> For the complete documentation index, see [llms.txt](https://docs.collibra.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.collibra.com/data-quality-self-hosted/admin-configuration/more-admin-settings/multi-tenancy-and-tenant-manager/configuring-sso-for-tenant-manager.md).
# Configuring SSO for Tenant Manager
Tenant Manager is a separate DQ application for managing multi-tenant environments. The following steps describe how to enable single sign-on (SSO) for the Tenant Manager. For more information on Tenant Manager, see [Using Tenant Manager](/data-quality-self-hosted/admin-configuration/more-admin-settings/multi-tenancy-and-tenant-manager/using-tenant-manager.md).
{% hint style="warning" %}
The Tenant Manager is considered a new application by the entity provider (Idp). Do not change any existing IdP or SSO configuration settings for the DQ Web application.
{% endhint %}
## Configure the identity provider for the new application
Begin by configuring the IdP for the Tenant Manager application.
{% stepper %}
{% step %}
Set the **Identifier (Entity ID)** for the new IdP application as `DQTenantManager`. Do not change the existing entity ID for the original SSO application.
{% endstep %}
{% step %}
Set the **Reply URL (Assertion Consumer Service URL)** for the new IdP application to the following (replacing `{host}` with your DQ host endpoint):
`https://{host}/tenant/saml/sso/tenantmanager`
{% endstep %}
{% step %}
Assign tenant admin users to the IdP application.
{% endstep %}
{% step %}
Assign tenant admin groups to the IdP application.
{% endstep %}
{% endstepper %}
## Set the SAML authentication properties
Add the following properties to your configuration.
{% tabs %}
{% tab title="Standalone" %}
{% stepper %}
{% step %}
Add the following property to your owl-env.sh file:
`export SAML_TENANT_MANAGER_ENABLED=true`
{% endstep %}
{% step %}
Add additional properties as needed (see below). Prefix each property with the export statement.
{% endstep %}
{% step %}
Restart the DQ Web application.
{% endstep %}
{% endstepper %}
{% endtab %}
{% tab title="Cloud Native" %}
{% stepper %}
{% step %}
Add the following property as an environment variable to your DQ-web Configmap:
`SAML_TENANT_MANAGER_ENABLED: true`
{% endstep %}
{% step %}
Add additional properties as needed (see below)
{% endstep %}
{% step %}
Recycle the pod.
{% endstep %}
{% endstepper %}
{% endtab %}
{% endtabs %}
### Required properties
| Property | Description |
| --------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| SAML\_ENTITY\_BASEURL | The base URL that is provided in the service provider metadata. It is used to generate the ACS URL, which is the entity base URL with /saml/sso appended to it. It must include a port number if one is configured on the IdP side.
Once you have enabled and configured SAML authentication, you can download the service provider metadata from https\://\/saml/metadata/SSO.
If you use Data Quality & Observability (self-hosted) with a Java version older than 21, such as Java 11, download your service provider metadata from https\://\/saml/metadata instead.
Whether the application needs to configure a load balancer.
You generally need this setting only when the Load Balancer is set for SSL Termination.
The default value is false.
If set to true, you must also provide a value for SAML\_LB\_SERVER\_NAME.
If the SAML\_LB\_EXISTS property is set to true and SAML\_LB\_INCLUDE\_PORT\_IN\_REQUEST set to false, you may need to update SAML\_ENTITY\_BASEURL to include the port in the URL. The SAML\_ENTITY\_BASEURL should match the IdP's ACS URL.
The attribute in which the identity provider stores the role of the user authenticating in the SAML response.
The default value is memberOf.
|
| SAML\_USER\_NAME\_PROP | The name of the attribute in the SAML response that contains the username of the user who is authenticating. |
| SAML\_KEYSTORE\_FILE | The path to the keystore for SSL validation.
The store should contain the keypair of the identity provider for SSL verification.
|
| SAML\_KEYSTORE\_PASS | The password for the keystore provided in `SAML_KEYSTORE_FILE`. |
| SAML\_KEYSTORE\_ALIAS | The alias of the keypair (private and public) in the keystore used for SSL verification. |
| LOCAL\_REGISTRATION\_ENABLED | Allows you to display or hide the registration link for local users on the Collibra DQ sign-in page. Because the registration link is displayed on the sign-in page by default, this property is set to true.To display or hide the registration link from the owl-env.sh file, select from the following properties:
- export LOCAL\_REGISTRATION\_ENABLED=true: Displays the registration link on the sign-in page for local users. This is set to
true by default. - export LOCAL\_REGISTRATION\_ENABLED=false: Hides the registration link on the sign-in page for local users.
To display or hide the registration link from a K8s ConfigMap, select the from the following properties:
- LOCAL\_REGISTRATION\_ENABLED:"true": Displays the registration link on the sign-in page for local users. This is set to
true by default. - LOCAL\_REGISTRATION\_ENABLED:"false": Hides the registration link on the sign-in page for local users.
This property must be set globally on deployment.
| Property | Description |
|---|
| SAML_LB_INCLUDE_PORT_IN_REQUEST | Whether to include the port number in the request. The default value is false. |
| SAML_LB_PORT | The port number of the load balancer. The default value is 443. |
| SAML_LB_SCHEME | The protocol of the load balancer. The default value is https. |
| SAML_LB_SERVER_NAME | The server or DNS name. Usually, the same as SAML_ENTITY_BASEURL without specifying the protocol, for example without https://. This property is required and has no default. Don't include a trailing slash at the end of this value. A trailing slash can cause the base URL and port number to be parsed incorrectly, which results in authentication failures. |
| SAML_LB_CONTEXT_PATH | Any path that may be defined on the load balancer. |
## Update settings in Tenant Manager
When you are ready with your IdP settings, add the final configuration settings in the Tenant Manager:
{% stepper %}
{% step %}
Sign in to Tenant Manager using the **Sign in as Tenant Manager** link.
{% endstep %}
{% step %}
Click 
in the left navigation pane.\ :chevrons-right: The SAML Security Settings page opens.
{% endstep %}
{% step %}
Click the **SAML Enabled** dropdown menu, then select **Enabled**.
{% endstep %}
{% step %}
Under the SAML Enabled dropdown menu, to the far right side of the page, click 
.\ :chevrons-right: The Add Meta Data Configuration dialog box appears.
{% endstep %}
{% step %}
Enter the required information.
| Option | Description |
| --------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Meta-Data URL | The URL of the identity provider metadata XML file or the location of the downloaded XML file.
The name of the XML file must begin with the prefix file: and typically uses file:/opt/owl/config/idp-metadata.xml format.