SailPoint IdentityNow

Example values

The tenant-specific values (the sg_ab12cde parts) show the shape only — Safeguard displays your real ACS URL and SP Entity ID in the Add Provider dialog after you click Save. This table makes it unambiguous which value goes on which side.

In SailPoint IdentityNow — the SAML app / SP details (you enter these at the IdP):

In Safeguard — Add Provider → SAML 2.0 (you copy these from the IdP):

-----BEGIN CERTIFICATE-----
MIIDdDCCAlygAwIBAgIGAX...(full cert from your IdP)...P3B/k0SolrFYPo
-----END CERTIFICATE-----

1. In SailPoint IdentityNow, go to Admin → Connections → Applications → Add Web App → "Connect a SAML app you've already set up."
2. Under Sign-On, set ACS URL to the ACS URL Safeguard shows after Save and Audience/SP Entity ID to the SP Entity ID Safeguard shows after Save.
3. Set Application username / NameID format to Email.
4. Under Attribute Mapping, add an outgoing attribute named email sourced from the identity's email — separate from the Application username/NameID setting above.
5. Copy the IdP SSO URL, Issuer, and download the certificate from the app's Sign-On tab.
6. In Safeguard, click Add Provider → SAML 2.0 → SailPoint IdentityNow, and enter those three values.
7. Provision the application to the identities/roles that need access.
8. Click Test in Safeguard to confirm.

Common errors: "Access Denied" at IdentityNow means the app was created but never provisioned to the identity/role attempting to sign in.