[Yandex Cloud documentation](../../../index.md) > [Yandex Identity Hub](../../index.md) > [Step-by-step guides](../index.md) > Managing apps (SSO) > SAML apps > Updating an app

# Updating a SAML app in Yandex Identity Hub


SAML apps can be managed by users with the `organization-manager.samlApplications.admin` [role](../../security/index.md#organization-manager-samlApplications-admin) or higher.

## Update the app's basic settings {#update-basic-settings}

To update the [SAML app's basic settings](../../concepts/applications.md#saml):

{% list tabs group=instructions %}

- Cloud Center UI {#cloud-center}

  1. Log in to [Yandex Identity Hub](https://center.yandex.cloud/organization).
  1. In the left-hand panel, select ![shapes-4](../../../_assets/console-icons/shapes-4.svg) **Apps** and then, the SAML app.
  1. On the top right, click ![pencil](../../../_assets/console-icons/pencil.svg) **Edit** and in the window that opens:

      1. Change the app's name in the **Name** field. The name must be unique within the organization and follow the naming requirements:

          * It must be from 1 to 63 characters long.
          * It may contain lowercase Latin letters, numbers, and hyphens.
          * It must start with a letter and cannot end with a hyphen.

      1. Change the app's description in the **Description** field.
      1. Add new [labels](../../../resource-manager/concepts/labels.md) by clicking **Add label** in the **Labels** field. Click ![xmark](../../../_assets/console-icons/xmark.svg) to delete an existing label.
    
  1. Under **Service provider (SP) configuration**:

     1. In the **SP EntityID ** field, enter the unique service provider ID. The value must be the same on the service provider's and Yandex Identity Hub side.
     1. In the **ACS URL** field, specify the URL Yandex Identity Hub will send the SAML response to. To provide multiple addresses, click **Add URL**. The ACS URL must follow the `https` schema. You can only use an encryption-free protocol for testing purposes on a local host (`http://127.0.0.1` and `http://localhost` values).
     1. In the **SP Logout URL** field, specify the address to which the IdP will send the SAML response after the user successfully logs out.
     1. In the **Signature mode** field, specify the SAML response elements that will be digitally signed:

       * `Assertions`: Only the provided user attributes.
       * `Response`: Full SAML response.
       * `Assertions and Response`: Full SAML response and, separately, the provided attributes.

  1. Optionally, enable **Only accept signed requests** to only accept requests signed with one of the added certificates. Add certificates:

     1. Click **Add certificate**.
     1. In the window that opens, select the addition method and attach the file or specify the text contents of your certificate.
     1. Click **Add**.

     You need to upload the public key certificate obtained from the service provider, which will be used to verify the signature to enable this feature.

  1. Optionally, enable **Encrypt assertion in response** to encrypt the SAML response using the selected certificate:

     1. Select **Data encryption algorithm** and **Data encryption algorithm**.
     1. Add a certificate:

        1. Click **Add certificate**.
        1. In the window that opens, select the addition method and attach the file or specify the text contents of your certificate.
        1. Click **Add**.

     You need to upload the public key certificate obtained from the service provider, which will be used for encryption.

  1. Click **Save**.

- CLI {#cli}

  If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../../cli/quickstart.md#install).

  The folder used by default is the one specified when [creating](../../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

  1. View the description of the CLI command for updating a SAML app:

     ```bash
     yc organization-manager idp application saml application update --help
     ```
  
  1. Run this command:

     ```bash
     yc organization-manager idp application saml application update \
       --id <app_ID> \
       --new-name <application_name> \
       --description <application_description> \
       --labels <key>=<value>[,<key>=<value>]
     ```

     Where:

     * `--id`: SAML application ID. This is a required setting.
     * `--new-name`: New SAML app name. The name must be unique within the organization and follow the naming requirements:

       * It must be from 1 to 63 characters long.
       * It may contain lowercase Latin letters, numbers, and hyphens.
       * It must start with a letter and cannot end with a hyphen.

     * `--description`: New SAML app description.
     * `--labels`: New list of [labels](../../../resource-manager/concepts/labels.md). You can specify one or more labels separated by commas in `<key1>=<value1>,<key2>=<value2>` format.

     Result:

     ```text
     id: ek0o663g4rs2********
     name: saml-app
     organization_id: bpf2c65rqcl8********
     group_claims_settings:
       group_distribution_type: NONE
     status: ACTIVE
     created_at: "2025-10-21T10:51:28.790866Z"
     updated_at: "2025-10-21T12:37:19.274522Z"
     ```

- Terraform {#tf}

  If you do not have Terraform yet, [install it and configure the Yandex Cloud provider](../../../tutorials/infrastructure-management/terraform-quickstart.md#install-terraform).
  
  
  To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), [authenticate](../../../terraform/authentication.md) using the appropriate method.

  1. Describe the new SAML application parameters in the configuration file:

     ```hcl
     resource "yandex_organizationmanager_idp_application_saml_application" "saml_app" {
       organization_id = "<organization_ID>"
       name            = "<new_application_name>"
       description     = "<new_application_description>"
       labels          = {
         "<key>" = "<value>"
       }
     }
     ```

     Where:

     * `name`: New SAML app name. The name must be unique within the organization and follow the naming requirements:

       * It must be from 1 to 63 characters long.
       * It may contain lowercase Latin letters, numbers, and hyphens.
       * It must start with a letter and cannot end with a hyphen.

     * `description`: New SAML app description.
     * `labels`: New [labels](../../../resource-manager/concepts/labels.md).

     For more on the properties of the `yandex_organizationmanager_idp_application_saml_application` resource, see [this provider guide](../../../terraform/resources/organizationmanager_idp_application_saml_application.md).

  1. Apply the changes:

     1. In the terminal, navigate to the configuration file directory.
     1. Make sure the configuration is correct using this command:
     
        ```bash
        terraform validate
        ```
     
        If the configuration is valid, you will get this message:
     
        ```bash
        Success! The configuration is valid.
        ```
     
     1. Run this command:
     
        ```bash
        terraform plan
        ```
     
        You will see a list of resources and their properties. No changes will be made at this step. Terraform will show any errors in the configuration.
     1. Apply the configuration changes:
     
        ```bash
        terraform apply
        ```
     
     1. Type `yes` and press **Enter** to confirm the changes.

     You can check the changes to the resources and their settings in the [Cloud Center interface](https://center.yandex.cloud/organization).

- API {#api}

  Use the [Application.Update](../../idp/application/saml/api-ref/Application/update.md) REST API method for the [Application](../../idp/application/saml/api-ref/Application/index.md) resource or the [ApplicationService/Update](../../idp/application/saml/api-ref/grpc/Application/update.md) gRPC API call.

{% endlist %}

## Update the service provider configuration {#update-sp}

To update the service provider configuration in a SAML app:

{% list tabs group=instructions %}

- Cloud Center UI {#cloud-center}

  1. Log in to [Yandex Identity Hub](https://center.yandex.cloud/organization).
  1. In the left-hand panel, select ![shapes-4](../../../_assets/console-icons/shapes-4.svg) **Apps** and then, the SAML app.
  1. On the top right, click ![pencil](../../../_assets/console-icons/pencil.svg) **Edit** and in the window that opens:
     
     1. In the **SP EntityID ** field, enter the unique service provider ID.
     
         The value must be the same on the service provider's and Yandex Identity Hub side.
     1. In the **ACS URL** field, specify the URL Yandex Identity Hub will send the SAML response to.
     
         If your service provider uses ACS indexes instead of ACS URLs, in addition to ACS URLs, you can specify the index value you got on the service provider's side.
     
         Optionally, use the **Add URL** button to specify multiple ACS URLs/indexes.
     
         {% note info %}
         
         If you have specified an index for one of the URLs in the **ACS URL** field settings, you must also specify indexes for all the other URLs.
         
         {% endnote %}
     
     1. In the **Signature mode** field, select the elements of the SAML response that will be signed with a digital signature:
     
         * `Assertions`: Only provided attributes will be signed. This is a default value.
         * `Response`: The full SAML response will be signed.
         * `Assertions and Response`: The full SAML response and, separately, the provided attributes will be signed.
         
         {% note warning %}
         
         The signing mode configured for the SAML app on the Yandex Identity Hub side must be the same as the signing mode on the service provider's side.
         
         {% endnote %}
     
     1. Click **Save**.

- CLI {#cli}

  If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../../cli/quickstart.md#install).

  The folder used by default is the one specified when [creating](../../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

  1. View the description of the CLI command for updating the service provider configuration:

     ```bash
     yc organization-manager idp application saml application update --help
     ```

  1. Run this command:

     ```bash
     yc organization-manager idp application saml application update \
       --id <app_ID> \
       --sp-entity-id <service_provider_ID> \
       --acs-urls <URL>[,<URL>] \
       --signature-mode <signature_mode>
     ```

     Where:

     * `--id`: SAML application ID. This is a required setting.
     * `--sp-entity-id`: Unique service provider ID. The value must be the same on the service provider's and Yandex Identity Hub side.
     * `--acs-urls`: URL or comma-separated URLs to which Yandex Identity Hub will send the SAML response. The ACS URL must follow the `https` schema. You can only use an encryption-free protocol for testing purposes on a local host (`http://127.0.0.1` and `http://localhost` values).
     * `--signature-mode`: SAML response elements that will be digitally signed. The possible values are:
       * `assertion_only`: Only the provided user attributes.
       * `response_only`: Full SAML response.
       * `response_and_assertion`: Full SAML response and, separately, the provided attributes.

     Result:

     ```text
     id: ek0o663g4rs2********
     name: saml-app
     organization_id: bpf2c65rqcl8********
     sp_entity_id: https://example.com/saml
     acs_urls:
       - url: https://example.com/saml/acs
     signature_mode: RESPONSE_AND_ASSERTION
     group_claims_settings:
       group_distribution_type: NONE
     status: ACTIVE
     created_at: "2025-10-21T10:51:28.790866Z"
     updated_at: "2025-10-21T12:37:19.274522Z"
     ```

- Terraform {#tf}

  If you do not have Terraform yet, [install it and configure the Yandex Cloud provider](../../../tutorials/infrastructure-management/terraform-quickstart.md#install-terraform).
  
  
  To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), [authenticate](../../../terraform/authentication.md) using the appropriate method.

  1. Describe the new service provider configuration parameters in the configuration file:

     ```hcl
     resource "yandex_organizationmanager_idp_application_saml_application" "saml_app" {
       organization_id = "<organization_ID>"
       name            = "<application_name>"

       service_provider = {
         entity_id = "<service_provider_ID>"
         acs_urls  = [
           {
             url = "URL"
           }
         ]
         security_settings = {
           signature_mode = "RESPONSE_AND_ASSERTIONS"
         }
     }
     ```

     Where:

     * `entity_id`: New unique service provider ID. The value must be the same on the service provider's and Yandex Identity Hub side.
     * `acs_urls`: New URLs Yandex Identity Hub will send the SAML response to. The ACS URL must follow the `https` schema. You can only use an encryption-free protocol for testing purposes on a local host (`http://127.0.0.1` and `http://localhost` values).
     * `signature_mode`: New SAML response elements that will be digitally signed. The possible values are:
       * `ASSERTION_ONLY`: Only the provided user attributes.
       * `RESPONSE_ONLY`: Full SAML response.
       * `RESPONSE_AND_ASSERTION`: Full SAML response and, separately, the provided attributes.

     For more on the properties of the `yandex_organizationmanager_idp_application_saml_application` resource, see [this provider guide](../../../terraform/resources/organizationmanager_idp_application_saml_application.md).

  1. Apply the changes:

     1. In the terminal, navigate to the configuration file directory.
     1. Make sure the configuration is correct using this command:
     
        ```bash
        terraform validate
        ```
     
        If the configuration is valid, you will get this message:
     
        ```bash
        Success! The configuration is valid.
        ```
     
     1. Run this command:
     
        ```bash
        terraform plan
        ```
     
        You will see a list of resources and their properties. No changes will be made at this step. Terraform will show any errors in the configuration.
     1. Apply the configuration changes:
     
        ```bash
        terraform apply
        ```
     
     1. Type `yes` and press **Enter** to confirm the changes.

     You can check the changes to the resources and their settings in the [Cloud Center interface](https://center.yandex.cloud/organization).

- API {#api}

  Use the [Application.Update](../../idp/application/saml/api-ref/Application/update.md) REST API method for the [Application](../../idp/application/saml/api-ref/Application/index.md) resource or the [ApplicationService/Update](../../idp/application/saml/api-ref/grpc/Application/update.md) gRPC API call.

{% endlist %}

## Update a digital signature verification key certificate {#update-cert}

The digital signature verification key certificate for the SAML app is automatically issued when the app is created for a five-year validity period.

You can issue any number of new digital signature verification key certificates for the SAML app at any time. Proceed as follows:

{% list tabs group=instructions %}

- Cloud Center UI {#cloud-center}

  1. Log in to [Yandex Identity Hub](https://center.yandex.cloud/organization).
  1. In the left-hand panel, select ![shapes-4](../../../_assets/console-icons/shapes-4.svg) **Apps** and then, the SAML app.
  1. Under **Application certificate**, click **Certificate management** on the **Overview** tab and in the window that opens:

      1. Click **Generate new certificate**. This will create a new certificate which will appear in the list.
      1. To activate the new certificate, enable **Active** next to it.

          {% note warning %}
          
          In a SAML app, only one certificate can be active. Activating a new certificate automatically deactivates the current one. After you activate the new certificate, do not forget to [upload](saml-create.md#setup-sp) it to the app's integration settings on the service provider’s side.
          
          {% endnote %}

      1. To download the new certificate, click ![ellipsis](../../../_assets/console-icons/ellipsis.svg) next to it and select ![arrow-down-to-line](../../../_assets/console-icons/arrow-down-to-line.svg) **Download**.
      1. To delete the certificate, click ![ellipsis](../../../_assets/console-icons/ellipsis.svg) next to it and select ![trash-bin](../../../_assets/console-icons/trash-bin.svg) **Delete**, then confirm the deletion. You can only delete inactive certificates.
      1. Click **Close**.

- CLI {#cli}

  If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../../cli/quickstart.md#install).

  The folder used by default is the one specified when [creating](../../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

  1. See the description of the CLI command for creating a new certificate:

     ```bash
     yc organization-manager idp application saml signature-certificate create --help
     ```

  1. Create a new certificate:

     ```bash
     yc organization-manager idp application saml signature-certificate create \
       --application-id <app_ID>
     ```

     Where:

     * `--application-id`: SAML application ID.

     Result:

     ```text
     id: ajeq9jfrmc5t********
     application_id: ek0o663g4rs2********
     created_at: "2025-10-21T10:14:17.861652377Z"
     ```

     Save the certificate ID because you will need it to activate the certificate.

  1. View the list of app certificates:

     ```bash
     yc organization-manager idp application saml signature-certificate list \
       --application-id <app_ID>
     ```

  1. Activate a new certificate:

     ```bash
     yc organization-manager idp application saml signature-certificate update \
       --id <certificate_ID> \
       --active true
     ```

     Where:

     * `--id`: Certificate ID you got when creating the certificate.
     * `--active`: Set to `true` to activate the certificate.

     {% note warning %}
     
     In a SAML app, only one certificate can be active. Activating a new certificate automatically deactivates the current one. After you activate the new certificate, do not forget to [upload](saml-create.md#setup-sp) it to the app's integration settings on the service provider’s side.
     
     {% endnote %}

- Terraform {#tf}

  If you do not have Terraform yet, [install it and configure the Yandex Cloud provider](../../../tutorials/infrastructure-management/terraform-quickstart.md#install-terraform).
  
  
  To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), [authenticate](../../../terraform/authentication.md) using the appropriate method.

  1. Describe the resource for creating a new certificate in the configuration file:

     ```hcl
     resource "yandex_organizationmanager_idp_application_saml_signature_certificate" "cert" {
       application_id = "<app_ID>"
       name           = "<certificate_name>"
     }
     ```

     Where:

     * `application_id`: SAML application ID.
     * `name`: Certificate name.

     For more on the properties of the `yandex_organizationmanager_idp_application_saml_signature_certificate` resource, see [this provider guide](../../../terraform/resources/organizationmanager_idp_application_saml_signature_certificate.md).

  1. Create a resource:

     1. In the terminal, navigate to the configuration file directory.
     1. Make sure the configuration is correct using this command:
     
        ```bash
        terraform validate
        ```
     
        If the configuration is valid, you will get this message:
     
        ```bash
        Success! The configuration is valid.
        ```
     
     1. Run this command:
     
        ```bash
        terraform plan
        ```
     
        You will see a list of resources and their properties. No changes will be made at this step. Terraform will show any errors in the configuration.
     1. Apply the configuration changes:
     
        ```bash
        terraform apply
        ```
     
     1. Type `yes` and press **Enter** to confirm the changes.

  1. To activate a new certificate, add it to the SAML application configuration by specifying the certificate ID in the `yandex_organizationmanager_idp_application_saml_application` resource description under `signature_certificate_ids`.
  
  1. Apply the changes:

     1. In the terminal, navigate to the configuration file directory.
     1. Make sure the configuration is correct using this command:
     
        ```bash
        terraform validate
        ```
     
        If the configuration is valid, you will get this message:
     
        ```bash
        Success! The configuration is valid.
        ```
     
     1. Run this command:
     
        ```bash
        terraform plan
        ```
     
        You will see a list of resources and their properties. No changes will be made at this step. Terraform will show any errors in the configuration.
     1. Apply the configuration changes:
     
        ```bash
        terraform apply
        ```
     
     1. Type `yes` and press **Enter** to confirm the changes.

     You can check the changes to the resources and their settings in the [Cloud Center interface](https://center.yandex.cloud/organization).

- API {#api}

  Use the [SignatureCertificate.Create](../../idp/application/saml/api-ref/SignatureCertificate/create.md) REST API method for the [SignatureCertificate](../../idp/application/saml/api-ref/SignatureCertificate/index.md) resource or the [SignatureCertificateService/Create](../../idp/application/saml/api-ref/grpc/SignatureCertificate/create.md) gRPC API call.

{% endlist %}

## Update user and group attributes {#update-attributes}

To update the attributes Yandex Identity Hub will transmit to the service provider:

{% list tabs group=instructions %}

- Cloud Center UI {#cloud-center}

  1. Log in to [Yandex Identity Hub](https://center.yandex.cloud/organization).
  1. In the left-hand panel, select ![shapes-4](../../../_assets/console-icons/shapes-4.svg) **Apps** and select the desired app.
  1. Navigate to the **Attributes** tab.
  1. To add a user group attribute, in the top-right corner of the page, click ![circles-3-plus](../../../_assets/console-icons/circles-3-plus.svg) **Add group attribute** and do the following in the window that opens:

      1. In the **Attribute name** field, set a name for the user group attribute. The attribute name must be unique within your application.
      1. In the **Transmitted groups** field, select one of these values:

          * `All groups`: In a SAML response, this field will include all [groups](../../concepts/groups.md) the user belongs to.
          
              The maximum number of groups this field can include is 1,000. If the user belongs to more groups than this, only the first thousand will go to the service provider. 
          * `Assigned groups only`: In a SAML response, this field will include only those groups that are explicitly specified on the **Users and groups** tab of your SAML app.

      1. Click **Add**.
  1. To add more user group attributes, in the top-right corner of the page, click ![plus](../../../_assets/console-icons/plus.svg) **Add attribute** and do the following in the window that opens:

      1. In the **Attribute name** field, set an attribute name unique within your app.
      1. In the **Value** field, select one of these values:

          * `SubjectClaims.sub`: [User ID](../users-get.md). The field value is the same as the one displayed in the **ID** field in the organization's user list in the Cloud Center's Yandex Identity Hub interface, e.g., `aje0fapf84ofj57q1r0b`.
          * `SubjectClaims.preferred_username`: Unique login for the user. The field value is the same as the one displayed in the **Username** field in the organization's user list in the Cloud Center's Yandex Identity Hub interface, e.g., `ivanov@example-federation.ru`.
          * `SubjectClaims.name`: User’s full name. The field value is the same as the one displayed in the **User** field in the organization's user list in the Cloud Center's Yandex Identity Hub interface. Here is an example: `Ivan Ivanov`.
          * `SubjectClaims.given_name`: Name. The field value is the same as the one displayed in the **Name** field under **Personal info** on the user info page in the Cloud Center's Yandex Identity Hub interface. Here is an example: `Ivan`.
          * `SubjectClaims.family_name`: Last name. The field value is the same as the one displayed in the **Surname** field under **Personal info** on the user info page in the Cloud Center's Yandex Identity Hub interface. Here is an example: `Ivanov`.
          * `SubjectClaims.email`: Email address. The field value is the same as the one displayed in the **Email** field on the user info page in the Cloud Center's Yandex Identity Hub interface, e.g., `ivanov@example-company.ru`.
          * `SubjectClaims.phone_number`: Phone number. The field value is the same as the one displayed in the **Phone** field under **Personal info** on the user info page in the Cloud Center's Yandex Identity Hub interface, e.g., `+74951234567`.
          * `SubjectClaims.company_name`: Company name. The field value is the same as the one displayed in the **Company name** field under **Personal info** on the user info page in the Cloud Center's Yandex Identity Hub interface. Here is an example: `Holiday LLC`.
          * `SubjectClaims.department`: Department name. The field value is the same as the one displayed in the **Department** field under **Personal info** on the user info page in the Cloud Center's Yandex Identity Hub interface. Here is an example: `Control systems department`.
          * `SubjectClaims.job_title`: Job title. The field value is the same as the one displayed in the **Job title** field under **Personal info** on the user info page in the Cloud Center's Yandex Identity Hub interface. Here is an example: `Software engineer`.
          * `SubjectClaims.employee_id`: Digital user code from the company's HR system. The field value is the same as the one displayed in the **Employee ID** field under **Personal info** on the user info page in the Cloud Center's Yandex Identity Hub interface, e.g., `08012`.
          
          {% note info %}
          
          You can add any of these attribute values more than once under different names.
          
          {% endnote %}

      1. Click **Add**.
  1. To modify an existing attribute, click its row and do the following in the window that opens:
  
      1. Edit the attribute name and/or value.

          You can edit format and value of the `NameID` attribute (user ID). The list of possible values for the **Value** field depends on the format you select. When you change the format, the attribute automatically resets to that format’s default value.
          
          Possible attribute formats and values:
          
          * `urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress `: User ID is provided in email address format. Available values:
              * `SubjectClaims.preferred_username`: Default value when switching to this format.
          
                  The uniqueness and invariability of the provided ID is not guaranteed: one organization may have two users with the same `preferred_username` ID. For example: a [federated](../../../iam/concepts/users/accounts.md#saml-federation) and a [local](../../../iam/concepts/users/accounts.md#local) user can have the same value for this attribute.
          
                  If the federated user's `preferred_username` ID is not in email format, the provided ID will be automatically suffixed with `@<identity_federation_ID>` to bring it to that format.
              * `SubjectClaims.email`: User email address.
          
          * `urn:oasis:names:tc:SAML:2.0:nameid-format:persistent`: User ID is provided in the [organization's](../../concepts/organization.md) user [ID](../users-get.md) format. In this case, the provided value is guaranteed to be unique and invariable. Available values:
              * `SubjectClaims.sub`: Default value when switching to this format.
              * `SubjectClaims.external_id`: External user ID.
              * `SubjectClaims.employee_id`: Employee ID.
          * `urn:oasis:names:tc:SAML:2.0:nameid-format:transient`: User ID is provided in the current user [session](../../concepts/sessions.md) ID. The value of this ID changes depending on session and cannot be used to uniquely identify the user.
          
              You cannot explicitly specify the `urn:oasis:names:tc:SAML:2.0:nameid-format:transient` format in the `NameID` attribute's settings: the user ID comes in the SAML response in this format only if this format was explicitly requested in the SAML request.
          
          {% note warning %}
          
          If the service provider's SAML request explicitly indicates the expected user's `NameID` value format, then the SAML response will present the value in the format specified in the SAML request. In this case, the format value specified in the Yandex Identity Hub settings will be ignored.
          
          {% endnote %}
      
      1. Click **Update**.
  1. To delete an existing user or group attribute, click ![ellipsis](../../../_assets/console-icons/ellipsis.svg) in its row and select ![trash-bin](../../../_assets/console-icons/trash-bin.svg) **Delete**, then confirm the deletion.

      {% note info %}

      You can delete any attributes except the required `NameID` attribute.

      {% endnote %}

- CLI {#cli}

  If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../../cli/quickstart.md#install).

  The folder used by default is the one specified when [creating](../../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

  1. View the description of the CLI command for adding an attribute:

     ```bash
     yc organization-manager idp application saml attribute create --help
     ```

  1. To add a user attribute, run this command:

     ```bash
     yc organization-manager idp application saml attribute create \
       --application-id <app_ID> \
       --name <attribute_name> \
       --value <attribute_value>
     ```

     Where:

     * `--application-id`: SAML application ID.
     * `--name`: Attribute name unique to your application.
     * `--value`: Attribute value. The possible values are:

       * `SubjectClaims.sub`: [User ID](../users-get.md). The field value is the same as the one displayed in the **ID** field in the organization's user list in the Cloud Center's Yandex Identity Hub interface, e.g., `aje0fapf84ofj57q1r0b`.
       * `SubjectClaims.preferred_username`: Unique login for the user. The field value is the same as the one displayed in the **Username** field in the organization's user list in the Cloud Center's Yandex Identity Hub interface, e.g., `ivanov@example-federation.ru`.
       * `SubjectClaims.name`: User’s full name. The field value is the same as the one displayed in the **User** field in the organization's user list in the Cloud Center's Yandex Identity Hub interface. Here is an example: `Ivan Ivanov`.
       * `SubjectClaims.given_name`: Name. The field value is the same as the one displayed in the **Name** field under **Personal info** on the user info page in the Cloud Center's Yandex Identity Hub interface. Here is an example: `Ivan`.
       * `SubjectClaims.family_name`: Last name. The field value is the same as the one displayed in the **Surname** field under **Personal info** on the user info page in the Cloud Center's Yandex Identity Hub interface. Here is an example: `Ivanov`.
       * `SubjectClaims.email`: Email address. The field value is the same as the one displayed in the **Email** field on the user info page in the Cloud Center's Yandex Identity Hub interface, e.g., `ivanov@example-company.ru`.
       * `SubjectClaims.phone_number`: Phone number. The field value is the same as the one displayed in the **Phone** field under **Personal info** on the user info page in the Cloud Center's Yandex Identity Hub interface, e.g., `+74951234567`.
       * `SubjectClaims.company_name`: Company name. The field value is the same as the one displayed in the **Company name** field under **Personal info** on the user info page in the Cloud Center's Yandex Identity Hub interface. Here is an example: `Holiday LLC`.
       * `SubjectClaims.department`: Department name. The field value is the same as the one displayed in the **Department** field under **Personal info** on the user info page in the Cloud Center's Yandex Identity Hub interface. Here is an example: `Control systems department`.
       * `SubjectClaims.job_title`: Job title. The field value is the same as the one displayed in the **Job title** field under **Personal info** on the user info page in the Cloud Center's Yandex Identity Hub interface. Here is an example: `Software engineer`.
       * `SubjectClaims.employee_id`: Digital user code from the company's HR system. The field value is the same as the one displayed in the **Employee ID** field under **Personal info** on the user info page in the Cloud Center's Yandex Identity Hub interface, e.g., `08012`.
       
       {% note info %}
       
       You can add any of these attribute values more than once under different names.
       
       {% endnote %}

  1. To add a user group attribute, run this command:

     ```bash
     yc organization-manager idp application saml attribute create \
       --application-id <app_ID> \
       --name <group_attribute_name> \
       --value <group_attribute_value>
     ```

     Where:

     * `--name`: User group attribute name. The attribute name must be unique within your application.
     * `--value`: Group attribute value. The possible values are:

       * `All groups`: In a SAML response, this field will include all [groups](../../concepts/groups.md) the user belongs to.
       
           The maximum number of groups this field can include is 1,000. If the user belongs to more groups than this, only the first thousand will go to the service provider. 
       * `Assigned groups only`: In a SAML response, this field will include only those groups that are explicitly specified on the **Users and groups** tab of your SAML app.

  1. To update the attribute, run this command:

     ```bash
     yc organization-manager idp application saml attribute update \
       --id <attribute_ID> \
       --name <new_attribute_name> \
       --value <new_attribute_value>
     ```

  1. To delete the attribute, run this command:

     ```bash
     yc organization-manager idp application saml attribute delete <attribute_ID>
     ```

- Terraform {#tf}

  If you do not have Terraform yet, [install it and configure the Yandex Cloud provider](../../../tutorials/infrastructure-management/terraform-quickstart.md#install-terraform).
  
  
  To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), [authenticate](../../../terraform/authentication.md) using the appropriate method.

  1. Describe the following SAML application attributes in the configuration file:

     ```hcl
     resource "yandex_organizationmanager_idp_application_saml_application" "saml_app" {
       organization_id = "<organization_ID>"
       name            = "<application_name>"

       attribute_mapping = {
         name_id  = {
           format = "EMAIL"
         }

         attributes = [{
           name  = "email"
           value = "SubjectClaims.email"
         }, {
           name  = "firstName"
           value = "SubjectClaims.given_name"
         }, {
           name  = "lastName"
           value = "SubjectClaims.family_name"
         }]
       }

       group_claims_settings = {
         group_attribute_name    = "<group_attribute_name>"
         group_distribution_type = "ALL_GROUPS"
       }
     }
     ```

     Where:

     * `organization_id`: [ID of the organization](../organization-get-id.md) you want to create your SAML application in. This is a required setting.
     * `name`: SAML application name. This is a required setting.
     * `attributes`: List of attributes Yandex Identity Hub will be delivering to the service provider. Each attribute contains:
       * `name`: Attribute name unique to your application.
       * `value`: Attribute value. The possible values are:

         * `SubjectClaims.sub`: [User ID](../users-get.md). The field value is the same as the one displayed in the **ID** field in the organization's user list in the Cloud Center's Yandex Identity Hub interface, e.g., `aje0fapf84ofj57q1r0b`.
         * `SubjectClaims.preferred_username`: Unique login for the user. The field value is the same as the one displayed in the **Username** field in the organization's user list in the Cloud Center's Yandex Identity Hub interface, e.g., `ivanov@example-federation.ru`.
         * `SubjectClaims.name`: User’s full name. The field value is the same as the one displayed in the **User** field in the organization's user list in the Cloud Center's Yandex Identity Hub interface. Here is an example: `Ivan Ivanov`.
         * `SubjectClaims.given_name`: Name. The field value is the same as the one displayed in the **Name** field under **Personal info** on the user info page in the Cloud Center's Yandex Identity Hub interface. Here is an example: `Ivan`.
         * `SubjectClaims.family_name`: Last name. The field value is the same as the one displayed in the **Surname** field under **Personal info** on the user info page in the Cloud Center's Yandex Identity Hub interface. Here is an example: `Ivanov`.
         * `SubjectClaims.email`: Email address. The field value is the same as the one displayed in the **Email** field on the user info page in the Cloud Center's Yandex Identity Hub interface, e.g., `ivanov@example-company.ru`.
         * `SubjectClaims.phone_number`: Phone number. The field value is the same as the one displayed in the **Phone** field under **Personal info** on the user info page in the Cloud Center's Yandex Identity Hub interface, e.g., `+74951234567`.
         * `SubjectClaims.company_name`: Company name. The field value is the same as the one displayed in the **Company name** field under **Personal info** on the user info page in the Cloud Center's Yandex Identity Hub interface. Here is an example: `Holiday LLC`.
         * `SubjectClaims.department`: Department name. The field value is the same as the one displayed in the **Department** field under **Personal info** on the user info page in the Cloud Center's Yandex Identity Hub interface. Here is an example: `Control systems department`.
         * `SubjectClaims.job_title`: Job title. The field value is the same as the one displayed in the **Job title** field under **Personal info** on the user info page in the Cloud Center's Yandex Identity Hub interface. Here is an example: `Software engineer`.
         * `SubjectClaims.employee_id`: Digital user code from the company's HR system. The field value is the same as the one displayed in the **Employee ID** field under **Personal info** on the user info page in the Cloud Center's Yandex Identity Hub interface, e.g., `08012`.
         
         {% note info %}
         
         You can add any of these attribute values more than once under different names.
         
         {% endnote %}

     * `group_claims_settings`: User group attribute parameters:
       * `group_attribute_name`: User group attribute name. The attribute name must be unique within your application.
       * `group_distribution_type`: Group attribute value. The possible values are: 
         * `ASSIGNED_GROUPS`: In a SAML response, this field will include only those groups that are explicitly specified on the **Users and groups** tab of your SAML app.
         * `ALL_GROUPS`: In a SAML response, this field will include all [groups](../../concepts/groups.md) the user belongs to.

             The maximum number of groups this field can include is 1,000. If the user belongs to more groups than this, only the first thousand will go to the service provider. 

     For more on the properties of the `yandex_organizationmanager_idp_application_saml_application` resource, see [this provider guide](../../../terraform/resources/organizationmanager_idp_application_saml_application.md).

  1. Apply the changes:

     1. In the terminal, navigate to the configuration file directory.
     1. Make sure the configuration is correct using this command:
     
        ```bash
        terraform validate
        ```
     
        If the configuration is valid, you will get this message:
     
        ```bash
        Success! The configuration is valid.
        ```
     
     1. Run this command:
     
        ```bash
        terraform plan
        ```
     
        You will see a list of resources and their properties. No changes will be made at this step. Terraform will show any errors in the configuration.
     1. Apply the configuration changes:
     
        ```bash
        terraform apply
        ```
     
     1. Type `yes` and press **Enter** to confirm the changes.

     You can check the changes to the resources and their settings in the [Cloud Center interface](https://center.yandex.cloud/organization).

- API {#api}

  Use the [Application.Update](../../idp/application/saml/api-ref/Application/update.md) REST API method for the [Application](../../idp/application/saml/api-ref/Application/index.md) resource or the [ApplicationService/Update](../../idp/application/saml/api-ref/grpc/Application/update.md) gRPC API call.

{% endlist %}

Make sure the attributes you added are also added to the SAML app's integration settings and can be processed correctly on the service provider's side.

## Update the list of app users and groups {#users-and-groups}

Update the list of your [organization's](../../concepts/organization.md) users permitted to authenticate in external app with a SAML application:

{% list tabs group=instructions %}

- Cloud Center UI {#cloud-center}

  1. Log in to [Yandex Identity Hub](https://center.yandex.cloud/organization).
  1. In the left-hand panel, select ![shapes-4](../../../_assets/console-icons/shapes-4.svg) **Apps** and select the required app.
  1. Navigate to the **Users and groups** tab.
  1. To add a user or user group to a SAML app:

      1. Click ![person-plus](../../../_assets/console-icons/person-plus.svg) **Add users**.
      1. In the window that opens, select the required user or user group.
      1. Click **Add**.
  1. To delete a user or user group from a SAML app:

      1. In the list of users and groups, click ![ellipsis](../../../_assets/console-icons/ellipsis.svg) and select ![trash-bin](../../../_assets/console-icons/trash-bin.svg) **Delete** next to the user or user group.
      1. Confirm the deletion.

- CLI {#cli}

  If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../../cli/quickstart.md#install).

  The folder used by default is the one specified when [creating](../../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

  1. Get the [user ID](../users-get.md) or [user group ID](../group-get-id.md).

  1. To add a user or user group to the app:
   
     1. See the description of the CLI command for adding users to an app:
   
        ```bash
        yc organization-manager idp application saml application add-assignments --help
        ```
   
     1. Run this command:
   
        ```bash
        yc organization-manager idp application saml application add-assignments \
          --id <app_ID> \
          --subject-id <user_or_group_ID>
        ```
   
        Where:
   
        * `--id`: App ID.
        * `--subject-id`: User or user group ID.
   
        Result:
   
        ```text
        assignment_deltas:
          - action: ADD
            assignment:
              subject_id: ajetvnq2mil8********
        ```

  1. To delete a user or user group from the app:

     1. See the description of the CLI command for removing users from an app:
   
        ```bash
        yc organization-manager idp application saml application remove-assignments --help
        ```
   
     1. Run this command:
   
        ```bash
        yc organization-manager idp application saml application remove-assignments \
          --id <app_ID> \
          --subject-id <user_or_group_ID>
        ```
   
        Where:
   
        * `--id`: SAML application ID.
        * `--subject-id`: User or user group ID.
   
        Result:
   
        ```text
        assignment_deltas:
          - action: REMOVE
            assignment:
              subject_id: ajetvnq2mil8********
        ```

- Terraform {#tf}

  If you do not have Terraform yet, [install it and configure the Yandex Cloud provider](../../../tutorials/infrastructure-management/terraform-quickstart.md#install-terraform).
  
  
  To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), [authenticate](../../../terraform/authentication.md) using the appropriate method.

  1. Describe the parameters of the SAML application with users and groups in the configuration file:

     ```hcl
     resource "yandex_organizationmanager_idp_application_saml_application_assignment" "example_assignment" {
       application_id = "<SAML_app_ID>"
       subject_id     = "<user_or_group_ID>"
     }
     ```

     Where:

     * `application_id`: SAML application ID.
     * `subject-id`: ID of the user or user group that will have access to the SAML application. To get the user ID, follow [this guide](../users-get.md). To get the user group ID, follow [this guide](../group-get-id.md).

     For more on the properties of the `yandex_organizationmanager_idp_application_saml_application_assignment` resource, see [this provider guide](../../../terraform/resources/organizationmanager_idp_application_saml_application_assignment.md).

  1. Apply the changes:

     1. In the terminal, navigate to the configuration file directory.
     1. Make sure the configuration is correct using this command:
     
        ```bash
        terraform validate
        ```
     
        If the configuration is valid, you will get this message:
     
        ```bash
        Success! The configuration is valid.
        ```
     
     1. Run this command:
     
        ```bash
        terraform plan
        ```
     
        You will see a list of resources and their properties. No changes will be made at this step. Terraform will show any errors in the configuration.
     1. Apply the configuration changes:
     
        ```bash
        terraform apply
        ```
     
     1. Type `yes` and press **Enter** to confirm the changes.

     You can check the changes to the resources and their settings in the [Cloud Center interface](https://center.yandex.cloud/organization).

- API {#api}

  Use the [Application.UpdateAssignments](../../idp/application/saml/api-ref/Application/updateAssignments.md) REST API method for the [Application](../../idp/application/saml/api-ref/Application/index.md) resource or the [ApplicationService/UpdateAssignments](../../idp/application/saml/api-ref/grpc/Application/updateAssignments.md) gRPC API call.

{% endlist %}

{% note tip %}

If you want to fine-tune user authentication in your applications, including authentication only from specific IP addresses, use [authentication policies](*authentication_policies).

{% endnote %}

[*authentication_policies]: Authentication policies are a Yandex Identity Hub tool that allows you to flexibly configure access to applications by denying or allowing authentication for specific users in specific applications and/or from specific IP addresses. For more information, see [Authentication policies in Yandex Identity Hub](../../concepts/authentication-policy.md).

#### Useful links {#see-also}

* [Creating a SAML application in Yandex Identity Hub](saml-create.md)
* [Deactivating and deleting a SAML application in Yandex Identity Hub](saml-deactivate-remove.md)
* [Adding a user](../add-account.md)
* [SAML applications](../../concepts/applications.md#saml)
* [Managing user groups](../manage-groups.md)