> ## Documentation Index
> Fetch the complete documentation index at: https://docs.invoca.com/llms.txt
> Use this file to discover all available pages before exploring further.

# SAML SSO: Appendix

> Reference examples for SAML SSO configuration — a full example SAML response and an ADFS claim rule — for use alongside [SAML SSO Setup](/s/article/jhdcp92865-570).

This article contains reference examples for SSO/SAML configuration and is intended for use alongside [SAML SSO Setup](/s/article/jhdcp92865-570).

## Example SAML response from an identity provider

```xml theme={null}
<?xml version="1.0"?>
<samlp:Response xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="Rd92460ad52365f80a510f2889c22b1b86396ba62" Version="2.0" IssueInstant="2016-11-14T23:11:02Z" Destination="{recipient}" InResponseTo="_7a646410-8ced-0134-2432-245e60e67313">
  <saml:Issuer>https://app.onelogin.com/saml/metadata/590777</saml:Issuer>
  <samlp:Status>
    <samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/>
  </samlp:Status>
  <saml:Assertion xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" Version="2.0" ID="pfx80a30bac-f594-0e63-9c09-3acd65d62052" IssueInstant="2016-11-14T23:11:02Z">
    <saml:Issuer>https://app.onelogin.com/saml/metadata/590777</saml:Issuer>
    <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
      <ds:SignedInfo>
        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
        <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
        <ds:Reference URI="#pfx80a30bac-f594-0e63-9c09-3acd65d62052">
          <ds:Transforms>
            <ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
            <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
          </ds:Transforms>
          <ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
          <ds:DigestValue>...</ds:DigestValue>
        </ds:Reference>
      </ds:SignedInfo>
      <ds:SignatureValue>...</ds:SignatureValue>
      <ds:KeyInfo>
        <ds:X509Data>
          <ds:X509Certificate>...</ds:X509Certificate>
        </ds:X509Data>
      </ds:KeyInfo>
    </ds:Signature>
    <saml:Subject>
      <saml:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:emailAddress">user@example.com</saml:NameID>
      <saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
        <saml:SubjectConfirmationData NotOnOrAfter="2016-11-14T23:14:02Z" Recipient="{recipient}" InResponseTo="_7a646410-8ced-0134-2432-245e60e67313"/>
      </saml:SubjectConfirmation>
    </saml:Subject>
    <saml:Conditions NotBefore="2016-11-14T23:08:02Z" NotOnOrAfter="2016-11-14T23:14:02Z">
      <saml:AudienceRestriction>
        <saml:Audience>Invoca_SAML_Service_Provider</saml:Audience>
      </saml:AudienceRestriction>
    </saml:Conditions>
    <saml:AuthnStatement AuthnInstant="2016-11-14T23:11:01Z" SessionNotOnOrAfter="2016-11-15T23:11:02Z" SessionIndex="_87b36510-8ced-0134-f243-0a760235ce19">
      <saml:AuthnContext>
        <saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml:AuthnContextClassRef>
      </saml:AuthnContext>
    </saml:AuthnStatement>
    <saml:AttributeStatement>
      <saml:Attribute Name="first_name" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic">
        <saml:AttributeValue xsi:type="xs:string">Jane</saml:AttributeValue>
      </saml:Attribute>
      <saml:Attribute Name="time_zone" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic">
        <saml:AttributeValue xsi:type="xs:string">America/Los_Angeles</saml:AttributeValue>
      </saml:Attribute>
      <saml:Attribute Name="organization_type" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic">
        <saml:AttributeValue xsi:type="xs:string">Affiliate</saml:AttributeValue>
      </saml:Attribute>
      <saml:Attribute Name="organization_id_from_network" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic">
        <saml:AttributeValue xsi:type="xs:string">34</saml:AttributeValue>
      </saml:Attribute>
      <saml:Attribute Name="role" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic">
        <saml:AttributeValue xsi:type="xs:string">Reporting</saml:AttributeValue>
      </saml:Attribute>
      <saml:Attribute Name="last_name" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic">
        <saml:AttributeValue xsi:type="xs:string">Doe</saml:AttributeValue>
      </saml:Attribute>
      <saml:Attribute Name="contact_phone_number" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic">
        <saml:AttributeValue xsi:type="xs:string">555-000-1234</saml:AttributeValue>
      </saml:Attribute>
    </saml:AttributeStatement>
  </saml:Assertion>
</samlp:Response>
```

## ADFS email-to-NameID transform claim

```text theme={null}
c:[Type == "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress"]
 => issue(Type = "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier",
   Issuer = c.Issuer, OriginalIssuer = c.OriginalIssuer, Value = c.Value, ValueType = c.ValueType,
   Properties["http://schemas.xmlsoap.org/ws/2005/05/identity/claimproperties/format"] = "urn:oasis:names:tc:SAML:2.0:nameid-format:emailAddress");
```

## Where to go next

<CardGroup>
  <Card title="SAML SSO Setup" icon="key" href="/s/article/jhdcp92865-570" horizontal />

  <Card title="Configure SSO with Okta" icon="lock" href="/s/article/configure-sso-with-okta" horizontal />
</CardGroup>