When configuring Single Sign-On (SSO) using SAML, Prisma Cloud acts as the Service Provider (SP) and integrates with an Identity Provider (IdP). To establish this trust relationship, the IdP must be configured with specific information about the SP. The IdP needs to know the unique identifier of the SP, which is the SP Entity ID. It also needs to know where to send the SAML assertion (the security token) after a user successfully authenticates; this endpoint is the Assertion Consumer Service (ACS) URL.

A. Username: The username is a user credential authenticated by the IdP, not a static configuration parameter for the SP-IdP trust relationship.

B. SSO Certificate: The IdP generates its own certificate to sign assertions. While the SP might have a certificate, it's the IdP's certificate that the SP needs to import, not the other way around for this part of the setup.

1. Palo Alto Networks

Prisma Cloud Administrator's Guide (SaaS)

"Integrate Prisma Cloud with an SSO Provider". The guide details the SSO setup process

stating

"Copy the following values from Prisma Cloud to your IdP: Audience URI (SP Entity ID) [and] Assertion Consumer Service URL."