> ## Documentation Index
> Fetch the complete documentation index at: https://clumio.reclear.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Configure single sign-on

> Configure SAML single sign-on and group-based user provisioning for Clumio.

Clumio documents SAML setup separately for nine identity providers. This page demonstrates how one
maintained hub could explain the shared workflow and route administrators to provider-specific steps.

<Warning>
  This is an information-architecture prototype. Use the linked Clumio guides for current production
  instructions.
</Warning>

## The shared setup workflow

<Steps>
  <Step title="Get Clumio's service-provider details">
    In the Clumio dashboard, open the SSO configuration and copy the Assertion Consumer Service URL
    and Entity ID. Download the service-provider metadata file if your identity provider accepts one.
  </Step>

  <Step title="Configure the identity provider">
    Create or configure the Clumio SAML application in the identity provider. Add Clumio's Entity ID,
    Assertion Consumer Service URL, and required email claim. The exact field names differ by provider.
  </Step>

  <Step title="Add the identity-provider metadata to Clumio">
    Return to Clumio and provide the identity-provider metadata URL, XML file, or manual SAML
    configuration supported by that provider.
  </Step>

  <Step title="Test before enabling SSO">
    Test the configuration with an administrator account before enabling SSO for other users. Keep a
    recovery path available until the login has been confirmed.
  </Step>
</Steps>

## Provider guides

| Provider             | Clumio guide                                                                                                                   |
| -------------------- | ------------------------------------------------------------------------------------------------------------------------------ |
| AD FS                | [Configure SSO for AD FS](https://documentation.commvault.com/clumio/configuring_sso_for_ad_fs.html)                           |
| Auth0                | [Configure SSO for Auth0](https://documentation.commvault.com/clumio/configuring_sso_for_auth0.html)                           |
| Duo                  | [Configure SSO for Duo](https://documentation.commvault.com/clumio/configuring_sso_for_duo.html)                               |
| Google               | [Configure SSO for Google](https://documentation.commvault.com/clumio/configuring_sso_for_google.html)                         |
| Microsoft Entra ID   | [Configure SSO for Microsoft Entra ID](https://documentation.commvault.com/clumio/configuring_sso_for_microsoft_entra_id.html) |
| Okta                 | [Configure SSO for Okta](https://documentation.commvault.com/clumio/configuring_sso_for_okta.html)                             |
| OneLogin             | [Configure SSO for OneLogin](https://documentation.commvault.com/clumio/configuring_sso_for_onelogin.html)                     |
| PingID               | [Configure SSO for PingID](https://documentation.commvault.com/clumio/configuring_sso_for_pingid.html)                         |
| Shibboleth with Gluu | [Configure SSO for Shibboleth](https://documentation.commvault.com/clumio/configuring_sso_for_shibboleth_using_gluu.html)      |

## Automatic user provisioning

Clumio documents group-based user provisioning for Okta and Microsoft Entra ID. Administrators map
identity-provider groups to Clumio roles and organisational units, then enable auto user provisioning
in **Administration > Access Management > Auto user provisioning**.

<CardGroup cols={2}>
  <Card title="Provision users with Okta" icon="users" href="https://documentation.commvault.com/clumio/provisioning_users_with_okta.html" arrow>
    Configure group claims and map Okta groups to Clumio access rules.
  </Card>

  <Card title="Provision users with Microsoft Entra ID" icon="users" href="https://documentation.commvault.com/clumio/provisioning_users_with_microsoft_entra_id.html" arrow>
    Configure group claims and map Entra ID groups to Clumio access rules.
  </Card>
</CardGroup>

<Note>
  Authentication and authorisation remain separate. SSO confirms the user's identity. Clumio roles and
  organisational units determine what that user can access.
</Note>