[Yandex Cloud documentation](../../../index.md) > [Yandex Identity Hub](../../index.md) > [Tutorials](../index.md) > [Setting up single sign-on (SSO) for apps](index.md) > Yandex 360

# Creating a SAML app in Yandex Identity Hub for integration with Yandex 360

[Yandex 360](https://360.yandex.ru/) is a cloud platform for business offering tools for setting up corporate email addresses, collaboration, and document management. Yandex 360 supports SAML authentication to provide secure SSO for your organization’s users.

For the users of your [organization](../../concepts/organization.md) to be able to authenticate to Yandex 360 via [SAML](https://en.wikipedia.org/wiki/Security_Assertion_Markup_Language) SSO, create a [SAML app](../../concepts/applications.md#saml) in Yandex Identity Hub and configure it both in Yandex Identity Hub and Yandex 360.

SAML apps can be managed by users with the `organization-manager.samlApplications.admin` [role](../../security/index.md#organization-manager-samlApplications-admin) or higher.

To give access to Yandex 360 to the users of your organization:

1. [Create an app](#create-app).
1. [Set up the integration](#setup-integration).
1. [Make sure the application works correctly](#validate).

## Create an app {#create-app}

{% list tabs group=instructions %}

- Cloud Center UI {#cloud-center}

    1. Log in to [Yandex Identity Hub](https://center.yandex.cloud/organization).
    1. In the left-hand panel, select ![shapes-4](../../../_assets/console-icons/shapes-4.svg) **Apps**.
    1. In the top-right corner, click ![Circles3Plus](../../../_assets/console-icons/circles-3-plus.svg) **Create application** and in the window that opens:
        1. Select the **SAML (Security Assertion Markup Language)** single sign-on method.
        1. In the **Name** field, specify a name for your new app: `yandex360`.

        1. Optionally, in the **Description** field, enter a description for the new app.
        1. Optionally, add [labels](../../../resource-manager/concepts/labels.md):

            1. Click **Add label**.
            1. Add a label in `key: value` format.
            1. Press **Enter**.
        1. Click **Create application**.

{% endlist %}

## Set up the integration {#setup-integration}

To configure Yandex 360 integration with the SAML app you created in Yandex Identity Hub, complete the configuration both on the Yandex Identity Hub side and in Yandex 360.

### Set up the SAML application in Yandex Identity Hub {#setup-idp}

#### Set up service provider endpoints {#sp-endpoints}

{% list tabs group=instructions %}

- Cloud Center UI {#cloud-center}

  1. Log in to [Yandex Identity Hub](https://center.yandex.cloud/organization).
  1. In the left-hand panel, select ![shapes-4](../../../_assets/console-icons/shapes-4.svg) **Apps** and then, the SAML app.
  1. At the top right, click ![pencil](../../../_assets/console-icons/pencil.svg) **Edit** and in the window that opens:  
      1. In the **SP EntityID ** field, specify `https://yandex.ru/`.
      1. In the **ACS URL** field, enter this address: `https://passport.yandex.ru/auth/sso/commit`.
      1. Click **Save**.

{% endlist %}

#### Configure user attributes {#user-attributes}

{% note warning %}

For integration with Yandex 360, set the `User.EmailAddress`, `User.Firstname`, and `User.Surname` attributes.

{% endnote %}

Set user attributes for integration with Yandex 360:

{% list tabs group=instructions %}

- Cloud Center UI {#cloud-center}

    1. Log in to [Yandex Identity Hub](https://center.yandex.cloud/organization).
    1. In the left-hand panel, select ![shapes-4](../../../_assets/console-icons/shapes-4.svg) **Apps** and select the desired app.
    1. Navigate to the **Attributes** tab.
    1. Edit user attributes:

        1. Replace the `emailaddress` attribute with `User.EmailAddress`. Follow these steps:
            1. Click the row with the `emailaddress` attribute.
            1. In the **Attribute name** field, specify `User.EmailAddress`.
            1. In the **Value** field, leave `SubjectClaims.email`.
            1. Click **Save**.

        1. Replace the `givenname` attribute with `User.Firstname`.
        1. Replace the `surname` attribute with `User.Surname`.
        1. You can delete the `fullname` attribute as you will no longer need it.

{% endlist %}

For more information about configuring attributes, see [Configure user and group attributes](../../operations/applications/saml-create.md#setup-attributes).

#### Collect data for setting up Yandex 360 {#collect-idp-data}

To set up SSO in Yandex 360, you need the following data from your SAML app:

{% list tabs group=instructions %}

- Cloud Center UI {#cloud-center}

    1. Log in to [Yandex Identity Hub](https://center.yandex.cloud/organization).
    1. In the left-hand panel, select ![shapes-4](../../../_assets/console-icons/shapes-4.svg) **Apps** and then, the SAML app.
    1. Under **Identity provider (IdP) configuration** on the **Overview** tab, copy the following data:

        * **Issuer / IdP EntityID**: IdP entity ID.
        * **Login URL**: Entry point URL address (Login URL).

    1. Under **Application certificate**, click **Download certificate** and save the token signature certificate in X.509 format to your device.

{% endlist %}

You will need this data to set up SSO in Yandex 360.

### Set up SAML authentication in Yandex 360 {#setup-sp}

{% note info %}

To set up SAML authentication in Yandex 360, the user needs the organization administrator permissions.

{% endnote %}

To set up SAML authentication in Yandex 360:

1. Go to the [Yandex 360 for Business console](https://admin.yandex.ru/).
1. Navigate to the SSO settings section.
1. Provide the data you got in the previous step:
    * **IdP Entity ID**: IdP issuer.
    * **Login URL**: Entry point URL.
    * Upload the **token signing certificate** in X.509 format.
1. Save the settings.

{% note warning %}

Make sure the domain from the `User.EmailAddress` attribute in the SAML response matches the main domain or one of the alias domains of your Yandex 360 organization.

{% endnote %}

### Add users {#add-users}

For your organization's users to be able to authenticate in Yandex 360 with Yandex Identity Hub's SAML app, you need to explicitly add these users and/or [user groups](../../concepts/groups.md) to your SAML application.

{% note info %}

Users and groups added to a SAML application can be managed by a user with the `organization-manager.samlApplications.userAdmin` [role](../../security/index.md#organization-manager-samlApplications-userAdmin) or higher.

{% endnote %}

Add users to the application:

{% list tabs group=instructions %}

- Cloud Center UI {#cloud-center}

    1. Log in to [Yandex Identity Hub](https://center.yandex.cloud/organization).
    1. In the left-hand panel, select ![shapes-4](../../../_assets/console-icons/shapes-4.svg) **Apps** and select the required app.
    1. Navigate to the **Users and groups** tab.
    1. Click ![person-plus](../../../_assets/console-icons/person-plus.svg) **Add users**.
    1. In the window that opens, select the required user or user group.
    1. Click **Add**.

{% endlist %}

## Make sure your application works correctly {#validate}

To make sure both your SAML app and Yandex 360 integration work correctly, authenticate to Yandex 360 as one of the users you added to the app. Follow these steps:

1. In your browser, go to the Yandex 360 login page.
1. If you were logged in to Yandex 360, log out.
1. On the authentication page, select Single Sign-On (SSO).
1. On the Yandex Cloud authentication page, enter the email address and user password. The user or group they belong to must be added to the application.
1. Make sure you have successfully authenticated in Yandex 360.

### Troubleshooting setup issues {#troubleshooting}

If you have specified incorrect values when setting up the IdP, you will get the `Failed to log in` message and the following error code on an attempt to log in via SSO.

#### email.not_in_response {#email-not-in-response}

Specify attribute names in `User.Firstname`, `User.Surname`, `User.EmailAddress` format. If you specify a different format, such as `Firstname`, you will not be able to authenticate.

#### request_your_admin {#request-your-admin}

This error occurs if the administrator of your organization’s user folder has restricted access to Yandex 360 for your account. For more details, contact your organization’s support team.

#### samlresponse.invalid {#samlresponse-invalid}

This error occurs if either the entry point URL, IdP issuer, or token signing certificate was specified incorrectly. You may also get this error within 14 days prior to the expiration of the token signing certificate or after it expires. Make sure the SSO settings in Yandex 360 are correct.

#### unsupportable_domain {#unsupportable-domain}

Make sure the domain from the `User.EmailAddress` email attribute in the [SAML](https://en.wikipedia.org/wiki/Security_Assertion_Markup_Language) response matches the main domain or one of the alias domains of your Yandex 360 organization.