SAML reference
Configuration fields, service provider values, and technical specifications
Print user authentication fields
Configured under Account Settings → Settings → User Authentication Providers → SAML 2.0.
Dynamic configuration
| Field | Required | Description |
|---|---|---|
| Entity ID | Yes | The unique URL identifying the identity provider, also called the Issuer. In Azure: Microsoft Entra Identifier. Typically starts with https://sts.windows.net. |
| Metadata Location | Yes | URL where the identity provider's SAML metadata is hosted. Pharos Cloud retrieves SSO URL, certificate, and endpoints automatically. In Azure: App Federation Metadata URL. Must be publicly accessible. |
| Email Field | No | The assertion attribute containing the user's email address. Default: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress. Change only if your identity provider uses a non-standard attribute name. |
Manual configuration
| Field | Required | Description |
|---|---|---|
| Entity ID | Yes | Unique URL identifying the identity provider. |
| Single Sign-In URL | Yes | URL where HP Insights redirects users to authenticate. |
| Signing Certificate | Yes | X.509 certificate from the identity provider. Used to validate assertion signatures. Must be updated whenever the identity provider rotates its certificate. |
| Single Sign-Out URL | No | URL where users are redirected on logout. If empty, users are logged out of HP Insights only. |
| Email Field | No | Assertion attribute containing the email address. Default: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress. |
| Sign Authentication Request | No | Whether HP Insights signs the initial authentication request. Default: Yes. |
HP Insights service provider values
When configuring your identity provider, use these values for theHP Insights service provider. Download the full SAML metadata file from Account Settings → Settings → User Authentication Providers → SAML Metadata.
| Value | Description |
|---|---|
| ACS URL |
The HP Insights endpoint where the identity provider sends the
SAML assertion. Found in the SAML metadata file under
AssertionConsumerService Location. Examples:
|
| Entity ID | The unique identifier for HP Insights as a service provider. Found in the metadata file as the entityID parameter. In Azure, this is the Identifier (Entity ID). |
| X.509 Certificate | HP Insights's public certificate. Used by the identity provider to validate signed authentication requests. Found in the metadata file as the X509Certificate value. |
| Binding | HTTP POST for SSO. HTTP Redirect for logout. |
| Initiation type | SP-initiated only. IdP-initiated SSO is not supported. |
| SAML version | SAML 2.0 only. |
Microsoft Entra ID field mapping
Quick reference for translating between HP Insights terminology and Microsoft Entra ID.
| HP Insights | Microsoft Entra ID | Direction |
|---|---|---|
| Entity ID (IdP) | Microsoft Entra Identifier | Azure → HP Insights |
| Single Sign-In URL | Login URL | Azure → HP Insights |
| Single Sign-Out URL | Logout URL | Azure → HP Insights |
| Metadata Location | App Federation Metadata URL | Azure → HP Insights |
| ACS URL | Reply URL (Assertion Consumer Service URL) | HP Insights → Azure |
| Entity ID (SP) | Identifier (Entity ID) | HP Insights → Azure |
SAML SSO error codes
The following error codes are returned by the HP Insights Identity Service during SAML sign-in and sign-out. Use these codes to identify the cause of authentication failures.
| Code | Error |
|---|---|
| 8000 | InvalidSamlProviderConfiguration — The SAML provider configuration is invalid. Check all fields in the SAML configuration for missing or incorrect values. |
| 8001 | UnknownSamlSsoSignInError — An unexpected error occurred during SAML sign-in. Contact HP Support. |
| 8002 | InvalidSamlSsoSignInResponseError — The SAML response received from the identity provider is invalid. Verify the ACS URL and signing certificate are correct. |
| 8003 | UnknownSamlSsoSignOutError — An unexpected error occurred during SAML sign-out. Contact HP Support. |
| 8004 | InvalidSamlSsoSignOutResponseError — The SAML sign-out response is invalid. Verify the Single Sign-Out URL is correctly configured. |
| 8005 | SamlProviderConfigurationNotInitializedError — The SAML provider has not been initialised. Save the SAML configuration and try again. |
| 8006 | InvalidSamlProviderIdError — The identity provider ID in the assertion does not match the configured Entity ID. Verify the Entity ID in the SAML configuration. |
| 8007 | SamlUserEmailNotFoundError — The SAML assertion does not contain an email address. Verify the Email Field (or Email Attribute Name) matches the attribute your identity provider uses to send the email address. |
| 8008 | InvalidSamlSsoSignInEmailKeyNotFoundError — The email key specified in the configuration was not found in the assertion. Check the Email Field value in the SAML configuration. |
| 8009 | InvalidSamlSsoSignInPathError — The sign-in path in the SAML response is invalid. Contact HP Support. |
| 8010 | InvalidSamlSsoSignInEmptyAssertionError — The SAML assertion returned by the identity provider is empty. Verify the identity provider is correctly configured to return assertions and that the signing certificate is current. |