Skip to main content

SAML authentication

View Markdown

To authenticate the users of your Temporal Cloud account, you can connect an identity provider (IdP) to your account by using Security Assertion Markup Language (SAML) 2.0.

info

SAML is included on all Temporal Cloud plans. See the pricing page for details.

Integrate SAML with your Temporal Cloud account​

  1. Locate your Temporal Cloud Account Id. Your Account Id can be viewed and copied from the Temporal Cloud user profile dropdown menu in the top right corner. Alternatively, find your Namespace Id. The Account Id is the five or six characters following the period (.), such as f45a2. You will need the Account Id to construct your callback URL and your entity identifier.
  2. Configure SAML with your IdP:
  3. Share your connection information with us and test your connection.

How to configure SAML with Microsoft Entra ID​

If you want to use the general Microsoft login mechanism, you don't need to set up SAML with Entra ID. Just select Continue with Microsoft on the Temporal Cloud sign-in page.

To use Entra ID as your SAML IdP, create a Microsoft Entra ID Enterprise application.

  1. Sign in to the Microsoft Entra ID.

  2. On the home page, under Manage Microsoft Entra ID, select View.

  3. On the Overview page near the top, select Add > Enterprise application.

  4. On the Browse Microsoft Entra ID Gallery page near the top, select Create your own application.

  5. In the Create your own application pane, provide a name for your application (such as temporal-cloud) and select Integrate any other application you don't find in the gallery.

  6. Select Save.

  7. In the Getting Started section, select 2. Set up single sign on.

  8. On the Single sign-on page, select SAML.

  9. In the Basic SAML Configuration section of the SAML-based Sign-on page, select Edit.

  10. In Identifier (Entity ID), enter the following entity identifier, including your Account Id where indicated:

    urn:auth0:prod-tmprl:ACCOUNT_ID-saml

    A correctly formed entity identifier looks like this:

    urn:auth0:prod-tmprl:f45a2-saml

  11. In Reply URL (Assertion Consumer Service URL), enter the following callback URL, including your Account Id where indicated:

    https://login.tmprl.cloud/login/callback?connection=ACCOUNT_ID-saml

    A correctly formed callback URL looks like this:

    https://login.tmprl.cloud/login/callback?connection=f45a2-saml

  12. In Sign on URL, enter the following login url, including your Account Id where indicated:

    https://cloud.temporal.io/login/saml?connection=ACCOUNT_ID-saml

    A correctly formed login URL looks like this:

    https://cloud.temporal.io/login/saml?connection=f45a2-saml

  13. You can leave the other fields blank. Near the top of the pane, select Save.

  14. In the Attributes & Claims section, select Edit. Configure the following settings. Under Required claim:

    • Set Unique User Identifier (NameID) to user.userprincipalname
    • Set the NameID format to emailAddress

    These are the default settings for Microsoft Entra ID. Then under Additional claims, ensure Email and Name are present.

  15. Collect information that you need to send to us:

    • In the SAML Certificates section of the SAML-based Sign-on page, select the download link for Certificate (Base64).
    • In the Set up APPLICATION_NAME section of the SAML-based Sign-on page, copy the value of Login URL.

To finish setting up Microsoft Entra ID as your SAML IdP, see Finish SAML configuration.

How to configure SAML with Okta​

To use Okta as your SAML IdP, configure a new Okta application integration.

  1. Sign in to the Okta Admin Console.

  2. In the left navigation pane, select Applications > Applications.

  3. On the Applications page, select Create App Integration.

  4. In the Create a new app integration dialog, select SAML 2.0 and then select Next.

  5. On the Create SAML Integration page in the General Settings section, provide a name for your application (such as temporal-cloud) and then select Next.

  6. In the Configure SAML section in Single sign on URL, enter the following callback URL, including your Account Id where indicated:

    https://login.tmprl.cloud/login/callback?connection=ACCOUNT_ID-saml

    A correctly formed callback URL looks like this:

    https://login.tmprl.cloud/login/callback?connection=f45a2-saml

  7. In Audience URI (SP Entity ID), enter the following entity identifier, including your Account Id where indicated:

    urn:auth0:prod-tmprl:ACCOUNT_ID-saml

    A correctly formed entity identifier looks like this:

    urn:auth0:prod-tmprl:f45a2-saml

  8. We require the user's full email address when connecting to Temporal.

    • In Name ID format, select EmailAddress.
    • In Attribute Statements, set email and name.

  9. Select Next.

  10. In the Feedback section, select Finish.

  11. On the Applications page, select the name of the application integration you just created.

  12. On the application integration page, select the Sign On tab.

  13. Under SAML Setup, select View SAML setup instructions.