IBM Security Verify

Example values

The tenant-specific values (the sg_ab12cde parts) show the shape only — Safeguard displays your real ACS URL and SP Entity ID in the Add Provider dialog after you click Save. This table makes it unambiguous which value goes on which side.

In IBM Security Verify — the custom SAML application (you enter these at the IdP):

In Safeguard — Add Provider → SAML 2.0 (you copy these from the IdP):

-----BEGIN CERTIFICATE-----
MIIDdDCCAlygAwIBAgIGAX...(full cert from your IdP)...P3B/k0SolrFYPo
-----END CERTIFICATE-----

1. In the IBM Security Verify admin console, go to Applications → Add application → Custom Application → SAML 2.0.
2. Under Sign-on, set Assertion consumer service URL to the ACS URL Safeguard shows after Save and Entity ID to the SP Entity ID Safeguard shows after Save.
3. Set Name ID format to Email, mapped from the user's email attribute.
4. Under Attribute mapping, add an attribute named email mapped from the user's email attribute — separate from the Name ID format setting above.
5. Copy the SSO URL and Issuer, and download the signing certificate, from the app's Sign-on tab.
6. In Safeguard, click Add Provider → SAML 2.0 → IBM Security Verify, and enter those three values.
7. Assign the application to the entitled users/groups under the app's Access tab.
8. Click Test in Safeguard to confirm.

Common errors: a "SAML response validation failed" error at Safeguard usually means the Entity ID entered in Safeguard doesn't exactly match the Issuer IBM Security Verify sends (this comparison is case-sensitive).