> ## Documentation Index
> Fetch the complete documentation index at: https://bigbluebutton.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# SAML Auth

> Administrators can connect Personal Rooms to their institution's SAML identity provider so users sign in with their existing credentials.

SAML (Security Assertion Markup Language) is an authentication and authorization protocol used for single sign-on and identity management. Connecting Personal Rooms to your SAML identity provider lets your users sign in with the institutional credentials they already have.

<Note>
  SAML support is in beta. It has been tested successfully with OpenCAS (which runs on Shibboleth), ClassLink, QuickLaunchSSO, and Azure AD.
</Note>

## What we need from you

In your institution's SAML identity provider, add two new apps or service providers: one for Personal Rooms Staging and one for Personal Rooms Production.

Set up Staging before Production. The staging environment lets us update your Personal Rooms instance with minimal downtime to your production environment.

Contact [support@blindsidenetworks.com](mailto:support@blindsidenetworks.com) for the metadata descriptor and callback URLs for your region, along with the customer identifier to use.

## Required parameters

Include the following parameters as part of the launch:

* **user\_id** — a unique user ID in your context.
* **email** — the user's email address.
* **firstname** — normally found as `givenName` or `GivenName`.
* **lastname** — normally found as `Surname`.

## Optional parameters

You may also want to add:

* **image** — a URL to the user's avatar. Applies only if your Personal Rooms site has avatars enabled.
* **roles** — a string with the role the user should be authenticated in Personal Rooms. Applies only if you use different functionality profiles per role.

## Identity provider metadata

We also need the descriptor for your identity provider. Send us either:

* An endpoint where we can retrieve your SAML IdP `EntityDescriptor` — a metadata file containing your public certificate, endpoint, and other information about your IdP, **or**
* The fingerprint of your certificate, together with the endpoint of your IdP.