[Yandex Cloud documentation](../../../index.md) > [Tutorials](../../index.md) > [Security](../index.md) > Setting up single sign-on (SSO) for apps > Sentry

# Creating a SAML app in Yandex Identity Hub for integration with Sentry

[Sentry](https://sentry.io/) is a real-time error monitoring and tracking platform for applications allowing developers to quickly detect, diagnose, and fix failures and performance issues.

For the users of your [organization](../../../organization/concepts/organization.md) to be able to authenticate to Sentry via [SAML](https://en.wikipedia.org/wiki/Security_Assertion_Markup_Language) SSO, create a [SAML app](../../../organization/concepts/applications.md#saml) in Yandex Identity Hub and configure it both in Yandex Identity Hub and Sentry.

SAML apps can be managed by users with the `organization-manager.samlApplications.admin` [role](../../../organization/security/index.md#organization-manager-samlApplications-admin) or higher.

{% note info %}

For SAML integration, your Sentry instance must have a public domain and a valid SSL certificate in place.

{% endnote %}

To give access to Sentry to the users of your organization:

1. [Create an app in Yandex Identity Hub](#create-app).
1. [Set up the integration](#setup-integration).
1. [Make sure the application works correctly](#validate).

## Create an app in Yandex Identity Hub {#create-app}

{% list tabs group=instructions %}

- Cloud Center UI {#cloud-center}

   1. Log in to [Yandex Identity Hub](https://center.yandex.cloud/organization).
   1. In the left-hand panel, select ![shapes-4](../../../_assets/console-icons/shapes-4.svg) **Apps**.
   1. In the top-right corner, click ![Circles3Plus](../../../_assets/console-icons/circles-3-plus.svg) **Create application** and in the window that opens:
      1. Select the **SAML (Security Assertion Markup Language)** single sign-on method.
      1. In the **Name** field, specify a name for your new app: `sentry-app`.

      1. Optionally, in the **Description** field, enter a description for the new app.
      1. Optionally, add [labels](../../../resource-manager/concepts/labels.md):

         1. Click **Add label**.
         1. Add a label in `key: value` format.
         1. Press **Enter**.
      1. Click **Create application**.
   1. Save the **Metadata URL** value, you will need it at the next step.

{% endlist %}

## Set up the integration {#setup-integration}

### Set up the SAML application in Yandex Identity Hub {#setup-idp}

#### Find the organization slug {#get-org-slug}

To set up endpoints, you need the organization slug, which is set to `sentry` by default. To find the slug of your organization:

1. Log in to Sentry.
1. In the left-hand menu, click **Settings**.
1. On the **Organization** tab, select **General Settings**.
1. Copy the **Organization Slug** field value.

#### Set up service provider endpoints {#sp-endpoints}

{% list tabs group=instructions %}

- Cloud Center UI {#cloud-center}

  1. Log in to [Yandex Identity Hub](https://center.yandex.cloud/organization).
  1. In the left-hand panel, select ![shapes-4](../../../_assets/console-icons/shapes-4.svg) **Apps** and then, the SAML app.
  1. At the top right, click ![pencil](../../../_assets/console-icons/pencil.svg) **Edit** and in the window that opens:  
      1. In the **SP EntityID ** field, paste the `<sentry_instance_address>/saml/metadata/<organization_slug>/` value.
      1. In the **ACS URL** field, paste the `<sentry_instance_address>/saml/acs/<organization_slug>/` value.
      1. Optionally, in the **SP Logout URL** field, paste the `<sentry_instance_address>/saml/sls/<organization_slug>/` value.
      1. Click **Save**.

{% endlist %}

### Configure authentication on the Sentry side {#setup-sp}

1. Log in to Sentry as a user with the organization owner permissions.
1. In the left-hand menu, click **Settings**.
1. On the **Organization** tab, select **Auth**.
1. From the list of providers, select **SAML2**.
1. Click **Configure**.
1. In the **Metadata URL** field, enter the metadata file address you copied earlier.
1. Click **Get metadata**.
1. Under **Map Identity Provider Attributes**, fill out the following fields:
   * In the **IdP User ID** field, enter `fullname`.
   * In the **User Email** field, enter `emailaddress`.
   * Optionally, in the **First Name** field, enter `givenname`.
   * Optionally, in the **Last Name** field, enter `surname`.
1. Click **Save Settings**.

### Add a user {#add-user}

For your organization's users to be able to authenticate in Sentry with Yandex Identity Hub's SAML app, you need to explicitly add these users and/or [user groups](../../../organization/concepts/groups.md) to the SAML application.

{% note info %}

Users and groups added to a SAML application can be managed by a user with the `organization-manager.samlApplications.userAdmin` [role](../../../organization/security/index.md#organization-manager-samlApplications-userAdmin) or higher.

{% endnote %}

1. Add users to the application:

   {% list tabs group=instructions %}

   - Cloud Center UI {#cloud-center}

      1. Log in to [Yandex Identity Hub](https://center.yandex.cloud/organization).
      1. In the left-hand panel, select ![shapes-4](../../../_assets/console-icons/shapes-4.svg) **Apps** and select the required app.
      1. Navigate to the **Users and groups** tab.
      1. Click ![person-plus](../../../_assets/console-icons/person-plus.svg) **Add users**.
      1. In the window that opens, select the required user or user group.
      1. Click **Add**.

   {% endlist %}

## Make sure your application works correctly {#validate}

To make sure both your SAML app and Sentry integration work correctly, authenticate to Sentry as one of the users you added to the app. Follow these steps:

1. In your browser, navigate to your Sentry instance's address.
1. On the authentication page, click **Login with SAML2**.
1. On the Yandex Cloud authentication page, enter the user email address and password. The user or group they belong to must be added to the application. The user must also have their email address specified.
1. Make sure you have successfully authenticated in Sentry.