> ## Documentation Index
> Fetch the complete documentation index at: https://docs.dqlabs.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# IBM Verify

> Step-by-step guide to configuring IBM Security Verify as the SAML 2.0 identity provider for single sign-on into Prizm.

<script type="application/ld+json">
  {`{
            "@context": "https://schema.org",
            "@type": "TechArticle",
            "headline": "IBM Verify SSO",
            "description": "Step-by-step guide to configuring IBM Security Verify as the SAML 2.0 identity provider for single sign-on into Prizm.",
            "url": "https://docs.dqlabs.ai/security/sso/ibm-verify",
            "publisher": {
              "@type": "Organization",
              "name": "DQLabs Inc",
              "logo": "https://media.brand.dev/332adc35-5bc4-4d2b-bf78-256aa4a5e414.svg"
            }
            }`}
</script>

## Overview

This guide describes how to configure **IBM Security Verify** as the SAML 2.0 Identity Provider (IdP) for PRIZM. After completing the configuration, entitled users can securely authenticate to PRIZM using their IBM Security Verify credentials.

## Prerequisites

Before you begin, ensure you have:

* IBM Security Verify Administrator privileges
* Permission to create SAML applications
* PRIZM Administrator access
* PRIZM Service Provider (SP) details:
  * Entity ID
  * ACS URL
  * Sign-on URL

## Step 1: Configure IBM Security Verify

1. Sign in to the **IBM Security Verify Admin Console** create your tenant.
2. Navigate to: **Applications → Add Application**
   <Frame>
     <img src="https://mintcdn.com/dqlabs/XQsoZNdlCRuYucXP/images/image-49.png?fit=max&auto=format&n=XQsoZNdlCRuYucXP&q=85&s=c27bbe540d7b6fd85c37e8b60f0b6b06" alt="Image" width="1142" height="250" data-path="images/image-49.png" />
   </Frame>
3. Select **Custom Application**.
   <Frame>
     <img src="https://mintcdn.com/dqlabs/XQsoZNdlCRuYucXP/images/image-50.png?fit=max&auto=format&n=XQsoZNdlCRuYucXP&q=85&s=62174cb0851d84f471f8efb7aa699a2d" alt="Image" width="1065" height="401" data-path="images/image-50.png" />
   </Frame>
4. Configure **SAML 2.0** as the sign-on method and make sure "Use metadata" is disabled.
   <Frame>
     <img src="https://mintcdn.com/dqlabs/XQsoZNdlCRuYucXP/images/image-51.png?fit=max&auto=format&n=XQsoZNdlCRuYucXP&q=85&s=a6df3400b0a86b877082fd86c1b7dd3d" alt="Image" width="808" height="193" data-path="images/image-51.png" />
   </Frame>
5. Provide the application details (Application Name, Company Name, Owner) in General tab.
6. Configure the following SAML settings using the values available in **PRIZM → Profile → Organization → SSO/SAML**.

\*Note the tenant name: Your tenant name is the subdomain of your login URL — e.g. if your URL is [mycompany.verify.ibm.com](http://mycompany.verify.ibm.com), your tenant name is [mycompany.verify.ibm.com](http://mycompany.verify.ibm.com). You will need this to download the metadata XML file.

| IBM Security Verify Field                  | PRIZM Value |
| :----------------------------------------- | :---------- |
| Provider ID                                | Entity ID   |
| Assertion Consumer Service URL (HTTP-POST) | ACS URL     |
| Target URL                                 | Sign-on URL |
| Service Provider SSO URL                   | Sign-on URL |

7. Configure the required attribute mappings.
   | <br /> **Attribute name**<br />**(Prizm variable)** | **Attribute name format** | **IBM SV attribute source** | **Required** |
   | :-------------------------------------------------- | :------------------------ | :-------------------------- | :----------- |
   | emailaddress                                        | basic                     | email                       | Yes          |
   | givenname                                           | basic                     | given\_name                 | Optional     |
   | surname                                             | basic                     | family\_name                | Optional     |

<Frame>
  <img src="https://mintcdn.com/dqlabs/XQsoZNdlCRuYucXP/images/image-53.png?fit=max&auto=format&n=XQsoZNdlCRuYucXP&q=85&s=a69b4d6379d0c87320b18ce78dd07bc0" alt="Image" width="1143" height="583" data-path="images/image-53.png" />
</Frame>

8. Save the application.

## Step 2: Configure PRIZM

1. Download the **Federation Metadata XML** from IBM Security Verify.<br />IBM Security Verify does not provide a download button on the application page. The Federation Metadata XML is accessed via a direct tenant-level URL.
   * **Open in browser:** Paste the following URL into your browser while logged into IBM Security Verify:
   > https\://{yourTenantName}/v1.0/saml/federations/saml20ip/metadata
   * Save the file: Right-click the page → **Save as** → ensure the filename ends in .xml
2. In PRIZM, navigate to: **Profile → Organization → SSO/SAML**
3. Enable **Single Sign-On**.
4. Select **IBM Security Verify** as the Identity Provider.
5. Upload the **Federation Metadata XML**.
6. Click **Save**.

<Frame>
  <img src="https://mintcdn.com/dqlabs/XQsoZNdlCRuYucXP/images/image-54.png?fit=max&auto=format&n=XQsoZNdlCRuYucXP&q=85&s=52c138811b197f4198887997fc205022" alt="Image" width="1190" height="551" data-path="images/image-54.png" />
</Frame>

## Step 3: Assign Users

In IBM Security Verify:

* Open the PRIZM application.
* Navigate to the **Entitlement** tab.
* Assign the required users or groups.
* Save the configuration.
  <Frame>
    <img src="https://mintcdn.com/dqlabs/XQsoZNdlCRuYucXP/images/image-55.png?fit=max&auto=format&n=XQsoZNdlCRuYucXP&q=85&s=0ecc19b5f08a2579346468f63071453f" alt="Image" width="1048" height="547" data-path="images/image-55.png" />
  </Frame>

In PRIZM:

Go to Access page and enable SSO for the users.

Users must be entitled before testing SSO.

## Step 4: Test Login

1. Navigate to the PRIZM login page.
2. Select **Sign in with SSO**.
3. Enter your corporate email address.
4. Authenticate using IBM Security Verify.

After successful authentication:

* Existing PRIZM users are authenticated.
* New users are automatically provisioned during their first login (JIT provisioning).
* Roles are assigned automatically based on incoming group mappings.

### SCIM Provisioning (Optional)

1. Open the PRIZM application.
2. Configure SCIM provisioning.
3. Enter:
   * SCIM Endpoint
   * Authentication Token
4. Save the configuration.
5. Enable provisioning.
6. Assign users/groups.