> ## Documentation Index
> Fetch the complete documentation index at: https://syteca.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Configure ForgeRock SSO Integration

> Set up SAML 2.0 Single Sign-On between ForgeRock Access Management and the Syteca Management Tool.

This page configures SAML 2.0 authentication between ForgeRock Access Management (AM) and the Syteca Management Tool. See [SSO integration overview](/docs/administration/integrations/sso) for what SSO integration does and the Management Tool settings shared across every provider.

<Steps>
  <Step title="Log in to the Management Tool">
    Log in as a user with administrator permissions.
  </Step>

  <Step title="Open SSO Integration settings">
    Click **Configuration** at the top of the Management Tool, then select the **SSO Integration** tab.
  </Step>

  <Step title="Enter the issuer and upload the metadata">
    Set **Issuer name** to your Management Tool URL, and upload your identity provider metadata under **Identity provider metadata (xml)** using **Choose File**.
  </Step>

  <Step title="Optionally upload a custom certificate">
    Select **Custom certificate**, upload the certificate file, and enter the **Certificate password**.
  </Step>

  <Step title="Review the auto-create account setting">
    <Note>
      The **Auto-create a Management Tool account for a new user on the first SSO login** checkbox is selected by default. See [SSO integration overview](/docs/administration/integrations/sso#what-every-integration-configures-in-common) for what this controls.
    </Note>
  </Step>

  <Step title="Save and download the Management Tool metadata">
    Click **Save**, then download the metadata using the metadata URL shown, and download the signing certificate using **Download signing certificate**.
  </Step>

  <Step title="Import the certificate into ForgeRock">
    Import the downloaded certificate into the ForgeRock trusted store. See ForgeRock's own documentation for this step.
  </Step>

  <Step title="Create an entity provider in ForgeRock">
    In the ForgeRock AM Admin UI, go to **Applications → Federation → Entity Providers**, create a new remote service, and upload the metadata downloaded from the Management Tool.
  </Step>

  <Step title="Configure the remote service settings">
    Define the remote service settings as required by your ForgeRock environment.
  </Step>

  <Step title="Verify the integration">
    On the Management Tool login page, click **Log in with SSO** to confirm the integration works.
  </Step>
</Steps>

<Frame caption="A new remote service created under ForgeRock AM's Entity Providers section.">
  <img src="https://mintcdn.com/syteca/0FlD-vkHsBA1azVX/images/administration/integrations/sso-forgerock-entity-provider.png?fit=max&auto=format&n=0FlD-vkHsBA1azVX&q=85&s=9c20aa388f8471dfc63597f3ed2e031f" alt="ForgeRock AM Entity Providers page with a new remote service" width="1058" height="850" data-path="images/administration/integrations/sso-forgerock-entity-provider.png" />
</Frame>

<Note>
  SSO authentication is not currently supported in [Multi-Tenant mode](/docs/administration/multi-tenant/overview).
</Note>

## Related

<CardGroup cols={2}>
  <Card title="SSO integration overview" icon="key" href="/docs/administration/integrations/sso">
    All supported SSO providers and shared Management Tool settings.
  </Card>

  <Card title="Azure SSO" icon="microsoft" href="/docs/administration/integrations/sso-azure">
    Configure SSO through Azure instead.
  </Card>

  <Card title="Okta SSO" icon="shield" href="/docs/administration/integrations/sso-okta">
    Configure SSO through Okta instead.
  </Card>

  <Card title="User management" icon="users" href="/docs/administration/users/users">
    Managing Management Tool user accounts and permissions.
  </Card>
</CardGroup>