Domain-level SAML assertion: Supported claims examples in Smartsheet

A reference for supported claims and SAML assertion examples.

Who can use this?

Plans:

  • Enterprise

Domain-level SAML authentication requires specific claim attributes to identify and authenticate users. Use this reference when configuring your Identity Provider (IdP) to confirm which attributes Smartsheet requires and to review supported SAML assertion examples for each.

These attributes are specific to domain-level SAML configurations. To check the attributes for plan-level SAML, see Plan-level SAML assertion: Supported claims examples in Smartsheet.

Required attributes

To enable successful sign-in and authentication, you must provide both the Persistent ID and Email Address to Smartsheet during the SAML exchange. This requires two separate claims.

Persistent ID

  • urn:oasis:names:tc:SAML:2.0:nameid-format:persistent

Email address

  • email

Consider the following regarding email addresses:

  • All letters in the email address must be lowercase
  • You must validate the email domain
  • It's advisable for the email domain to match the primary email used in Smartsheet, although it's not a requirement

Configure a Persistent ID in your IdP

If your IdP doesn't include a Persistent ID attribute by default, you need to configure one before completing your domain-level SAML setup. SAML uses this identifier to reliably recognize users across login sessions. It must be unique to each user and can't change after configuration.

To configure a Persistent ID in your IdP:

  1. Identify an immutable, unique attribute in your user directory to use as the Persistent ID, such as a user ID or GUID.
  2. If your IdP can't use the source attribute directly as a Persistent ID, create or transform the attribute using your IdP's attribute mapping or transformation features.
  3. Configure your IdP to include the Persistent ID attribute in the SAML assertion sent to Smartsheet. Assign it a consistent name.

Optional attributes

The following attributes are recommended but optional:

Given name

The given name (first name) of the person associated with the account:

  • givenName

Surname

The surname (last name) of the person associated with the account:

  • surname

Additional attributes

Some SAML services may ask for additional information, such as the Assertion Consumer Service (ACS) URL and the Audience Restriction (Entity ID). You can find these values on the Configure SAML IdP screen.

To access the screen:

  1. Go to Admin Center
  2. Navigate to Authentication and select Add a SAML IdP > Other IdP (Customize).

In Entra ID, you don't need to manually enter the persistent ID value, as it's automatically included through the Unique User Identifier claim that comes pre-filled. For the Unique Identifier Claim, the value passed must be user.userprincipalname. The only attribute value you must add manually is the email address. Any other pre-populated claims within the application should be deleted. Learn how to configure Entra ID for domain-level single sign-on to Smartsheet.