## 6.1.1.8.1.1.4.2  Register SAP BTP Subaccount in Any SAML 2.0 Identity Provider
An SAML service provider interacts with an SAML 2.0 identity provider to authenticate users signing in by means of a single sign-on (SSO) mechanism. In this scenario, the User Account and Authentication (UAA) service acts as a service provider representing a single subaccount. To establish trust between an identity provider and a subaccount, you must register your subaccount by providing the SAML details for web-based authentication in the identity provider itself.
## Context
Administrators must configure trust on both sides, in the service provider and in the SAML identity provider.
This description tries to guide you through the configuration of your identity provider. The trust configuration on the side of the SAM 2.0 identity provider must contain the following items:
- Metadata for web-based authentication or the relevant configuration information
If available, the metadata contains the configuration information, including the signing certificate and the required URLs. You can create the metadata file of your subaccount using the SAML Metadata button in
Security Trust Configuration of your subaccount.
- Use e-mail as the unique name ID attribute, and map the user attribute Groups to the assertion attribute
- Groups (capitalized). This attribute is required for the assignment of roles. This makes sure that there is a trust relationship between your SAM 2.0 identity provider and the subaccount.
Your administrators use the administration console of your SAML 2.0 identity provider to register the subaccount.
To establish trust from a tenant of your identity provider to a subaccount, assign a metadata file and define attribute details. The SAML 2.0 assertion includes these attributes. With the UAA as SAML 2.0 service provider, they are used for automatic assignment of UAA authorizations based on information maintained in the identity provider.
## Procedure
1. Open the administration console of your SAML 2.0 identity provider.
2. Go to the configuration of your SAML 2.0 identity provider.
3. Add a new SAML service provider as described in the documentation of your identity provider.
4. (If applicable) Choose a name for your identity provider that clearly identifies it as your new service provider. Save your changes.
Users see this name in the logon screen when the authentication is requested by the UAA service. Seeing the name, they know which application they currently access after authentication.
5. Choose the SAML 2.0 configuration and import the relevant metadata XML file. Save your changes.
##  Note
Use the saml-&lt;subdomain&gt;-sp.xml metadata file of your subaccount. You can create the file using Download SAML Metadata in Security Trust Configuration of your subaccount.
Take care that the fields of the SAML configuration are filled. The metadata provides information, such as the name, the URLs of the assertion consumer service and single logout endpoints, and the signing certificate.
6. Choose or create the name ID attribute and select E-mail as a unique attribute. Save your changes.
7. Choose or create a user attribute, and enter Groups (capitalized) as attribute name for the Groups user attribute. Save your changes.
## Related Information
Settings for Default SAML Federation Attributes of Identity Providers for Business Users [page 2309]