[Yandex Cloud documentation](../../../../index.md) > [Tutorials](../../../index.md) > [Security](../../index.md) > Setting up single sign-on (SSO) for apps > Cloud.ru > SAML

# Creating a SAML app in Yandex Identity Hub for integration with Cloud.ru

[Cloud.ru](https://cloud.ru/) is a Russian provider of cloud services, spanning IaaS, PaaS, AI/ML tools, and solutions for public, private, and hybrid cloud deployments, including support for infrastructure migration and operation.

For the users of your [organization](../../../../organization/concepts/organization.md) to be able to authenticate to Cloud.ru via [SAML](https://en.wikipedia.org/wiki/Security_Assertion_Markup_Language) SSO, create a [SAML app](../../../../organization/concepts/applications.md#saml) in Yandex Identity Hub and configure it both in Yandex Identity Hub and Cloud.ru.

SAML apps can be managed by users with the `organization-manager.samlApplications.admin` [role](../../../../organization/security/index.md#organization-manager-samlApplications-admin) or higher.

To give access to Cloud.ru to the users of your organization:

1. [Create an app](#create-app).
1. [Set up the integration](#setup-integration).
1. [Make sure the application works correctly](#validate).

## Create an app {#create-app}

{% list tabs group=instructions %}

- Cloud Center UI {#cloud-center}

    1. Log in to [Yandex Identity Hub](https://center.yandex.cloud/organization).
    1. In the left-hand panel, select ![shapes-4](../../../../_assets/console-icons/shapes-4.svg) **Apps**.
    1. In the top-right corner, click ![Circles3Plus](../../../../_assets/console-icons/circles-3-plus.svg) **Create application** and in the window that opens:
        1. Select the **SAML (Security Assertion Markup Language)** single sign-on method.
        1. In the **Name** field, specify a name for your new app: `cloud-ru-saml-app`.

        1. Optionally, in the **Description** field, enter a description for the new app.
        1. Optionally, add [labels](../../../../resource-manager/concepts/labels.md):

            1. Click **Add label**.
            1. Add a label in `key: value` format.
            1. Press **Enter**.
        1. Click **Create application**.

{% endlist %}

## Set up the integration {#setup-integration}

To configure Cloud.ru integration with the SAML app you created in Yandex Identity Hub, complete the setup both in Cloud.ru and Yandex Identity Hub.

### Set up the SAML app in Cloud.ru {#setup-sp}

1. Get the metadata for the [new app](#create-app):

    1. Log in to [Yandex Identity Hub](https://center.yandex.cloud/organization).
    1. In the left-hand panel, select ![shapes-4](../../../../_assets/console-icons/shapes-4.svg) **Apps** and then, the SAML app.
    1. On the **Overview** tab, under **Identity provider (IdP) configuration**, click **Download metadata file**.

      The downloaded [XML](https://en.wikipedia.org/wiki/XML) file contains the required metadata and a certificate used for SAML response signature verification.

1. Set up SAML authentication for Cloud.ru.

    1. Log in to the Cloud.ru [console](https://console.cloud.ru/).
    1. Navigate to the **Federations** tab in the **Administration** section.
    1. Click **Create federation** and select the **SAML** protocol type.
    1. Upload the XML metadata file you got in Yandex Identity Hub in the previous step.
    1. Enter the federation name and description.
    1. Set the session duration.
        
        {% note info %}

        The maximum lifetime of an SSO session is from 30 minutes to 7 days. If there is no activity, the session is automatically terminated and re-authentication is required.
        
        {% endnote %}
    
    1. Check the settings in the **Single Logout Service** section, they should be imported from the XML metadata file. For **Default URL Binding**, set `Post`.
    1. Check the settings in the **Single Sign-On Service** section, they should be imported from the XML metadata file. For **Default URL Binding**, set `Redirect`.
    1. Make sure the signing certificate was imported from the XML metadata file and has the `Signing` type.
    1. Click **Create**.
    1. Download the provided XML file with Cloud.ru metadata, as it is required to complete the setup in Yandex Identity Hub.
    1. Click **Done**.
    1. In the list of federations, find the new federation and copy its ID. Save this ID as you will need it later.

### Set up the SAML application in Yandex Identity Hub {#setup-idp}

#### Set up service provider endpoints {#sp-endpoints}

{% list tabs group=instructions %}

- Cloud Center UI {#cloud-center}

    1. Log in to [Yandex Identity Hub](https://center.yandex.cloud/organization).
    1. In the left-hand panel, select ![shapes-4](../../../../_assets/console-icons/shapes-4.svg) **Apps** and then, the SAML app.
    1. At the top right, click ![pencil](../../../../_assets/console-icons/pencil.svg) **Edit** and in the window that opens:  
        1. In the **SP EntityID ** field, specify the `entityID` attribute value of the `EntityDescriptor` element from the Cloud.ru XML metadata file.
        1. In the **ACS URL** field, specify the `Location` attribute value of the `AssertionConsumerService` element from the Cloud.ru XML metadata file.
        1. Click **Save**.

{% endlist %}

### Add users {#add-users}

To enable your organization's users to authenticate in Cloud.ru using the Yandex Identity Hub SAML application, you must explicitly add their accounts both to the application and the Cloud.ru federation.

{% note info %}

Users and groups added to a SAML application can be managed by a user with the `organization-manager.samlApplications.userAdmin` [role](../../../../organization/security/index.md#organization-manager-samlApplications-userAdmin) or higher.

{% endnote %}

#### Add users to the Yandex Identity Hub SAML application {#add-app-users}

{% list tabs group=instructions %}

- Cloud Center UI {#cloud-center}

    1. Log in to [Yandex Identity Hub](https://center.yandex.cloud/organization).
    1. In the left-hand panel, select ![shapes-4](../../../../_assets/console-icons/shapes-4.svg) **Apps** and select the required app.
    1. Navigate to the **Users and groups** tab.
    1. Click ![person-plus](../../../../_assets/console-icons/person-plus.svg) **Add users**.
    1. In the window that opens, select the required user.
    1. Click **Add**.

{% endlist %}

{% note tip %}

If you want to fine-tune user authentication in your applications, including authentication only from specific IP addresses, use [authentication policies](*authentication_policies).

{% endnote %}

[*authentication_policies]: Authentication policies are a Yandex Identity Hub tool that allows you to flexibly configure access to applications by denying or allowing authentication for specific users in specific applications and/or from specific IP addresses. For more information, see [Authentication policies in Yandex Identity Hub](../../../../organization/concepts/authentication-policy.md).

#### Add users to the Cloud.ru federation {#add-cloudru-users}

1. Log in to the Cloud.ru [console](https://console.cloud.ru/).
1. Open the **Users** section and go to the **Federated users** tab.
1. In the top-right corner, click **Add federation user**.
1. Select the federation you want to add the user to.
1. Specify the user's email address.
1. Grant the user access permissions for projects and platforms.
1. Click **Add**.

## Make sure your application works correctly {#validate}

To make sure both your SAML app and its integration with Cloud.ru work correctly, authenticate to Cloud.ru as one of the users you added to the app.

Proceed as follows:

1. In your browser, open the Cloud.ru [console](https://console.cloud.ru/) login page.
1. If you were logged in, log out.
1. On the login screen, click **SSO**.
1. In the dialog that appears, enter the ID of the federation you created and click **Log in**.
1. On the Yandex Cloud authentication page, enter the email address and user password.
1. Make sure you have successfully authenticated to Cloud.ru.