---
schema_version: "1"
id: ce0752a78a3e0329c4ed7da93309e82f53748b53c3eab7f8a2e912246459cdf4
title: Gathering Setup Information for SSO
collection: mulesoft
version: current
locale: en-us
portal_url: https://docs.salesforce.com/mulesoft/current/en-us/api-experience-hub/gathering-set-up-information.md
canonical_url: https://docs.mulesoft.com/api-experience-hub/gathering-set-up-information
source_site: docs.mulesoft.com
content_type: documentation
content_hash: 76dd352b07b8f1cdb924c0ab52eb6819817fc6bba8078900cea335d36ebcff74
description: MuleSoft Documentation Site
latest: true
---
---
product: API Experience Hub
---

# Gathering Setup Information for SSO

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

Use these sections to gather the information you’ll need to set up SSO.

You might need to collaborate with your security team or other team members if you don’t have access
to this information. For more information, see
[User Roles for Configuring SSO](https://docs.mulesoft.com/api-experience-hub/user-roles-permissions-and-profiles#user-roles-for-configuring-sso).

## Username Assignment Strategy for a Shared Identity

If an identity provider is configured for your Anypoint Platform organization, review the username
assignment strategy because it can be different for the portal and Anypoint Platform users.

To have a single identity between the portal and Anypoint Platform, the format for the username
assignment must be the same. If the username strategy doesn’t match, reconcile the username format
by adding attributes for `anypoint_idp_id` and `anypoint_username`. Then, map this information to
the Anypoint Platform identity provider that you are using for SSO.

For more information about adding custom claims when the identity provider is already configured but
not in the required format, see _Required Claims and Attributes for SSO_.

## Required Claims and Attributes for SSO

Be aware of API Experience Hub requirements for claims or attributes when creating a new application
for the portal in the identity provider.

Configuring the required user claims in the identity provider ensures that the user information is
mapped correctly to Salesforce and Anypoint Platform users.

The **AEHPortalRegistrationHandler** requires specific user information from the identity provider
to create or update a user. The registration handler uses required claims to extract user
information. This table lists the required information and which claims the information is extracted
from. If more than one claim exists for the same value, the registration handler looks for the first
expected claim in the order it appears in the table:

<table><colgroup><col> <col></colgroup><thead><tr><th>Field</th><th>Expected Claims</th></tr></thead><tbody><tr><td><p>First Name</p></td><td><p>given_name, first_name, firstname, and firstName</p></td></tr><tr><td><p>Last Name</p></td><td><p>family_name, last_name, lastname, and lastName</p></td></tr><tr><td><p>Email</p></td><td><p>email, email_address, and emailAddress</p></td></tr><tr><td><p>Username</p></td><td><p>preferred_username, federation_identifier, email, sub, and NameId</p></td></tr><tr><td><p>Groups</p></td><td><p>groups</p></td></tr></tbody></table>

To configure SSO when the identity provider is already configured for Anypoint Platform, use this
information:

<table><colgroup><col> <col> <col></colgroup><thead><tr><th>Field</th><th>Description</th><th>Expected Values</th></tr></thead><tbody><tr><td><div><div><p>Anypoint Idp Id</p></div></div></td><td><div><div><p>Map identities to the specific identity provider in Anypoint Platform.</p></div></div></td><td><div><div><p>anypoint_idp_id</p></div></div></td></tr><tr><td><div><div><p>Anypoint Username</p></div></div></td><td><div><div><p>Explicitly specify the Anypoint Platform user if the user’s identity exists in Anypoint Platform, but the username is different than the Salesforce user.</p></div></div></td><td><div><div><p>anypoint_username</p></div></div></td></tr></tbody></table>

If the required information is not in the supported format, create a new custom attribute or claim
with the supported format. For information, see the documentation for the identity provider.

## See Also

- [User Roles for Configuring SSO](https://docs.mulesoft.com/api-experience-hub/user-roles-permissions-and-profiles#user-roles-for-configuring-sso)

- [Configuring SSO](https://docs.mulesoft.com/api-experience-hub/configuring-sso)