Domain-level SAML assertion: Supported claims examples in Smartsheet

These attributes are specific to domain-level SAML configurations. To check the attributes for plan-level SAML, see Plan-level SAML assertion: Supported claims examples in Smartsheet.

Required attributes

To successfully sign in and authenticate, you must provide both the Persistent ID and Email Address to Smartsheet during the SAML exchange process. This requires two separate claims.

Persistent ID

• urn:oasis:names:tc:SAML:2.0:nameid-format:persistent

Email address

• email

Consider the following regarding email addresses:

• All letters in the email address must be lowercase
• You must validate the email domain
• It's advisable for the email domain to match the primary email used in Smartsheet, although it's not a requirement

Optional attributes

The following attributes are recommended but optional:

Given name

The given name (first name) of the person associated with the account:

• givenName

Surname

The surname (last name) of the person associated with the account:

• surname

Additional attributes

Some SAML services may ask for additional information, such as the Assertion Consumer Service (ACS) URL and the Audience Restriction (Entity ID). You can easily find these values on the Configure SAML IdP screen.

To access the screen:

1. Go to Admin Center
2. Navigate to Authentication and select Add a SAML IdP > Other IdP (Customize).

In Azure, you don't need to manually enter the persistent ID value, as it's automatically included through the Unique User Identifier claim that comes pre-filled. For the Unique Identifier Claim, the value passed must be user.userprincipalname. The only attribute value you must add manually is the email address. Any other pre-populated claims within the application should be deleted. Learn more about configuring Azure for domain-level single sign-on to Smartsheet.