---
title: Adding a SAML Duende Dynamic Provider
---

## Setting up an SAML Dynamic Provider

### Step 3: Define the Service Provider

Here is where you define the Service Provider. Be aware that your IDS acts as the Service Provider in the SAML connection:

| Name                           | Required | Type           | Description |
| ------------------------------ | -------- | -------------- | ----------- |
| `SP Entity Id`                 | Yes      | Text           | String that uniquely identifies this Service Provider |
| `Callback path (ACS endpoint)` | Yes      | Text           | Relative path to redirect an authenticated user after sign-in. If you use Duende Dynamic Authentication, it must start with the configured prefix, the default value is '/federation/' |

![Wizard Name](img/adding/adminui-dynamicprovider-saml-sp.png)

### Step 4: Certificate

Here we can setup an optional certificate that can be used by your Service Provider to sign requests. This helps to ensure that requests are coming from a legitimate source.

- If you don't want to setup this certificate just click on 'Next'.

- If you want to add a certificate, enter a certificate file and password and then, click on the "Test" button to validate the certificate.

- If you change your mind, click Clear to remove the certificate.

| Name           | Required | Type           | Description |
| -------------- | -------- | -------------- | ----------- |
| `Certificate`  | Yes      | File           | Certificate in PFX or P12 format |
| `Password`     | Yes      | Text           | Password protecting the certificate selected |

![Wizard Name](img/adding/adminui-dynamicprovider-saml-cert.png)

### Step 5: Define IdP Metadata Address

Here we setup the connection to the external Identity Provider:

| Name                         | Required | Type           | Description |
| ---------------------------- | -------- | -------------- | ----------- |
| `Idp Metadata Address`       | Yes      | Text           | Metadata address of the Identity Provider. It has a button to verify the address is reachable and that contains a well-formated metadata. |

![Wizard Name](img/adding/adminui-dynamicprovider-saml-idp.png)

### Step 6: Sign-In Scheme

Here we select the Sign in Scheme that will handle authentication:

| Name             | Required | Type           | Description |
| ---------------- | -------- | -------------- | ----------- |
| `Sign in Scheme` | Yes      | Text           | Sign in Scheme representing an authentication handler on your IDS code |

The interface offers default schemes for IdentityServer and Asp.Identity in the form of radio buttons. These options will automatically populate the Sign in Scheme field. However, you also have the flexibility to manually enter a different scheme if desired.

![Wizard Name](img/adding/adminui-dynamicprovider-saml-signin-scheme.png)

#### IdentityServer Overriding Sign In/Out Schemes

Depending on how Identity Server's SAML plug-in is configured this setting could be overridden. If 'SignInScheme' or 'SignOutScheme' are set in Saml2pAuthenticationOptions in Identity Server then these will override the settings configured in AdminUI.

The following is a code fragment that shows a way these setting could be configured:

```language-csharp
services.AddIdentityServer(...)
    .AddSamlDynamicProvider(options =>
    { 
        options.SignInScheme = "MySignInScheme";
        options.SignOutScheme = "MySignOutScheme";
    });
```

### Step 7: Summary

The final step in the creation process is a summary that will allow you to review the settings for the dynamic provider as a whole and then also go back and make changes. There is also the option to disable the provider if you do not wish it to be active immediately.

![Wizard Summary](img/adding/adminui-dynamicprovider-saml-summary.png)