></td></tr><tr><td><div><div><p><strong>Identity Provider Certificate</strong></p></div></div></td><td><div><div><p>Upload the certificate previously downloaded from the <strong>View SAML setup instructions</strong>.</p></div></div></td></tr><tr><td><div><div><p><strong>SAML Identity Type</strong></p></div></div></td><td><div><div><p>Assertion contains the <strong>Federation ID</strong> from the user object.</p></div></div></td></tr><tr><td><div><div><p><strong>SAML Identity Location</strong></p></div></div></td><td><div><div><p>Identity is in the <strong>NameIdentified</strong> element of the <strong>Subject</strong> statement.</p></div></div></td></tr><tr><td><div><div><p><strong>Identity Provider Login URL</strong></p></div></div></td><td><div><div><p>Match the <strong>Identity Provider Single Sign-On URL</strong> from the <strong>View SAML setup instructions</strong>.</p></div></div></td></tr><tr><td><div><div><p><strong>Custom Logout URL</strong></p></div></div></td><td><div><div><p>Okta URL</p></div></div></td></tr><tr><td><div><div><p><strong>User Provisioning</strong></p></div></div></td><td><div><div><p><strong>Enabled</strong></p></div></div></td></tr><tr><td><div><div><p><strong>User Provisioning Type</strong></p></div></div></td><td><div><div><p><strong>Custom SAML JIT with Apex Handler</strong></p></div></div></td></tr><tr><td><div><div><p><strong>SAML JIT Handler</strong></p></div></div></td><td><div><div><p><strong>AEHPortalRegistrationHandler</strong></p></div></div></td></tr><tr><td><div><div><p><strong>Execute Handler As</strong></p></div></div></td><td><div><div><p>Select a system administrator.</p></div></div></td></tr></tbody></table>

    ![An example of the SAML Single Sign-On Settings](/mulesoft/current/en-us/api-experience-hub/_images/aeh-sso-saml-single-sign-on-settings.png)

Microsoft Entra ID SAML for Cloud

Create a new application for the API Experience Hub portal in the identity provider using Microsoft
Entra ID. Microsoft Entra ID for OpenID Connect isn’t supported.

1.  In Azure, create a SAML Enterprise application:

    1.  Go to the Azure administration portal or enter
        `[https://portal.azure.com](https://portal.azure.com)` in a browser.

    2.  Go to Microsoft Entra ID (Active Directory service), click **Add**, and select **Enterprise
        application**.

    3.  In **Browse Microsoft Entra Gallery**, select the **Salesforce** application.

    4.  Enter a name like **AEH Portal** and click **Create**.

2.  Configure the single sign-on settings for the application:

    1.  From **Manage**, select **Single sign-on** and select **SAML**.

    2.  From **Basic SAML Configuration**, click **Edit**.

    3.  Complete these required fields:

        <table><colgroup><col> <col></colgroup><thead><tr><th>Field</th><th>Value</th></tr></thead><tbody><tr><td><div><div><p>Identifier (Entity ID)</p></div></div></td><td><div><div><p><code>https://&lt;YOUR_DOMAIN&gt;.my.site.com/aeh</code></p></div></div></td></tr><tr><td><div><div><p>Reply URL (Assertion Consumer Service URL)</p></div></div></td><td><div><div><p><code>https://&lt;YOUR_DOMAIN&gt;.my.site.com/aeh/login</code></p></div></div></td></tr><tr><td><div><div><p>Sign on URL</p></div></div></td><td><div><div><p><code>https://&lt;YOUR_DOMAIN&gt;.my.site.com/aeh/login</code></p></div></div></td></tr><tr><td><div><div><p>Logout Url (Optional)</p></div></div></td><td><div><div><p><code>https://&lt;YOUR_DOMAIN&gt;.my.site.com/aeh/services/auth/sp/saml2/logout</code></p></div></div></td></tr></tbody></table>

    4.  Save your changes.

3.  Configure the required first name, last name, email, and username claims that the application
    sends:

    1.  From **Attributes & Claims**, click **Edit**.

    2.  Click **Add a group claim**, select **All Groups** or any other option except **None**, and
        click **Save**.

        At least one group must be associated to perform a group mapping in a later step.

    3.  Add a new claim for each required claim by clicking **\+ Add new claim** and completing
        these fields for each claim:

        - First Name

          <table><colgroup><col> <col></colgroup><thead><tr><th>Field</th><th>Value</th></tr></thead><tbody><tr><td><div><div><p>Name</p></div></div></td><td><div><div><p>firstName</p></div></div></td></tr><tr><td><div><div><p>Source attribute</p></div></div></td><td><div><div><p>user.givenname</p></div></div></td></tr></tbody></table>

        - Last Name

          <table><colgroup><col> <col></colgroup><thead><tr><th>Field</th><th>Value</th></tr></thead><tbody><tr><td><div><div><p>Name</p></div></div></td><td><div><div><p>lastName</p></div></div></td></tr><tr><td><div><div><p>Source attribute</p></div></div></td><td><div><div><p>user.surname</p></div></div></td></tr></tbody></table>

        - Email

          <table><colgroup><col> <col></colgroup><thead><tr><th>Field</th><th>Value</th></tr></thead><tbody><tr><td><div><div><p>Name</p></div></div></td><td><div><div><p>email</p></div></div></td></tr><tr><td><div><div><p>Source attribute</p></div></div></td><td><div><div><p>user.mail</p></div></div></td></tr></tbody></table>

        - Username

          <table><colgroup><col> <col></colgroup><thead><tr><th>Field</th><th>Value</th></tr></thead><tbody><tr><td><div><div><p>Name</p></div></div></td><td><div><div><p>http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name</p></div></div></td></tr><tr><td><div><div><p>Source attribute</p></div></div></td><td><div><div><p>user.userprincipalname</p></div></div></td></tr></tbody></table>

API Experience Hub uses the value of the
`http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name` claim as the username, which must be
email-shaped for Salesforce to accept it. The Microsoft Entra ID `user.userprincipalname` attribute
is email-shaped by default. If this claim is not present, API Experience Hub uses the value of the
email claim instead.

1.  Save your changes.

    1.  Enable multi-valued SAML attributes when sending multiple groups in the groups claim.

        Sending groups as a comma-separated list isn’t required.

2.  Navigate to **Salesforce** > **Setup**.

3.  From **Setup**, in the Quick Find box, enter `Custom Metadata Types`, and then select **Custom
    Metadata Types**.

4.  Click **Manage Records** for **API Experience Hub Configuration**.

5.  Click **Edit** for the **Default** record, select the **Enable Multi-Valued SAML Attributes**
    checkbox, and then click **Save**.

    1.  If this single sign-on is already configured in Anypoint Platform, map the application to
        the identity provider for Anypoint Platform using a new custom attribute, `anypoint_idp_id`.

6.  Click **\+ Add new claim** and complete these fields:

    <table><colgroup><col> <col></colgroup><thead><tr><th>Field</th><th>Value</th></tr></thead><tbody><tr><td><div><div><p>Name</p></div></div></td><td><div><div><p>anypoint_idp_id</p></div></div></td></tr><tr><td><div><div><p>Source attribute</p></div></div></td><td><div><div><p>"&lt;identity_provider_id&gt;" The ID must be in quotes.</p></div></div></td></tr></tbody></table>

    To get the identity provider ID, go to **Access Management > Identity Providers**, click the
    identity provider, and copy the 32-digit ID from the browser URL.

    ![An example identity provider ID in Access Management](/mulesoft/current/en-us/api-experience-hub/_images/aeh-identity-provider-id-azure.png)

7.  Save your changes.

    1.  If usernames for the portal and Anypoint Platform are different, add another custom
        attribute named `anypoint_username`. This attribute updates existing identity provider users
        to match the identities in the portal and Anypoint Platform.

8.  Click **\+ Add new claim** and complete these fields:

    <table><colgroup><col> <col></colgroup><thead><tr><th>Field</th><th>Value</th></tr></thead><tbody><tr><td><div><div><p>Name</p></div></div></td><td><div><div><p>anypoint_username</p></div></div></td></tr><tr><td><div><div><p>Source attribute</p></div></div></td><td><div><div><p>Define an attribute for example, ExtractMailPrefix (user.mail)</p></div></div></td></tr></tbody></table>

9.  Save your changes.

10. From **Source**, select **Transformation** and complete these fields:

    <table><colgroup><col> <col></colgroup><thead><tr><th>Field</th><th>Value</th></tr></thead><tbody><tr><td><div><div><p>Transformation</p></div></div></td><td><div><div><p>ExtractMailPrefix()</p></div></div></td></tr><tr><td><div><div><p>Parameter 1</p></div></div></td><td><div><div><p>Attribute</p></div></div></td></tr><tr><td><div><div><p>Attribute name</p></div></div></td><td><div><div><p>user.mail</p></div></div></td></tr></tbody></table>

11. Click **Add**.

12. From **Manage claim**, save your changes.

13. Create single sign-on settings in Salesforce:

    1.  Select **Single Sign-on** and click **Download** from **Federation Metadata XML** in the
        **SAML Certificates** section.

    2.  Go to **Salesforce > Setup > Single Sign-On Settings** and click **New from Metadata File**.

    3.  From **Metadata File**, click **Choose File**, select the Federation Metadata XML file, and
        click **Create**.

    4.  Complete these fields:

        <table><colgroup><col> <col></colgroup><thead><tr><th>Field</th><th>Value</th></tr></thead><tbody><tr><td><div><div><p>Name</p></div></div></td><td><div><div><p>Enter a name.</p></div></div></td></tr><tr><td><div><div><p>API Name</p></div></div></td><td><div><div><p>Enter a name.</p></div></div></td></tr><tr><td><div><div><p>Entity ID</p></div></div></td><td><div><div><p>Enter the value from the Azure Enterprise application’s <strong>Identifier (Entity ID)</strong> field. For example, <code><a href="https://&lt;YOUR_DOMAIN&gt;.my.site.com/aeh">https://&lt;YOUR_DOMAIN&gt;.my.site.com/aeh</a></code>.</p></div></div></td></tr><tr><td><div><div><p>SAML Identity Type</p></div></div></td><td><div><div><p>Assertion contains the Federation ID from the User object.</p></div></div></td></tr><tr><td><div><div><p>Just-in-time User Provisioning</p></div></div></td><td><div><div><p>Enabled</p></div></div></td></tr><tr><td><div><div><p>User Provisioning Type</p></div></div></td><td><div><div><p>SAML JIT with Apex handler</p></div></div></td></tr><tr><td><div><div><p>SAML JIT Handler</p></div></div></td><td><div><div><p>AEHPortalRegistrationHandler</p></div></div></td></tr><tr><td><div><div><p>Execute Handler As</p></div></div></td><td><div><div><p>Select a system administrator.</p></div></div></td></tr></tbody></table>

    5.  Save your changes.

## Step 2: Add Salesforce Identity Providers

After the identity provider is configured for Salesforce, add and enable the identity provider from
the API Experience Hub UI. When the identity provider is enabled, users can log in to the portal
using this identity provider.

1.  Go to **API Experience Hub > User management** and click **Login settings**.

2.  From the **Single sign-on (SSO)** section, scroll down to step 2 **Add Salesforce identity
    providers**.

3.  Click **Select identity provider** and select an option from the drop-down menu.

4.  Click **\+ Add identity provider** and move the slider to **Enabled**.

## Step 3: Add Group Mappings

When setting up SSO for the portal, your users must have an identity in both Salesforce and Anypoint
Platform. SSO users are mapped to teams using their group names. You must map your users to teams
using Access Management. API Experience Hub provides an out-of-the-box team called **AEH Portal -
${salesforceOrganizationId}\_${salesforceCommunityId}** that is added automatically as a team in
Access Management.

Add group mappings by adding the user to the corresponding profile in API Experience Hub:

1.  Go to **Access Management** > **Teams**.

2.  Click **AEH Portal Guests** and click **AEH Portal Members** > **External IdP Groups**.

3.  Complete these fields:

    <table><colgroup><col> <col></colgroup><thead><tr><th>Field</th><th>Value</th></tr></thead><tbody><tr><td><div><div><p>Group Name</p></div></div></td><td><div><div><p>Enter <code>AEH Members</code> or enter the value of the groups claim.</p></div></div></td></tr><tr><td><div><div><p>Provider Name</p></div></div></td><td><div><div><p>The name of the corresponding Salesforce identity provider.</p></div></div></td></tr><tr><td><div><div><p>Type</p></div></div></td><td><div><div><p>Member.</p></div></div></td></tr></tbody></table>

4.  From **Type**, click **Add**.

    ![The External IdP Groups page from Access Management](/mulesoft/current/en-us/api-experience-hub/_images/aeh-sso-access-mgmt-ext-idp-groups.png)

5.  Save your changes.

    The SSO users associated with the group you designated are assigned to the team.

## Step 4: Test the SSO Configuration

Verify that the SSO for the portal is configured properly.

1.  Open an incognito window in a browser and go to your API Experience Hub portal.

2.  Select the SSO option that you configured.

3.  Log in with a user that belongs to the group you configured in the identity provider for your
    portal.

4.  Check the visibility of APIs for the user in the portal.

5.  Go to **Access Management** and select **Users**.

6.  Search using the username to confirm that the user is mapped to the expected identity provider.

7.  Go to the team with the configured group mappings.

    From the **Members** tab, ensure that you can see your user there.

## See Also

- [Troubleshooting Single Sign-On Errors](https://docs.mulesoft.com/api-experience-hub/troubleshoot-sso-errors)