--- title: Implement SAML as an external provider in an ASP.NET... description: A technical walkthrough demonstrates how to add SAML as an external identity provider to an ASP.NET Core Identity application that uses Duende IdentityServer... canonical: https://daily.dev/posts/implement-saml-as-an-external-provider-in-an-asp-net-core-identity-application-using-duende-as-an-oi-p4jafuri4 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Implement SAML as an external provider in an ASP.NET Core Identity application using Duende as an OIDC server | daily.dev og:description: A technical walkthrough demonstrates how to add SAML as an external identity provider to an ASP.NET Core Identity application that uses Duende IdentityServer... og:url: https://daily.dev/posts/implement-saml-as-an-external-provider-in-an-asp-net-core-identity-application-using-duende-as-an-oi-p4jafuri4 og:image: https://api.daily.dev/og/posts/p4JaFURI4.png og:image:alt: Implement SAML as an external provider in an ASP.NET Core Identity application using Duende as an OIDC server og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Implement SAML as an external provider in an ASP.NET Core Identity application using Duende as an OIDC server **[Damien Bowden](https://daily.dev/sources/damienbod)** · 5 min read · 0 upvotes · 0 comments ## Summary A technical walkthrough demonstrates how to add SAML as an external identity provider to an ASP.NET Core Identity application that uses Duende IdentityServer as an OIDC server. It uses the Sustainsys.Saml2.AspNetCore2 NuGet package to implement the SAML client, with Entra ID configured as the SAML identity provider via an Enterprise Application. The setup covers loading IdP metadata and certificates, configuring the SAML authentication scheme, triggering the challenge flow, and mapping claims in the external login callback. The author notes that OpenID Connect should be preferred over SAML when available, since SAML is more complex and less well supported. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How do I add SAML as an external identity provider in an ASP.NET Core Identity application using Duende IdentityServer? Use the Sustainsys.Saml2.AspNetCore2 NuGet package to add a SAML authentication scheme alongside Duende IdentityServer. Configure SPOptions with the entity ID and return URL, create an IdentityProvider instance pointing to the Entra ID metadata location, load the IdP's signing certificate, and trigger authentication via a Challenge request to the Saml2Defaults.Scheme, then handle the result in an external login callback that maps claims into ASP.NET Core Identity. _daily.dev surfaces walkthroughs like this for developers wiring SAML federation into ASP.NET Core identity stacks._ ### Should I use SAML or OpenID Connect when setting up an Entra ID Enterprise Application for single sign-on? OpenID Connect should always be preferred over SAML in an Entra ID tenant when it is available, since SAML is more complex to configure and less well supported overall. SAML should only be used in cases where OpenID Connect is not an option, such as integrating with legacy applications or identity providers that lack OIDC support. _Developers deciding between SAML and OIDC for Entra ID integrations can track these trade-offs on daily.dev._ ## Similar posts on daily.dev - [Examples of SAML Providers](https://daily.dev/posts/examples-of-saml-providers-aneafft7f) · Security Boulevard · 0 upvotes · 0 comments - [Azure AD SAML vs OIDC: Which Protocol Should Your SaaS Use?](https://daily.dev/posts/azure-ad-saml-vs-oidc-which-protocol-should-your-saas-use--pbzjzdwf1) · Security Boulevard · 0 upvotes · 0 comments - [Integrate Keycloak with ASP.NET Core Using OAuth 2.0](https://daily.dev/posts/integrate-keycloak-with-asp-net-core-using-oauth-2-0-w348tdawg) · Milan Jovanović · 11 upvotes · 1 comments --- Tags: [#authentication](https://daily.dev/tags/authentication) [View this post on daily.dev](https://daily.dev/posts/implement-saml-as-an-external-provider-in-an-asp-net-core-identity-application-using-duende-as-an-oi-p4jafuri4) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Implement SAML as an external provider in an ASP.NET Core Identity application using Duende as an OIDC server","url":"https://daily.dev/posts/implement-saml-as-an-external-provider-in-an-asp-net-core-identity-application-using-duende-as-an-oi-p4jafuri4","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/implement-saml-as-an-external-provider-in-an-asp-net-core-identity-application-using-duende-as-an-oi-p4jafuri4"},"datePublished":"2026-10-04T13:04:06.289Z","dateModified":"2026-10-04T13:04:29.012Z","description":"A technical walkthrough demonstrates how to add SAML as an external identity provider to an ASP.NET Core Identity application that uses Duende IdentityServer...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/b718e7ee98a3d4a9859837148cc88e0f?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/b718e7ee98a3d4a9859837148cc88e0f?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Damien Bowden","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Damien Bowden","logo":"https://media.daily.dev/image/upload/s--MpH73n5h--/f_auto,q_auto/v1791119042/logos/damienbod?_a=BAMAMicg0","url":"https://daily.dev/sources/damienbod"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/implement-saml-as-an-external-provider-in-an-asp-net-core-identity-application-using-duende-as-an-oi-p4jafuri4","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"authentication","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Damien Bowden","item":"https://daily.dev/sources/damienbod"},{"@type":"ListItem","position":3,"name":"Implement SAML as an external provider in an ASP.NET Core Identity application using Duende as an OIDC server"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/implement-saml-as-an-external-provider-in-an-asp-net-core-identity-application-using-duende-as-an-oi-p4jafuri4#faq","mainEntity":[{"@type":"Question","name":"How do I add SAML as an external identity provider in an ASP.NET Core Identity application using Duende IdentityServer?","acceptedAnswer":{"@type":"Answer","text":"Use the Sustainsys.Saml2.AspNetCore2 NuGet package to add a SAML authentication scheme alongside Duende IdentityServer. Configure SPOptions with the entity ID and return URL, create an IdentityProvider instance pointing to the Entra ID metadata location, load the IdP's signing certificate, and trigger authentication via a Challenge request to the Saml2Defaults.Scheme, then handle the result in an external login callback that maps claims into ASP.NET Core Identity. daily.dev surfaces walkthroughs like this for developers wiring SAML federation into ASP.NET Core identity stacks."}},{"@type":"Question","name":"Should I use SAML or OpenID Connect when setting up an Entra ID Enterprise Application for single sign-on?","acceptedAnswer":{"@type":"Answer","text":"OpenID Connect should always be preferred over SAML in an Entra ID tenant when it is available, since SAML is more complex to configure and less well supported overall. SAML should only be used in cases where OpenID Connect is not an option, such as integrating with legacy applications or identity providers that lack OIDC support. Developers deciding between SAML and OIDC for Entra ID integrations can track these trade-offs on daily.dev."}}]} ```