Overview

You can set up your Redis Cloud databases and Redis Client libraries to ensure your app re-connects to your database after unexpected failover events or network outages and minimize data losses.

Set up databases

These settings can be turned on when you create or edit your database.

Enable data persistence

Enabling [Data persistence]() allows Redis to save your data to a durable storage medium, such as a disk, to ensure data availability in case of memory loss or system failure.

Redis Cloud supports the following data persistence options:

- An **Append-Only File** maintains a record of write operations. This lets you restore data by using the record to reconstruct the database up to the point of failure. The Append-only file updates on every write or every second.

- A **Snapshot** is a copy of the in-memory database, taken at periodic intervals (one, six, or twelve hours). You can restore data to the snapshot's point in time.

Append-only files provide greater protection than snapshots at the cost of resources and recovery time.
Although snapshot recovery is faster, the risk of data loss is higher, depending on the time between failure and the most recent snapshot.

If you do not enable data persistence, your data may be lost if the database goes down. It is best practice to  enable data persistence for all production databases. You can turn on data persistence when you create or edit your database.

Enable replication

[Database replication]() allows for automatic failover and greater fault tolerance. Replication can prevent data loss in the event of a hardware or zone failure.

Redis Cloud supports these replication settings:

- **No replication**: You will have a single copy of your database in one zone. If anything happens to your database, your app will not be able to connect to it.
- **Single-Zone**: Your database will have a primary dataset and a replica dataset located in the same cloud zone. If anything happens to the primary database, the replica takes over and becomes the new primary. Your app will connect to the new primary database automatically with the same endpoint.
- **Multi-Zone** _(or Multi-AZ)_: The primary and its replicas are stored in different availability zones. This means that your app will connect to the new primary database zone automatically if an entire availability zone becomes unavailable.

You can enable replication when you create your database. You can switch between no replication and single-zone replication after your create your database. However, you can't switch from no replication or single-zone replication to multi-zone replication.

It is best practice to enable replication for any databases that need to be highly available.

Create Active-Active databases for geographic availability

For geographic availability, create [Active-Active databases](), which provide:

- **Geographic distribution**: Data is replicated across multiple regions and availability zones. Applications can read from and write to the nearest region, reducing latency for users worldwide.

- **99.999% availability**: Higher availability than single-region deployments by protecting against regional outages.

- **Automatic conflict resolution**: Uses conflict-free replicated data types (CRDTs) to handle concurrent writes across regions.

Set manual maintenance windows

Redis maintains your Redis Cloud subscriptions and databases as needed to ensure your databases are running the most stable and up-to-date version of Redis. By default, Redis will perform [maintenance]() automatically while limiting service disruption as much as possible.

For stable apps, you may want to control when Redis can perform maintenance on your databases. For Redis Cloud Pro subscriptions, you can [set manual maintenance windows]() to ensure non-urgent maintenance will occur at set times. Configuring or altering the maintenance window will not have any impact on your subscription or databases.

A Redis Cloud Essentials database has a set maintenance window based on the region where it is located. See [Essentials maintenance]() for more information.

Set up Redis clients

When you're developing your apps, it is best to use specific Redis Client features to connect to Redis Cloud if they are available for your preferred client.

See [Clients]() to learn how to connect with the official Redis clients.

Production usage guides

For production-ready configurations and best practices, see the production usage guides for each client:

- [redis-py]()
- [Node.js]()
- [Jedis]()
- [Lettuce]()
- [go-redis]()
- [NRedisStack]()

Re-attempt connections

Some clients allow you to re-try connecting to your database if the connection fails. For these clients, we recommend that you implement connection re-attempts to ensure high availability and connection stability.

View your [client's docs]() to learn more.

Refresh DNS

Your application may disconnect from your database either during planned maintenance or for other, unplanned reasons. Most Redis clients are set to refresh their DNS address when they reconnect to the database, and you will not be required to perform any further action. If you encounter connectivity problems for more than a minute during maintenance then you should refresh your DNS entries.

Depending on the client, you may be recommended to turn off the DNS cache entirely. Refer to your [client's docs]() to learn more.

Use the WAIT and WAITAOF commands

The [WAIT]() and [WAITAOF]() commands block the current client until all previous write commands are persisted between replicas. With these commands, your application guarantees that acknowledged writes are recorded between replicas.

For more info, see [Use the WAIT command for strong consistency]().

Test failover behavior

You can test your app's failover behavior in Redis Cloud by running a failover test. A failover test in Redis Cloud simulates a controlled disruption such as an endpoint migration, node failure, or cluster outage to confirm that your app can reconnect, recover, and continue operating without data loss. These tests are a critical part of validating high-availability and disaster recovery, ensuring that applications meet recovery time and recovery point objectives.

For more info, see [How to run a Failover Test in Redis Cloud](https://support.redislabs.com/hc/en-us/articles/29001166157074-How-to-Run-a-Failover-Test-in-Redis-Cloud).

More info

- [Redis Clients]()
- [Active-Active Redis]()
- [Active-Active Redis applications]()


Access management

Summary: Control who can make changes to your databases using the Redis Cloud console.

Overview

The **Access management** screen helps you manage:

- The team of users allowed to access your subscription and its databases.
- The API keys that authenticate application access to your account.
- [Single sign-on (SSO) with SAML]().

Here, you learn how to manage your team's users and control their level of access.

For help managing API keys, see [Manage API keys]().

Manage team access

The **Team** tab lets you manage the people allowed to access your account. Each authorized person is assigned to a role that specifies their privileges.

The list contains one entry summarizing the team settings for each user in your team. By default, the list includes the account owner.

The list includes several buttons and icons to help you manage the list:

| Icon | Description |
|------|-------------|
|  | The **Add** button lets you add members to your team |
|  | The **Edit** button lets you edit the settings for the selected team member |
|  | The **Delete** button lets you remove members from your team
| <nobr></nobr> | The **Sort ascending** and **Sort descending** icons display the list according to the selected order |

You can also use the list search to find a specific user or filter by **Role**, **User Type**, or **Options**.

Add user

When you add a member to your team, the **Add user** dialog appears.

Use the dialog to specify these values.

| Setting | Description |
|---------|-------------|
| **First name** | First name of the user displayed in the Redis Cloud console and in email messages |
| **Last name** | Last name of the user displayed in the Redis Cloud console and in email messages |
| **Role** | The role identifies their subscription and account privileges.  For details, see [Team management roles](#team-management-roles). |
| **Email** | The address used for alerts and other email messages regarding the account |
| **Alert emails** | Enable to be notified when subscription databases cross certain thresholds, such as exceeding memory limits or latency requirements |
| **Operational emails** | Notifications about subscription and database changes, such as creating or deleting a database, and [subscription and database maintenance]() |
| **Billing emails** | Notifications about billing, such as when bills are issued and paid |
| **Multi-factor authentication** | Whether MFA is enabled for the member.  This is deactivated when members have not enabled or confirmed MFA in their user profile settings. |

Use the **Add user** button to save your new team member details.

Redis will send an activation email to the user once their details are saved. After following the activation link, they can sign in.

Edit user

To edit user team details, select the user from the list and then select the **Edit** button.
The **Edit user** dialog displays the details you can change.

You can change any detail except the team member's email address.

Select **Save user** to save your changes.

Delete user

To remove a member from your team, select them from the list and then select the **Delete** button. A confirmation dialog appears.

Select **Delete user** to confirm removal. This is a permanent action that cannot be undone.

Team management roles

Each team member is assigned a role that identifies their privileges and limits their activities in the Redis Cloud console.

Roles and responsibilities are:

- **Owner** can view, create, and edit any settings in the account.

    Each subscription must have at least one account owner. Accounts can have multiple owners.

    Owners can also manage subscriptions, databases, and API keys.

- **Billing Admin** can view and edit settings related to billing and payments.

    Billing Admins can add and remove payment methods and change the payment method for a subscription, but they cannot change any other subscription or database settings.

- **Manager** can view, create, and edit any setting in the subscription.

    Managers can change subscription costs and change payment methods associated with a subscription, but they cannot add or remove available payment methods.

- **Member** can view, create, and edit databases in ways that do not impact costs.

    Members cannot create databases or edit databases in ways that impact costs.

- **Viewer** can view all databases and their configurations, including database secrets.

- **Logs viewer** can not access the Redis Cloud console. They are only allowed access to the [Redis Cloud API]() [`GET logs/`]() endpoint.

This table shows each role's ability to perform common tasks.

| **Task** | **Owner** | **Billing Admin** | **Manager** | **Member** | **Viewer** | **Logs Viewer** |
|---|---|---|---|---|---|---|
| Access management | ✅ Yes | ❌ No | ❌ No | ❌ No | ❌ No | ❌ No |
| Account settings | ✅ Yes | ✅ Yes[1](#table-note-1) | ❌ No | ❌ No | ❌ No | ❌ No |
| Billing & payments | ✅ Yes | ✅ Yes | ❌ No[4](#table-note-4) | ❌ No | ❌ No | ❌ No |
| Create subscription | ✅ Yes | ❌ No | ✅ Yes | ❌ No | ❌ No | ❌ No |
| Edit subscription | ✅ Yes | ✅ Yes[2](#table-note-2) | ✅ Yes | ❌ No | ❌ No | ❌ No |
| Create database (affects cost) | ✅ Yes | ❌ No | ✅ Yes | ❌ No | ❌ No | ❌ No |
| Edit database (affects cost) | ✅ Yes | ❌ No | ✅ Yes | ❌ No | ❌ No | ❌ No |
| Create database (no cost impact) | ✅ Yes | ❌ No | ✅ Yes | ❌ No | ❌ No | ❌ No |
| Edit database (no cost impact) | ✅ Yes | ❌ No | ✅ Yes | ✅ Yes | ❌ No | ❌ No |
| View subscription | ✅ Yes | ✅ Yes | ✅ Yes | ✅ Yes | ✅ Yes | ❌ No |
| View database | ✅ Yes | ✅ Yes[3](#table-note-3) | ✅ Yes | ✅ Yes | ✅ Yes | ❌ No |
| Use the [REST API]() | ✅ Yes | ❌ No | ❌ No | ❌ No | ✅ Yes[5](#table-note-5) | ✅ Yes[6](#table-note-6) |

1. Billing Admins can only edit the account billing address in Account Settings.

2. Billing Admins can only change the payment method when editing a subscription.

3. Billing Admins can see the list of databases, but can not see database details, including connection details.

4. Managers are able to view existing payment methods and assign them as payment methods for subscriptions, but they cannot add or remove payment methods.

5. Viewers can use the REST API for GET requests, but cannot modify subscription or database details.

6. Logs viewers can only use the [`GET logs/`]() endpoint of the REST API.


Create roles for Active-Active databases

Content

For [Active-Active databases](), you can define roles with different levels of access for different regions. For example, you can define a user role with full database access in one region and read-only access in another. Or, you can prevent a user from running any commands in a specified region.

1. Go to **Data Access Control > Roles** and either select `+` to create a new role or point to an existing role and select the pencil icon to edit it.

1. In the **Associations** section of the **Edit role** or **Create new role** screen, you can select `+` to create a new association or point to an existing association and select the pencil icon to edit it.

1. Select one or more Active-Active databases from the **Databases** list. Active-Active databases are marked with a globe icon.

1. To set the role's default level of access to the selected databases, choose a **Redis ACL** from the list and select the check mark to confirm the association.

The default level of access to the selected database only applies to regions that exist when the role is created. If you add a new region to your Active-Active subscription, the new region will default to **No Access** for the role.

1. Select the ACL name next to a region to change which ACL applies to that region.

    In addition to the ACL rules that are already configured, you can set a role to have **No-Access** in a region. This is a special rule that prevents a user with this role from running any commands when connecting to the database in that region.

1. Select **Save role**.

When you assign a user-defined ACL rule to a role and associate it with one or more databases, Redis will verify that the ACL rule will work with the selected databases. Verify that the [syntax]() of the ACL rule is correct if you receive an error.

After you create a role, you can assign it to a user. Users with this role can access the databases according to the role's associated Redis ACLs. For more information, see [Assign roles to users]().


Configure permissions with Redis ACLs

Overview

You can define custom Redis ACL rules to assign to a data access role or use predefined Redis ACLs.

Redis provides three predefined ACL rules, which are marked with the Redis logo and can not be changed:

- **Full-Access**: Allows all commands.
- **Read-Write**: Allows read and write commands and excludes dangerous commands.
- **Read-Only**: Allows read commands only.

ACLs that are not marked with the Redis logo are user-defined ACL rules.

To configure a Redis ACL that you can assign to a data access role:

1. Go to **Data Access Control** from the [Redis Cloud console](https://cloud.redis.io/#/) menu.

1. Select the **Redis ACLs** tab.

1. Either select `+` to create a new Redis ACL or point to an existing ACL and select the pencil icon to edit it.

    The built-in Redis ACLs can't be edited.

1. Provide a descriptive name and create the ACL rule [using ACL syntax](#define-permissions-with-acl-syntax).

1. Select the check mark to save your changes.  Your new Redis ACL should appear in the list.

After you create a Redis ACL, you can assign it to a role. Redis ACLs are not fully verified until they are assigned to a role. For more information, see [Create roles]() or [Active-Active access roles]() for an [Active-Active database]().

Define permissions with ACL syntax

You can define these permissions using the [Redis ACL syntax](#acl-rules). This syntax lets you concisely specify which commands, command categories, keys, and pub/sub channels to allow.

- `+` *includes* commands or command categories
- `-` *excludes* commands or command categories
- `@` indicates a command category
- `~` defines a permitted key pattern
- `&` allows access to a [pub/sub channel]()

The Redis Cloud console will validate your ACL syntax while you are typing.

Command ACL rules

A **command** can be any [Redis command]().

For example, this Redis ACL rule indicates that the `SET` command is permitted:

[code example]

Command category ACL rules

A [**command category**](#command-categories) is a predefined, named set of commands.

For example, the Redis commands that
read data are available in the `read` command category. This Redis ACL rule permits access to all read commands:

[code example]

To find out which commands are included in the
`read` command category, run the following command with [`redis-cli`]():

[code example]

Key ACL rules

To specify which **keys** are accessible, use the [key permissions syntax](#key-permissions).

The following ACL rule allows access to all keys:

[code example]

Whereas, this ACL rule only allows access to keys prefixed with `cache:`

[code example]

Starting with Redis 7.0, key patterns can also be used to define how a command is able to read or write a key.

The following ACL rule allows you to copy information from keys prefixed with `cache:` into keys prefixed with `app:`:

[code example]

For more information on how this works, see the [key permissions syntax](#key-permissions).

Pub/sub ACL rules

Pub/sub ACL rules determine which pub/sub channels a user can access. For more information see, [Redis pub/sub]()

For versions older than Redis 7.0, pub/sub is permissive and allows access to all channels by default.

Redis 7.0 makes pub/sub restrictive and blocks access to all channels in Redis Software. However, Redis Cloud still defaults to permissive pub/sub even for Redis 7.0 subscriptions.

| Redis
version | Redis Open Source
pub/sub ACLs | Redis Cloud
pub/sub ACLs |
|:-------------:|-----------|-------------|
| 6.0 | Not supported | Not supported |
| 6.2 | Permissive | Permissive |
| 7.0 | Restrictive | Permissive |

#### Restrict channel access

To block access to all channels, use the following ACL rule:

[code example]

If you want to limit access to specific channels, first include `resetchannels`. Then use `&` syntax to allow access to particular channels:

[code example]

#### Allow all channels

To make pub/sub explicitly permissive and allow users to access all channels, set the following rule:

[code example]

Selectors

Starting with Redis 7.0, Redis supports adding multiple sets of rules that are evaluated independently of each other, called [selectors](#selectors).

The following ACL rule allows a user to execute `GET` on keys prefixed with `cache` and `SET` on keys prefixed with `app`:

[code example]

Predefined permissions

Redis Cloud includes three predefined permissions:

- Full-Access (`+@all ~*`) - All commands are allowed for all keys.

- Read-Write (`+@all -@dangerous ~*`) - All commands except for the `dangerous` command category are allowed for all keys.

- Read-Only (`+@read ~*`) - Only the `read` command category is allowed for all keys.

Advanced capability command permissions

Note that you can define permissions for the Redis commands of any advanced capabilities that are part of your subscription;
however, these permissions can only be used for databases that support those capabilities.


Create and edit database users

Summary: Create a database user and assign it a role.

Overview

Before you create a database user, you must [create a data access role]() to assign to that user.

Create a user

To create a user:

1. Go to **Data Access Control** from the [Redis Cloud console](https://cloud.redis.io/#/) menu.

1. Select the **Users** tab.

2. Select `+` to create a new user.

3. Enter a username in the **Username** field.

An error occurs if a user tries to connect to a memcached database with the username `admin`. Do not use `admin` for a username if the user will be connecting to a memcached database.

1. Select a [**Role**]() from the list.

1. Enter and confirm the user's password. ACL user passwords must be between 8 and 128 characters long.

    Then, select the check mark to save the user.

Assign roles to existing users

To assign a data access role to an existing user:

1. Go to **Data Access Control** from the [Redis Cloud console](https://cloud.redis.io/#/) menu.

1. Select the **Users** tab.

1. Point to the user and select the **Edit*** icon when it appears.

1. Select a [**Role**]() from the list.

1. Select the check mark to save the user.


Assign permissions to roles

Content

To assign [Redis ACLs]() to a data access role:

1. Go to **Data Access Control** from the [Redis Cloud console](https://cloud.redis.io/#/) menu.

1. Select the **Roles** tab.

1. Select `+` to create a new role or point to an existing role and select the pencil icon to edit it.

1. Enter a name for the role.

1. Select an **ACL rule** to assign to the role.

1. Select one or more databases from the **Databases** list and click the check mark to confirm the association.

1. Select **Save role**.

When you assign a user-defined ACL rule to a role and associate it with one or more databases, we'll verify that the ACL rule will work with the selected databases. The database may go into an Inactive state for a few seconds while we verify the ACL rule.

After you create a role, you can assign it to a user. Users with this role can access the databases according to the role's associated Redis ACLs. For more information, see [Assign roles to users]().

To assign Redis ACLs to a role for an [Active-Active database](), see [Active-Active access roles]().


Default user

Summary: Learn how to change your default user password or turn off access using the default user password.

Overview

Password-based authentication is a basic but essential Redis security feature. When you create a Redis Cloud database, your database is given a randomly generated password called the **Default user password**.

This password appears in the **Security** section of the **Configuration** tab of the database details screen.

Use the copy button to copy the password to the clipboard:

You'll need to use this password whenever you connect to your database using a Redis client. See [Connect to a database]() for more info.

If you have [blocked the public endpoint]() for your Redis Cloud Pro subscription, you can also turn on passwordless authentication for the default user. See [Block public endpoints]() for more info.

See your [Redis client's documentation]() to learn how to provide your password when connecting.

Change password

To change the default user password for your database:

1. From the database **Configuration** tab, select **Edit**.

1. Under the **Security** section, enter the new password in the **Default user password** field. Database passwords must be less than 50 characters long.

1. Select **Save database** to update the password.

Turn off default user

After you set up [role-based access control]() to limit who can access your database, we recommend that you turn off default user access.

To turn off the default user for a database:

1. From the database **Configuration** tab, select **Edit**.

1. Under the **Security** section, select the **Default User** switch to turn it off.

1. Select **Save database**.


Data access control

Summary: Control who can access your databases using the default user database password and role-based access control.

Default user

Summary: Lets you define multiple users with fine-grained data authorization features.

Enable Role-based access control

Configure permissions with Redis ACLs

Assign permissions to roles

Create and edit database users

Default user

When you create a Redis Cloud database, your database is given a randomly generated password called the [**Default user password**](). Learn how to [change the default user password]() or [turn off default user access]().

Role-based access control

With [role-based access control (RBAC)](), you create roles and assign users to those roles to grant different levels of access to the database.

- [Enable RBAC]()
- [Configure ACLs]()
- [Create roles]()
- [Create and edit database users]()
- [Active-Active roles]()


Enable Role-based access control

Overview

Role-based access control (RBAC) lets you define *roles* with specific sets of *permissions*. You can then assign *users* to these roles
to provide appropriate levels of access.

RBAC effectively lets you implement the [principle of least privilege](https://en.wikipedia.org/wiki/Principle_of_least_privilege). For example, you can provide
read-only access to an application whose only job is to display Redis data. Similarly, you can prevent new developers from running dangerous administrative commands.

Set up RBAC

To set up RBAC, first navigate to the **Data Access Control** screen.

There are three tabs on this screen: **Users**, **Roles**, and **Redis ACLs**.

In the **Redis ACLs** tab, you [define named *permissions*]() for specific Redis commands, keys, and pub/sub channels.

In the **Roles** tab, you [create roles](). Each role consists of a set of permissions for one or more Redis Cloud databases.

Finally, in the **Users** tab, you [create users]() and [assign each user a role]().

Database access users are different from account access users. To learn more, see [Access management]().

Redis ACLs vs. Redis Cloud RBAC

In Redis, you can create users and assign ACLs to them using the `ACL` command. However,
Redis does not support generic roles.

In Redis Cloud, you configure RBAC using the Redis Cloud console. As a result, certain Redis ACL
subcommands are not available in Redis Cloud. The following table shows which ACL commands are supported.

In Redis, you must explicitly provide access to the `MULTI`, `EXEC`, and `DISCARD` commands.
In Redis Cloud, these commands, which are used in transactions, are always permitted. However, the commands
run within the transaction block are subject to RBAC permissions.

When you run multi-key commands on multi-slot keys, the return value is `failure` but the command runs on the keys that are allowed.


Access control

Summary: Control who can access the Redis Cloud console and databases.

Access management

Summary: Social login with Redis Cloud.

Social login

Summary: Redis Cloud supports multi-factor authentication to reduce the risk of unauthorized Redis Cloud console access.

Multi-factor authentication

Summary: Redis Cloud supports both IdP-initiated and SP-initiated single sign-on (SSO) with SAML (Security Assertion Markup Language). You can use any identity provider to integrate with Redis Cloud as long as it supports the SAML protocol, or you can refer to integration guides for a few specific providers.

SAML single sign-on

Data access control

Content

Redis Cloud offers you a few different ways to control who can access and make changes to your databases.


Multi-factor authentication

Overview

To reduce the chances of unauthorized access, Redis Cloud allows users to enable multi-factor authentication (MFA).

When MFA is enabled, users must enter their username, password, and an authentication code when signing in. MFA requires a mobile device that can receive these authentication codes over text messaging. In addition, you may [use an authenticator app](#app) such as [Google Authenticator](https://en.wikipedia.org/wiki/Google_Authenticator) as one of your factors.

To further increase the security of the account, the account owner can [require MFA enforcement for all users](#enforcing).

Once you enable MFA, it will be required to access every account that belongs to you. Deactivating MFA enforcement on an account does not deactivate MFA enforcement for other users of that account that have defined a phone number. To deactivate MFA enforcement for other users, those users will each need to deactivate MFA enforcement for their own user accounts.

Enable MFA

Each user can enable and configure MFA for their account.
The default MFA configuration sends an authentication code by text message that users must enter when they sign in.

To configure MFA for your user account:

1. Sign in to your account.
2. From the Redis Cloud console menu, select your name and then **User Profile** from the drop down menu.

3. Under your user profile, locate **Multi-factor authentication**.

4. Enter your mobile phone number in the **Text message** box and then select **Send code**.
5. You will receive a confirmation code sent by text message. Enter the code when prompted by the Redis Cloud console and select **Verify**.

Your account is now configured for MFA.

We recommend that you also [configure MFA for an authenticator app](#app) as an additional factor.

If you cannot sign in to your account because of MFA, please [contact support](https://redis.io/support/).

If your mobile phone is lost or stolen, make sure that you update the MFA configuration to prevent unauthorized sign-ins.

Change your MFA phone number

To change the mobile phone number used for MFA:

1. Navigate to the Multi-Factor authentication section in the **User Profile**.
2. Select **Change number**.
3. Enter the new mobile phone number, and complete the verification process as described above.

Configure MFA for an authenticator app {#app}

After you configure MFA for text messages, you can also configure MFA to work with a time-based one-time password (TOTP) app such as [Google Authenticator](https://play.google.com/store/apps/details?id=com.google.android.apps.authenticator2&hl=en_US&gl=US&pli=1).

When you sign in to the Redis Cloud console, you can select  either an authentication code sent by text message or an authentication code shown in your authenticator app.

To configure MFA for an authenticator app:

1. Install an authenticator app on your mobile phone.
1. Add Redis Cloud to the app:
    1. From the **User Profile** view in your Redis Cloud account, locate **Multi-Factor Authentication**.
    1. Select **Connect** for the authenticator app. A QR code appears, requesting verification.
    1. Scan the QR code using your phone's authenticator app.
    1. Enter the code generated by your authenticator app to verify the setup.

You can now use either a text message code or an authenticator app code as your second factor when signing in.

#### Deactivate MFA

You can deactivate MFA for your user account. To deactivate MFA, go to your profile, locate **Multi-Factor Authentication**, and select **Deactivate**.

Enforce MFA for all user accounts {#enforcing}

Account owner users can enable MFA enforcement for all users in their account.
After MFA is enforced for the account, all users who do not have MFA enabled will be required to configure MFA the next time they sign in to the Redis Cloud console.

Redis Cloud does not enforce MFA for [SAML SSO]() users since the identity provider handles MFA management and enforcement.

To enable MFA enforcement for all user accounts:

1. Sign in as an account owner.
2. Go to **Account Settings**.
3. Under **Security**, switch the **MFA environment** toggle to *On*.

- When you enable MFA enforcement, users cannot disable MFA for their account.
- When you disable MFA enforcement, users can disable MFA for their account.

4. Select **Save changes** to save your changes.

Notify all of your Redis Cloud console users before enabling MFA enforcement.


SAML single sign-on

Summary: This integration guide shows how to configure Auth0 as a SAML single sign on provider for your Redis Cloud account.

Auth0 SAML integration guide

Summary: This integration guide shows how to configure AWS IAM Identity Center as a SAML single sign on provider for your Redis Cloud account.

AWS IAM Identity Center SAML integration guide

Summary: This integration guide shows how to configure Google Workspace as a SAML single sign on provider for your Redis Cloud account.

Google Workspace SAML integration guide

Summary: This integration guide shows how to set up Microsoft Entra as a SAML single sign on provider for your Redis Cloud account.

Microsoft Entra (formerly Azure Active Directory) SAML integration guide

Summary: This integration guide shows how to set up Okta as a SAML single sign-on provider for your Redis Cloud account.

Okta SAML integration guide (Generic)

Summary: This integration guide shows how to set up Okta as a SAML single sign on provider for your Redis Cloud account.

Okta SAML integration guide (Org2Org)

Summary: This integration guide shows how to set up PingIndentity as a SAML single sign-on provider for your Redis Cloud account.

PingIdentity SAML integration guide

Overview

Redis Cloud supports both [IdP-initiated](#idp-initiated-sso) and [SP-initiated](#sp-initiated-sso) [single sign-on (SSO)](https://en.wikipedia.org/wiki/Single_sign-on) with [SAML (Security Assertion Markup Language)](https://en.wikipedia.org/wiki/Security_Assertion_Markup_Language).

You cannot use [SCIM (System for Cross-domain Identity Management)](https://en.wikipedia.org/wiki/System_for_Cross-domain_Identity_Management) to provision Redis Cloud users. However, Redis Cloud supports just-in-time (JIT) user provisioning, which means Redis Cloud automatically creates a user account the first time a new user signs in with SAML SSO.

SAML SSO overview

When SAML SSO is enabled, the [identity provider (IdP)](https://en.wikipedia.org/wiki/Identity_provider) admin handles SAML user management instead of the Redis Cloud account owner.

You can use any identity provider to integrate with Redis Cloud as long as it supports the SAML protocol. You can also refer to these integration guides for several popular identity providers:

  - [Auth0 SAML integration]()
  - [AWS IAM Identity Center SAML integration]()
  - [Azure Active Directory SAML integration]()
  - [Google Workspace integration]()
  - [Okta SAML integration (Generic)]()
  - [Okta SAML integration (Org2Org)]()
  - [PingIdentity SAML integration]()

After you activate SAML SSO for a Redis Cloud account, all existing local users for the account, except for the user that set up SAML SSO, are converted to SAML users and are required to use SAML SSO to sign in. Before they can sign in to Redis Cloud, the identity provider admin needs to set up these users on the IdP side and configure the `redisAccountMapping` attribute to map them to the appropriate Redis Cloud accounts and [roles]().

IdP-initiated SSO

With IdP-initiated single sign-on, you can select the Redis Cloud application after you sign in to your [identity provider (IdP)](https://en.wikipedia.org/wiki/Identity_provider). This redirects you to the [Redis Cloud console](https://cloud.redis.io/#/login) and signs you in to your SAML user account.

SP-initiated SSO

You can also initiate single sign-on from the [Redis Cloud console](https://cloud.redis.io/#/login). This process is known as [service provider (SP)](https://en.wikipedia.org/wiki/Service_provider)-initiated single sign-on.

1. From the Redis Cloud console's [sign-in screen](https://cloud.redis.io/#/login), select **SSO**.

1. Enter the email address associated with your SAML user account.

1. Select the **Login** button.

    - If you already have an active SSO session with your identity provider, this signs you in to your SAML user account.

    - Otherwise, the SSO flow redirects you to your identity provider's sign in screen. Enter your IdP user credentials to sign in. This redirects you back to the Redis Cloud console and automatically signs in to your SAML user account.

Multi-factor authentication

The account owner remains a local user and should set up [multi-factor authentication (MFA)]() to help secure their account. After SAML activation, the account owner can set up additional local bypass users with MFA enabled.

If MFA enforcement is enabled, note that Redis Cloud does not enforce MFA for SAML users since the identity provider handles MFA management and enforcement.

Set up SAML SSO

To set up SAML single sign-on for a Redis Cloud account:

1. [Verify domain ownership in Redis Cloud](#verify-domain).

1. [Set up a SAML app](#set-up-app) to integrate Redis Cloud with your identity provider.

1. [Configure SAML identity provider in Redis Cloud](#configure-idp).

1. [Download service provider metadata](#download-sp) and upload it to your identity provider.

1. [Activate SAML SSO](#activate-saml-sso).

Verify domain ownership in Redis Cloud {#verify-domain}

Before you set up SAML SSO in Redis Cloud, you must verify that you own the domain(s) associated with your SAML setup.

1. Sign in to [Redis Cloud](https://cloud.redis.io/#/login) with the email address associated with the SAML user you set up with your identity provider.

1. Select **Access Management** from the [Redis Cloud console](https://cloud.redis.io) menu.

1. Select **Single Sign-On**.

1. Select the **Setup SAML SSO** button:

1. From the **SAML** screen of the [Redis Cloud console](https://cloud.redis.io), you must verify you own the domains associated with your SAML configuration. Select **Add domain** to open the **Manage domain bindings** panel.

1. Select **Copy** to copy the provided TXT DNS record. For each domain you want to associate with your SAML setup, add the copied TXT record to its DNS records.

1. Select **Add domain** to add a domain.

1. Enter the domain name and select  to save it, or select  to cancel.

1. After you save the domain name, its status is **Pending**. Select **Verify** to verify it.

    We'll check the domain's DNS records for the provided TXT record. If the TXT record does not exist or we can't resolve your domain, we won't be able to verify the domain and users with that domain won't be able to sign in using SAML SSO.

    Select  to delete a domain if it was added by mistake.

    If we find the TXT record, the domain's status will change to **Verified**.

    You can select **Add domain** to add another domain.

1. Select **Close** to close the domain binding panel.

After you verify at least one domain, you can select **Manage domains** to open the **Manage domain bindings** panel again and add or verify more domains.

Set up SAML app {#set-up-app}

Set up a SAML app to integrate Redis Cloud with your identity provider:

1. Sign in to your identity provider's admin console.

1. Create or add a SAML integration app for the service provider Redis Cloud.

1. Set up your SAML service provider app so the SAML assertion contains the following attributes:

    | Attribute name<br />(case-sensitive) | Description |
    |-------------------------------------------|-------------|
    | FirstName | User's first name |
    | LastName | User's last name |
    | Email | User's email address (used as the username in the Redis Cloud console) |
    | redisAccountMapping | Key-value pair of a lowercase [role name]() (owner, member, manager, billing_admin, or viewer) and the user's Redis Cloud **Account number** found in the [account settings]() |

    For `redisAccountMapping`, you can add the same user to multiple SAML-enabled accounts using one of these options:

    - A single string that contains a comma-separated list of account/role pairs

        [code example]

    - Multiple strings, where each represents a single account/role pair

        [code example]

To confirm the identity provider's SAML assertions contain the required attributes, you can use a SAML-tracer web developer tool to inspect them.

1. Set up any additional configuration required by your identity provider to ensure you can configure the `redisAccountMapping` attribute for SAML users.

    If your identity provider lets you configure custom attributes with workflows or group rules, you can set up automation to configure the `redisAccountMapping` field automatically instead of manually.

Configure SAML in Redis Cloud {#configure-idp}

After you set up the SAML integration app and create a SAML user in your identity provider, you need to configure your Redis Cloud account to set up SAML SSO.

1. Sign in to [Redis Cloud](https://cloud.redis.io/#/login) with the email address associated with the SAML user you set up with your identity provider.

1. Select **Access Management** from the [Redis Cloud console](https://cloud.redis.io) menu.

1. Select **Single Sign-On**.

1. [Verify at least one domain](#verify-domain) if you haven't.

1. Configure the **Identity Provider metadata** settings.

    To do so, you need the following metadata values from your identity provider:

    | Setting | Description |
    |---------|-------------|
    | **Issuer (IdP entity ID)** | The unique entity ID for the identity provider |
    | **IdP server URL** | The identity provider's HTTPS URL for SAML SSO |
    | **Single logout URL** | The URL used to sign out of the identity provider and connected apps (optional) |
    | **Assertion signing certificate** | Public SHA-256 certificate used to validate SAML assertions from the identity provider |

    To find these metadata values, see your identity provider's documentation.

1. Select **Enable**.

1. From the **SAML activation** dialog box, select **Continue**.

Download service provider metadata {#download-sp}

Next, you need to download the service provider metadata for Redis Cloud and use it to finish configuring the SAML integration app for your identity provider:

1. Select the **Download** button to download the service provider [metadata](https://docs.oasis-open.org/security/saml/v2.0/saml-metadata-2.0-os.pdf) in XML format.

1. Sign in to your identity provider's admin console.

1. Configure the Redis Cloud service provider app with the downloaded XML.

    - Some identity providers let you upload the XML file directly.

    - Others require you to manually configure the service provider app with specific metadata fields, such as:

        | XML attribute | Value | Description |
        |---------------|-------|-------------|
        | EntityDescriptor's **entityID** | https://<nobr>auth.redis.com</nobr>/saml2/<nobr>service-provider</nobr>/\<ID\> | Unique URL that identifies the Redis Cloud service provider |
        | AssertionConsumerService's **Location** | <nobr> https://<nobr>auth.redis.com</nobr>/sso/saml2/\<ID\> | The service provider endpoint where the identity provider sends a SAML assertion that authenticates a user  |

    - To use [IdP-initiated SSO](#idp-initiated-sso) with certain identity providers, you also need to set the RelayState parameter to the following URL:

        [code example]

       > Replace `<ID>` so it matches the `AssertionConsumerService Location` URL's ID.

    To learn more about how to configure service provider apps, see your identity provider's documentation.

Activate SAML SSO {#activate-saml-sso}

After you finish the required SAML SSO configuration between your identity provider and Redis Cloud account, you can test and activate SAML SSO.

All users associated with the account, excluding the local user you used to set up SAML SSO, are converted to SAML users on successful activation. They can no longer sign in with their previous sign-in method and must use SAML SSO instead. However, you can add local bypass users after SAML SSO activation to allow access to the account in case of identity provider downtime or other issues with SAML SSO.

To activate SAML SSO:

1. Sign out of any active SSO sessions with your identity provider.

1. For **Activate SAML integration**, select the **Activate** button.

1. From the **Logout notification** dialog, select **Continue**. This redirects you to your configured identity provider's sign-in screen.

1. Sign in with your identity provider.

1. When redirected to the Redis Cloud sign-in screen, you can either:

    - Sign in with your local credentials as usual.

    - Select **SSO** and enter the email address associated with the SAML user configured in your identity provider. Your user converts to a SAML user in Redis Cloud. Don't use this method if you want your user account to remain a local bypass user.

If you see a **SAML activation failed** notification when redirected to the Redis Cloud sign-in screen, sign in with your local user credentials and review the SAML configuration for issues.

After you activate SAML SSO, [add a few local bypass users]() from the **Team** tab. Local bypass users should [set up MFA]() for additional security.

Update configuration {#update-config}

If you change certain metadata or configuration settings after you set up SAML SSO, such as the assertion signing certificate, remember to do the following:

1. [Update the SAML SSO configuration](#configure-idp) with the new values.

1. [Download the updated service provider metadata](#download-sp) and use it to update the Redis Cloud service provider app.

Link other accounts

After you set up SAML SSO for one account, you can link other accounts you own to the existing SAML configuration. This lets you use the same SAML configuration for SSO across multiple accounts.

You must have the `Owner` role assigned to your user account for all accounts you want to link. The same user must link each account to the original configuration.

To link other accounts to an existing SAML SSO configuration:

1. Sign in to the [Redis Cloud console](https://cloud.redis.io/) with the account that has an existing SAML configuration.

1. Go to **Access Management > Single Sign-On**.

1. Select **Get token**.

    Select **Copy** to copy the linking token.

1. Sign in to the account that you want to link to the SAML configuration. Go to **Access Management > Single Sign-On** and then enter the copied token into the **Join an existing SAML configuration** text box. Select the arrow to confirm.

    After you do this, the owner of the original account will receive a request to link the new account to the SAML configuration.

1. Sign in with the original account and select **Access Management > Single Sign-On**. You should see the new account in the **Unlinked accounts** list.

1. Select **Link account**.

1. In the **Convert existing users** dialog, select **Confirm conversion** to finish linking the accounts.

Deactivate SAML SSO

Before you can deactivate SAML SSO for an account, you must sign in to the account as a local (non-SAML) user with the owner role assigned.

Deactivating SAML SSO for an account also removes any existing SAML-type users associated with the account.

To deactivate SAML SSO for a specific account:

1. In the [Redis Cloud console](https://cloud.redis.io), select your name to display your available accounts.

1. If the relevant account is not already selected, select it from the **Switch account** list.

1. Go to **Access Management > Single Sign-On**.

1. Select **Deactivate SAML**. This only deactivates SAML SSO for the current account. Other linked accounts continue to use this SAML SSO configuration.

1. Select **Deactivate** to confirm deactivation.

Deprovision SAML users

When a user is removed from your identity provider, their access to Redis Cloud should also be removed.

When you have revoked a user’s access to Redis Cloud, they cannot access the Redis Cloud console, but their API keys remain active. You can [delete an API key]() to remove access.

To deprovision SAML users upon deletion, the identity provider admin can set up a webhook to automatically make the appropriate Cloud API requests. For more information about managing users with API requests, see [Users]() in the Redis Cloud API documentation.

<saml2:Attribute Name="redisAccountMapping" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified">
            <saml2:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
                12345=owner,54321=manager
            </saml2:AttributeValue>
        </saml2:Attribute>

<saml2:Attribute Name="redisAccountMapping" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified">
            <saml2:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
                12345=owner
            </saml2:AttributeValue>
            <saml2:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
                54321=manager
            </saml2:AttributeValue>
        </saml2:Attribute>


Auth0 SAML integration guide

Overview

This guide shows how to configure [Auth0](https://auth0.com/docs) as a SAML single sign-on identity provider (IdP) for your Redis Cloud account.

To learn more about Redis Cloud support for SAML, see [SAML single sign-on]().

Before completing this guide, you must [verify ownership of any domains]() you want to associate with your SAML setup.

Step 1: Set up your identity provider (IdP)

Specify the SAML owner

1. Sign in to your Auth0 account and navigate to **User Management > Users**.
   * Select the SAML owner.
   * Verify the details.

    SAML assertion requires first and last name, which are not available in the default user profile.

Depending how they are created, users can have different profiles.

1. Add `user_metadata` to fulfill the SAML assertion, then select **Save**.

   The key-value pair of `redisAccountMapping` consists of a lowercase role name (owner, member, manager, billing_admin, or viewer) and your Redis Cloud Account ID found in the [account settings]().

    [code example]

1. Open **Actions > Triggers** and select **`post-login`**.

1. Select **Create Action** to create a new custom action.

1. Provide a **name** for the action and select **Create**.

1. Add the following code to the action:

    [code example]

1. Select **Deploy** to save and deploy the action.

1. Return to the **`post-login`** trigger and drag the action you just created to the trigger.

    Select **Apply** to save your changes.

Create and configure the SAML application

1. Open **Applications > Applications** and select **Create Application**.

1. Provide a **name** for the Application and select **Single Page Web Applications**. Select **Create**.

1. From the newly created application, go to **Settings > Advanced Settings > Certificates**.

    * Copy and save the **Signing Certificate**. You will need this information to configure SAML in admin console.

    * We suggest that you update the default logo of the application to the Redis icon for better visibility.

1. From the newly created application, go to **Addons** and enable **SAML 2 WEB APP**.

1. From the **Usage** tab:

    * Copy and save the **Issuer** value.
    * Copy and save the **Identity Provider Login URL**.

    You will need both of these values, along with the certificate value you copied in the previous step, to configure SAML in the Redis Cloud console.

Step 2: Configure SAML support in Redis Cloud

Now that you have you Auth0 IdP server ready, configure support for SAML in Redis Cloud.

Sign in to Redis Cloud

Sign in to your account on the [Redis Cloud console](https://cloud.redis.io/#/login).

Activate SAML in Access Management

To activate SAML, you need to have a local user (or social sign-on user) with the **owner** role. If you have the correct permissions, you will see the **Single Sign-On** tab.

1. Fill in the information you saved previously in the **setup** form. This includes:

    * **Issuer (IdP Entity ID)**: Issuer value from Auth0
    * **IdP server URL**: Identity Provider Login URL from Auth0
    * **Assertion signing certificate**: Certificate value from Auth0

    Once you click **Enable**, wait a few seconds for the status to change.

1. Download the service provider (SP) metadata. Save the file to your local hard disk.

1. Open the file in any text editor. Save the following text from the metadata:

    * **EntityID**: The unique name of the service provider (SP)

    * **Location** : The location of the assertion consumer service

Step 3: Finish SAML configuration in Auth0

1. Return to the Auth0 SAML application and select **Addons > SAML 2 Web App > Settings**:

    * Paste the **Location** link in **Application Callback URL** field.

    * Enter the following code in the **Settings** code area. Modify the `audience` variable with the `EntityID` value, and the `recipient` variable with the `Location` value from the metadata file you downloaded.

    [code example]
    Scroll down and select **Enable** to apply the configuration.

IdP initiated SSO

To use IdP-initiated SSO with certain identity providers, you also need to set the `RelayState` parameter to this URL:

`https://cloud.redis.io/#/login/?idpId=<ID>`

Replace `ID` so it matches the `AssertionConsumerService` Location URL ID (the content after the last forward slash "/"). To learn more about how to configure service provider apps, see your identity provider’s documentation.

Step 4: Return to the Redis Cloud console

1. Return to the Redis Cloud console and select **Activate**.

   A popup appears, explaining that, in order to test the SAML connection, we need to login with credentials of a user defined in Auth0. Select **Continue** to go to the Auth0 login screen.

1. The Auth0 login screen appears. Enter the credentials and select **Sign In**.

If everything is configured correctly, you will see the the Redis Cloud console screen. Your local account is now considered a SAML account.

To log in to the Redis Cloud console from now on, click on **Sign in with SSO**.

exports.onExecutePostLogin = async (event, api) => {
        const um = event.user.user_metadata || {};
        const am = event.user.app_metadata || {};
        api.samlResponse.setAttribute('email', event.user.email);
        api.samlResponse.setAttribute(
            'firstName',
            um.FirstName || ''
        );
        api.samlResponse.setAttribute(
            'lastName',
            um.LastName || ''
        );
        const mapping = am.redisAccountMapping || um.redisAccountMapping;
        if (mapping) {
            api.samlResponse.setAttribute('redisAccountMapping', mapping);
        } else {
            api.access.deny('missing_redis_account_mapping', 'redisAccountMapping not set for user');
        }
    };


Overview

This guide shows how to configure [AWS IAM Identity Center](https://aws.amazon.com/iam/identity-center/) as a SAML single sign-on identity provider (IdP) for your Redis Cloud account.

To learn more about Redis Cloud support for SAML, see [SAML single sign-on]().

Before completing this guide, you must [verify ownership of any domains]() you want to associate with your SAML setup.

Step 1: Setup your identity provider (IdP)

Create the AWS IAM Identity Center SAML application

1. Sign in to your AWS account.

1. From the main menu, search for **IAM Identity Center (successor to AWS Single Sign-On)**.

1. Once in IAM Identity Center, select **Applications**.

1. Next, select **Add application**.

1. In the next screen, select **Add custom SAML 2.0 application** then **Next**.

1. The **Configure Application** screen is where you initially get the information needed to configure SAML in Redis Cloud. To begin, change the **Display name** and **Description** to **Redis Cloud**.

1. Next, scroll to the **IAM Identity Center metadata** section. Here, you will find all of the information needed to configure SAML in Redis Cloud:

* IAM Identity Center sign-in URL
* IAM Identity Center SAML issuer URL
* IAM Identity Center Certificate

Note down or copy the URLs and select **Download** to download the certification information.

Both the IAM Identity Center sign-in URL and the IAM Identity Center SAML issuer URL are the same value. This is expected.

Now that you have your IAM Identity Center IdP server information, configure support for SAML in Redis Cloud.

Sign in to Redis Cloud

Activate SAML in Access Management

To activate SAML, you must have a local user (or social sign-on user) with the `owner` role. If you have the correct permissions, you will see the **Single Sign-On** tab.

1. Add the information you saved previously in the **Configuration setup** screen. This includes:

   * **Issuer (IdP Entity ID)**: IAM Identity Center SAML issuer URL.
   * **IdP server URL**: IAM Identity Center sign-in URL.
   * **Assertion signing certificate**: Drag and drop the certificate file you downloaded to disk in the form text area.

   Select **Enable** and wait a few seconds for the status to change.

1. Select **Download** to get the service provider (SP) metadata. Save the file to your local hard disk.

1. Open the file in any text editor. Save the following text from the metadata:

   * **EntityID** - The unique name of the service provider (SP).

   * **Location** : The location of the assertion consumer service.

Step 3: Finish SAML configuration in AWS IAM Identity Center's Redis Cloud Application

1. Return to the **Configuration setup** screen in IAM identity Center. Scroll down to the bottom of the page and select **Upload application SAML metadata file**. Select **upload** and choose the file that you downloaded in the SAML configuration screen in Redis Cloud.

1. If you would like to also configure an IdP initiated workflow, fill in the **relay state** field in the **Application properties** section. Use this URL: `https://cloud.redis.io/#/login/?idpId=XXXXXX`. Take the ID from the location URL in step 3 (the content after the last forward slash "/") and append to the URL.

1. Select **Submit** to finish creating the application.

1. Configure the **Redis Cloud** application's attribute mappings. Select **Actions > Edit Attribute Mappings**.

   In the next screen, add these attributes:

   * **Subject**: `${user:email}`, `unspecified`
   * **Email**: `${user:email}`, `unspecified`
   * **FirstName**: `${user:givenName}`, `unspecified`
   * **LastName**: `${user:familyName}`, `unspecified`
   * **redisAccountMapping**: `XXXXXXX=owner`, `unspecified`

The `redisAccountMapping` key-value pair consists of the lowercase role name (owner, member, manager, billing_admin, or viewer) and your Redis Cloud Account ID found in the [account settings]().

Step 4: Ensure that the Cloud account user has an IAM Identity Center user account

To complete SAML setup, ensure that the user who began SAML configuration in Redis Cloud console has a user defined in the AWS IAM identity center. This user account is required to complete the SAML setup.

Also, make sure that the user has been assigned to the **Redis Cloud** Application.

Step 5: Activate SAML integration

The final step in our SAML integration with AWS IAM identity Center is to activate the SAML integration.

1. In the Single Sign-On screen, select **Activate**.

  A logout notification screen displays, letting you know that you will be redirected to your identity provider. Select **Continue** to go to the AWS IAM Identity Center's login screen.

1. Enter your AWS IAM Identity Center credentials.

If everything is configured correctly, you will see the the Redis Cloud console screen. Your local account is now considered a SAML account.

To log in to the Redis Cloud console from now on, click on **Sign in with SSO**.


Overview

This guide shows how to configure [Microsoft Entra](https://learn.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory-architecture) (formerly Azure Active Directory) as a SAML single sign-on identity provider (IdP) for your Redis Cloud account.

To learn more about Redis Cloud support for SAML, see [SAML single sign on]().

Before completing this guide, you must [verify ownership of any domains]() you want to associate with your SAML setup.

To create the Microsoft Entra SAML Toolkit integration application:

1. Sign in to your Microsoft Azure account.

1. From the main menu, select **Microsoft Entra ID > Enterprise Applications**. Select **New application** to add a new application.

1. Select **Microsoft Entra SAML Toolkit** from the list of apps.

1. Name the application **Redis Cloud** and then select **Create**.

1. Select **Properties** and upload the Redis logo.

    Select **Save**.

1. Once you've created the application, go to the **Application Overview** and select **Set up single sign on**.

1. Select **SAML** as the single sign-on method.

1. Go to **Step 1** in the configuration screen and select **Edit**.

    Enter some mock data in the required fields.

    Select **Save** to save your changes.

1. Go to **Step 3** in the configuration screen.

   * Certificate (Base 64) is required to complete SAML configuration in the Redis Cloud console. Select **Download** to download it.

1. Go to **Step 4** in the configuration screen, and note down or copy the following information:

   * **Login URL** is used as the "IdP server URL" in the SAML configuration in admin console.
   * **Microsoft Entra Identifier** is used as the "Issuer (IdP Entity ID)" in the SAML configuration in admin console.

Now that you have your Entra IdP server ready, configure support for SAML in Redis Cloud.

Sign in to Redis Cloud

Activate SAML in access management

To activate SAML, you must have a local user (or social sign-on user) with the **owner** role. If you have the correct permissions, you will see the **Single Sign-On** tab.

1. Fill in the information you saved previously in the **setup** form. This includes :

   * **Issuer (IdP Entity ID)**: Microsoft Entra Identifier
   * **IdP server URL**: Login URL
   * **Assertion signing certificate**: Drag-and-drop the certificate file you downloaded to disk in the form text area

   Once you click the **Enable** button, wait a few seconds for the status to change.

1. You will then be able to **download** the service provider (SP) metadata. Save the file to your local hard disk.

1. Open the file in any text editor. Save the following text from the metadata:

   * **EntityID**: The unique name of the service provider (SP)

   * **Location**: The location of the assertion consumer service

Step 3: Finish SAML configuration in Microsoft Entra ID

1. Go back to Microsoft Entra ID setup and **Edit** the Basic SAML Configuration in **Step 1**.

   This is where you entered mock data. Let's now enter the correct data for this step.

   For the `EntityID` and `Location` fields below you can directly upload the metadata file using the option at the top of the page. However, you will still need to manually    add the **Sign on URL**.

    * Paste `EntityID` information in the `Identifier (Entity ID)` field.

    * Paste `Location` link in `Reply URL (Assertion Consumer Service URL)` field.

    * For the `Sign on URL` field, add URL `https://cloud.redis.io/#/login/?idpId=` where you need to add the ID from the Reply URL ID, for example,    `https://cloud.redis.io/#/login/?idpId=0oa5pwatz2JfpfCb91d7`.

    Select **Save**.

1. Go to step 2, **Attributes & Claims** and select **Edit**.

1. Configure these attributes and claims:

    * Modify Unique User Identifier (Name ID) to **user.mail**

    * Modify additional claims to match SAML assertion as follows:

        * **Email**: user.mail
        * **FirstName**: user.givenname
        * **LastName**: user.surname
        * **redisAccountMapping**: "<sm_account_id>=owner"
            * The `redisAccountMapping` contains Redis Cloud account IDs and user roles pairs. The key-value pair consists of the lowercase role name (owner, member, manager, billing_admin, or viewer) and your **Redis Cloud Account ID** found in the [account settings]().

Make sure the **Namespace** field is empty when modifying these claims.

1. To add a user to the application, select **User and Groups > Add user/group**.

1. Add the user and select **Assign**.

Step 4: Return to Redis Cloud console

1. Return to Redis Cloud console and select **Activate**.

1. A popup appears, explaining that you must log in with the credentials of a Microsoft Entra user to test the SAML connection. Select **Continue** to go to the Microsoft login screen.

1. The Microsoft login screen will appear. Enter the credentials and click **Sign In**.

If everything is configured correctly, you will see the the Redis Cloud console screen. Your local account is now considered a SAML account.

To log in to the Redis Cloud console from now on, click on **Sign in with SSO**.

Claim conditions and user groups

If your users are going to be part of different Groups, you can create a Claim Condition for the `redisAccountMapping` attribute.

IdP initiated SSO

If you correctly set the up the **Sign on URL**, the SAML application appears by default on the user's **My Apps** panel.

While assigning the user to the app, a notification will appear:

Therefore, if you sign into `https://myapplications.microsoft.com/`, the application will be available.

If the app is not available, make sure that the App is registered. It should be done automatically.

You can also access the app directly by using the **User access Url** from App Properties.


Google Workspace SAML integration guide

Overview

This guide shows how to configure [Google Workspace](https://workspace.google.com/) as a SAML single sign-on identity provider (IdP) for your Redis Cloud account.

To learn more about Redis Cloud support for SAML, see [SAML single sign-on]().

Before completing this guide, you must [verify ownership of any domains]() you want to associate with your SAML setup.

Create the Google Workspace SAML application

1. Sign in to your [Google Workspace admin account](https://admin.google.com/).

1. From the main menu, select **Apps** then **Web and mobile apps**.

1. Once in Web and mobile apps, select **Add custom SAML app** from the dropdown list.

1. To begin, change the **App name** and **Description** to **Redis Cloud**. You can also choose an **App icon** for the application. We suggest you upload a Redis icon. Once complete, select **Continue**.

1. In the next screen, you will find all of the information needed to configure SAML in Redis Cloud. Select the **copy** button for the following information sections:

   * SSO URL
   * Entity ID
   * Certificate

Once complete, select **Continue**.

Now that you have your Google Workspace IdP server information, configure support for SAML in Redis Cloud.

Sign in to Redis Cloud

Sign in to your account on the [Redis Cloud console](https://cloud.redis.io/#/login).

Activate SAML in Access Management

To activate SAML, you must have a local user (or social sign-on user) with the `owner` role. If you have the correct permissions, you will see the **Single Sign-On** tab.

1. Add the information you saved previously in the **Google identity provider details** screen. This includes:

    * **Issuer (IdP Entity ID)**: `Entity ID`.
    * **IdP server URL**: `SSO URL`.
    * **Assertion signing certificate**: `Certificate`.

   Select **Enable** and wait a few seconds for the status to change.

1. Select **Download** to get the service provider (SP) metadata. Save the file to your local hard disk.

1. Open the file in any text editor. Save the following text from the metadata:

    * **EntityID**: The unique name of the service provider (SP).

   * **Location**: The location of the assertion consumer service.

Step 3: Add a custom attribute to Google Workspace's user profile

1. From the main menu in Google Workspace, select **Directory** then **Users**, and from the **more options** dropdown select **Manage custom attributes**.

1. From the **Manage user attributes** screen, select **Add Custom Attribute**.

1. Add the following information for the new custom attribute:

   * **Category**: `Redis Cloud`
   * **Name**: `redisAccountMapping`
   * **Info type**: `Text`
   * **Visibility**: `Visible to user and admin`
   * **No. of values**: `Single`

   Once complete, select **Add**. The summary page now displays the new **redisAccountMapping** custom field.

1. From the main menu in Google Workspace, select **Directory** then **Users**, then select the user you wish to configure.

1. Each user who needs to access Redis Cloud through SAML needs to define the **redisAccountMapping** attribute. The `redisAccountMapping` key-value pair consists of the lowercase role name (owner, member, manager, billing_admin, or viewer) and your Redis Cloud Account ID found in the [account settings]().

   Once complete, select **Save**.

   Repeat this step for each user who needs to define the `redisAccountMapping` attribute.

Step 4: Finish SAML configuration in Google Workspace's Redis Cloud Application

1. Return to the **Service provider details** screen in Google Workspace, and add the following information:

   * **ACS URL**: The Location from the downloaded service provider (SP) metadata
   * **Entity Id**: The EntityID from the downloaded service provider (SP) metadata

   Leave the **Name ID** default information as it is. Once complete, select **Continue**.

1. Configure the **Redis Cloud** application's attribute mappings. Select **Add Mapping**.

   In the next screen, map these attributes:

   * **Primary Email**: `Email`
   * **First name**: `FirstName`
   * **Last name**: `LastName`
   * **redisAccountMapping**: `redisAccountMapping`

   Once complete, select **Finish**.

1. Next, we need to turn on the Redis Cloud service for all users, select **Web and mobile apps** -> **Redis Cloud** and then **service status**. Select **ON for everyone**. Once complete, select **Save**.

Step 5: Activate SAML integration

The final step in our SAML integration with AWS IAM identity Center is to activate the SAML integration.

1. In the Single Sign-On screen, select **Activate**.

A logout notification screen displays, letting you know that you are redirected to Google's login screen.

1. Select the Google account you wish to login with.

If everything is configured correctly, you will see the the Redis Cloud console screen. Your local account is now considered a SAML account.

To log in to the Redis Cloud console from now on, click on **Sign in with SSO**.


Okta SAML integration guide (Generic)

Overview

This guide shows how to configure [Okta](https://help.okta.com/en-us/Content/Topics/Security/Identity_Providers.htm) as a SAML single sign-on identity provider (IdP) for your Redis Cloud account.

Learn how to use the generic application template. You can also refer to the [Org2Org]() application template.

To learn more about Redis Cloud support for SAML, see [SAML single sign-on]().

Before completing this guide, you must [verify ownership of any domains]() you want to associate with your SAML setup.

Step 1: Set up your demo identity provider (IdP)

To create the Okta SAML integration application:

1. Log in to the Okta admin console. Select **Applications > Create App Integration**.

1. Select **SAML 2.0**, then select **Next**.

1. Complete these fields for the SAML application **General Settings** section:

    * **App name**: Redis Cloud

    * **App logo**: Upload a Redis icon.

    Select **Next**.

1. In the **Configure SAML** tab, enter this data in the **General** section:

    * **Single sign-on URL**: `http://www.fake.com`. This is a temporary mock URL that you will modify later.
    * **Audience URI (SP Entity ID)**: `http://www.fake.com`. This is a temporary mock URL that you will modify later.
    * **Default RelayState**: `https://cloud.redis.io/#/login/?idpId=XXXXXX`. You will need to complete this URL with the `idpId` later. _Complete this field only if you need your SAML flow to be IdP initiated._
    * **Name ID forma**: `Unspecified`
    * **Application username**: `Okta username`
    * **Update application username on**: `Create and update`

    Next, add __attribute statements__, which are required for the configuration:

    * **Attribute 1**:
      * **Name**: `redisAccountMapping`
      * **Name Format**: `Basic`
      * **Value**: `appuser.redisAccountMapping`

    * **Attribute 2**:
      * **Name**: `FirstName`
      * **Name Format**: `Basic`
      * **Value**: `user.firstName`

    * **Attribute 3**:
      * **Name**: `LastName`
      * **Name Format**: `Basic`
      * **Value**: `user.lastName`

    * **Attribute 4**:
      * **Name**: `Email`
      * **Name Format**: `Basic`
      * **Value**: `user.login`

    Select **Next**.

1. The last step is an optional feedback step for Okta. Select **I'm an Okta customer adding an internal app** and then select **Finish**.

1. Next, scroll down the page of your newly created app integration and select **View Setup Instructions**. A new browser window opens, providing the information you need to configure the IdP in Redis Cloud.

   Scroll down to **Applications > Applications**, and note down the following information:

    * **Identity Provider Single Sign-On URL**
    * **Identity Provider Issuer**
    * **X.509 Certificate**

   Once you save the information, close the window.

To modify the application user profile:

1. Go to **Directory > Profile Editor** in the left menu, and select **Redis Cloud User**.

1. Add the custom attribute to your user profile to specify which Redis Cloud role the user has and on which account. Select **Add Attribute**.

1. Add this information for the new custom attribute.

    * **Data type**: `string array`
    * **Display name**: `redisAccountMapping`
    * **Variable name**: `redisAccountMapping`
    * **Description**: `redisAccountMapping`
    * **Attribute required**: `Yes`
    * **Group priority**: `Combine values across groups`

1. Once you add the attribute, it appears in the list of attributes for the profile.

Step 2: Create a group and assign the application

Now that your SAML IdP is configured, create an Okta group and assign users to the Redis Cloud application.

Create the group

1. In the left menu, select **Directory > Groups**, then select **Add group**.

1. Complete **Name** and  **Description**, then click **Save**.

Assign users to the group

1. Select the group, then select **Assign people**.

1. For each user you want to add to the group, highlight the user in the table and select **+**. You can also select **Add all** to add all users. Once you add all the users to your group, select **Save**.

Assign the application to the group

Now that your group is populated with its users, you can assign the SAML integration application to your group. From **Applications > Applications > Redis Cloud**:

1. Select **Assign to groups** menu item.

1. In the **Redis Cloud User Group**, select **Assign**.

1. Define the Redis account mapping string default for this group and select **Save and Go Back**. The key-value pair consists of the lowercase role name (owner, member, manager, billing_admin, or viewer) and your **Redis Cloud Account ID** found in the [account settings](). Select **"Done"**.

    The mapping field has now been defined as a default for each member of the group.

Edit the mapping field for the group

To modify the Redis mapping field, select the pencil icon of the Redis Cloud group in the **Redis Cloud** application screen.

You can modify the mapping field for the whole group on the edit screen that appears.

Edit the mapping field for a specific user

To override the Redis mapping field at an individual user level, select the **People** menu, and then the pencil icon of the person whose field you want to modify.

Set the user's **Assignment master** to **Administrator**, enabling the group's policy override. Select **Save**.

The user's **Type** is set to `Individual`.

On the screen that appears, select the pencil icon of the user to modify the Redis mapping field.

Then, edit the user assignment.

Step 3: Configure SAML support in Redis Cloud

Now that you have a test IdP server ready as well as your user group, configure support for SAML in Redis Cloud.

Sign in to Redis Cloud

Activate SAML in Access Management

To activate SAML, you must have a local user (or social sign-on user) with the **owner** role. If you have the correct permissions, you will see the **Single Sign-On** tab.

1. Fill in the information you saved in step 6 in the **setup** form, including:

    * **IdP Server URL**: Identity Provider Single Sign-On URL
    * **Issuer**: Identity Provider Issuer
    * **Assertion signing certificate**: X.509 Certificate

1. Select **Enable** and wait a few seconds for the status to change. You are then able to download the service provider (SP) metadata. Save the file to your local hard disk.

1. Open the file in any text editor. Save the following text from the metadata:

    * **EntityID**: The unique name of the service provider (SP)

    * **Location**: The location of the assertion consumer service

1. Return to Okta, select **Applications > Redis Cloud > General** and select **Edit**.

1. Then, navigate to **Configure SAML** (step 2) and update the following information in **SAML Settings General**:

   * **Single sign-on URL**: Use the information that you copied for **Location**.
   * **Audience URI (SP Entity ID)**: Use the information that you copied for **EntityID**.
   * **Default RelayState**: Only needed if you want to have an IdP initiated flow. Take the ID from the location URL in step 3 (the content after the last forward slash "/") and append to the url (for example, `https://cloud.redis.io/#/login/?idpId=YOUR_LOCATION_ID`).

   Select **Next**, then select **Finish**.

Return to Redis Cloud console

1. Return to Redis Cloud console and select **Activate**.

    A popup appears, stating that to test the SAML connection, you need to log in with Okta credentials of the user defined in the Redis Cloud group. This user is part of the group to which you assigned the Redis Cloud application. Select **Continue** to go to the Okta login screen.

1. The Okta login screen appears. Enter the credentials and select **Sign In**.

If everything is configured correctly, you will see the the Redis Cloud console screen. Your local account is now considered a SAML account.

To log in to the Redis Cloud console from now on, click on **Sign in with SSO**.


Okta SAML integration guide (Org2Org)

Overview

This guide shows how to configure [Okta](https://help.okta.com/en-us/Content/Topics/Security/Identity_Providers.htm) as a SAML single sign-on identity provider (IdP) for your Redis Cloud account.

This guide shows how to use the Org2Org application template. You can also use the [Generic]() application template.

To learn more about Redis Cloud support for SAML, see [SAML single sign-on]().

Before completing this guide, you must [verify ownership of any domains]() you want to associate with your SAML setup.

Step 1: Set up your identity provider

Create the Okta SAML integration application

Create an Okta "Org2Org" SAML integration appliction.

1. Sign in to the Okta admin console.

1. From the left menu, select **Applications**.

1. Select **Browse App Catalog**.

1. Locate and select **Okta Org2Org**.

1. Once you have found the application, click "Add".

1. Enter this field for the **Org2Org** application **General Settings** section and select **Next**:

   * **Application label**: `Redis Cloud`

1. Enter the following fields in the **Sign-On Options > Attributes** section:

    * **Name**: `redisAccountMapping`
    * **Name Format**: `Basic`
    * **Value**: `appuser.redisAccountMapping`

To ensure the role mapping will not take effect, don't skip entering `appuser.redisAccountMapping` in the **Value** field.

1. Next, select **View Setup Instructions**. A new browser window opens, providing the information needed to configure the IdP in Redis Cloud.

1. Scroll down to section 6 in the page, and note the following information:

   * **IdP Issuer URI**
   * **IdP Single Sign-On Url**
   * **IdP Signature Certificate**: Click the link and download the certificate to your hard drive

    Once you capture the information, close the window, return to the Okta admin console, and select **Done**.

Modify the application user profile

1. In the left menu, select **Directory > Profile Editor**, then select **Redis Cloud User**.

1. Select **Add Attribute** to add a custom attribute to the user profile and specify the Redis Cloud role.

1. Add this information for the new custom attribute:

   * **Data type**: `string array`
   * **Display name**: `redisAccountMapping`
   * **Variable nam**: `redisAccountMapping`
   * **Description**: `redisAccountMapping`
   * **Attribute required**: `Yes`
   * **Group priority**: `Combine values across groups`

1. Once you add the attribute, it appears in the list of profile attributes.

1. Add a Redis Cloud icon to the application because it's easier for users to identify the application. Select the pencil icon on the application logo and upload a Redis image using these steps:

Step 2: Create a group and assign the application {#createtestuser}

Now that our SAML IdP is configured, create an Okta group and assign the Redis Cloud application.

Create the group

1. In the left menu, select **Directory > Groups**, then select **Add group**.

1. Enter **Name** and **Description**.

Assign users to the group

1. Select the group, then select **Assign people**.

1. For each user you want to add to the group, highlight the user in the table and select **+**. You can also add all users by selecting **Add all**. After you add all the users to your group, select **Save**.

Assign application to the group

Now that your group is populated with its users, assign the SAML integration application to your group.

1. From the menu, select **Applications > Applications > Redis Cloud**. Then, select **Assign to groups**.

1. In the **Redis Cloud User Group**, select **Assign**.

1. Now, define the Redis account mapping string default for this group and select **Save and go back**. The key-value pair consists of the lowercase role name (owner, member, manager, billing_admin, or viewer) and your **Redis Cloud Account ID** found in the [account settings](). Select **"Done"**.

    The mapping field is now defined as a default for each member of the group.

Editing the mapping field for the group

To modify the Redis mapping field, select the pencil icon of the Redis Cloud group in the "Redis Cloud" application screen.

You can modify the mapping field for the whole group on the edit screen that appears.

Editing the mapping field for a specific user

To override the Redis mapping field at an individual user level, select the **People** menu, then select the pencil icon of the person whos field you want to modify.

Set the user's **Assignment master** to `Administrator` to enable group policy overrides. Select **Save**.

The user's **Type** is set to `Individual`.

On the screen that appears, select the pencil icon of the user to modify the Redis mapping field.

Now that you have a test IdP server and your user group ready, configure support for SAML in Redis Cloud.

Sign in to Redis Cloud

Sign in to your account on the [Redis Cloud console](https://cloud.redis.io/#/login).

Activate SAML in access management

To activate SAML, you must have a local user (or social sign-on user) with the **owner** role. If you have the correct permissions, the **Single Sign-On** tab is enabled.

1. Add the information you saved previously in the **setup** form (step 1), including:

   * **Issuer (IdP Entity ID)**: IdP Issuer URI
   * **IdP server URL**: IdP Single Sign-On Url
   * **Assertion signing certificate**: Drag and drop the file you downloaded to disk in the form text area.

1. Select **Enable** and wait a few seconds for the status to change. Then, download the service provider (SP) metadata. Save the file to your local hard disk.

1. Open the file in any text editor. Save the following text from the metadata:

   * **EntityID**: Unique name of the service provider (SP)

   * **Location**: Location of the assertion consumer service

1. Return to Okta, select **Applications > Redis Cloud > General**, then select **Edit**.

1. Update this information in **Advanced Sign-on Settings**.

   * **Hub ACS URL**: Use the information that you copied for **Location**.
   * **Audience URI**: Use the information that you copied for **EntityID**.

Select **Save**.

IdP-initiated SSO

To use IdP-initiated SSO with identity providers, set the RelayState parameter to URL `https://cloud.redis.io/#/login/?idpId=<ID>`.

Replace `<ID>` so it matches the AssertionConsumerService Location URL ID (the content after the last forward slash "/"). To learn more about configuring service provider applications, see your identity provider's documentation.

Return to Redis Cloud console

1. Return to Redis Cloud console and select **Activate**.

   A popup appears, explaining that, to test the SAML connection, you need to log in with Okta credentials of the user defined in the Redis Cloud group. This user is part of the group to which you assigned the Redis Cloud application. Select **Continue** to go to the Okta login screen.

1. The Okta login screen appears. Enter the credentials and select **Sign In**.

If everything is configured correctly, you will see the the Redis Cloud console screen. Your local account is now considered a SAML account.

To log in to the Redis Cloud console from now on, click on **Sign in with SSO**.


PingIdentity SAML integration guide

Overview

This guide shows how to configure [PingIdentity](https://docs.pingidentity.com/) as a SAML single sign-on identity provider (IdP) for your Redis Cloud account.

To learn more about Redis Cloud support for SAML, see [SAML single sign-on]().

Before completing this guide, you must [verify ownership of any domains]() you want to associate with your SAML setup.

Step 1: Set up your identity provider (IdP)

Add the `redisAccountMapping` attribute

1. Log in into your Ping Identity account. Open **Administrators > Identities > User Attributes** and select **Add Attribute**.

2. Select the **DECLARED** attribute type.

3. Fill in the fields with the following values:

    * **Name**: `redisAccountMapping`
    * **Display name**: `redisAccountMapping`
    * **Description**: `redisAccountMapping`

    Select **Save and Close**. Then, verify that the attribute was created successfully.

Add the user who will activate SAML in Service Manager (Redis Cloud)

1. Go to **Administrators > Identities > Users** and select **Add User**.

1. Fill in the following information:

    * **redisAccountMapping**: `{accountID}={role}`

    **accountID** is the account ID from [account settings]() and **role** represents the role that the user will be assigned in Redis Cloud console (owner, member, manager, billing_admin, or viewer):

    Save and check that the user was added successfully.

Create the Ping Identity SAML application

1. Go to **Administrators > Connections > Applications** and select **+** to add a new application.

1. Choose a name for the application, select **SAML Application Type** and select **Configure**.

1. In the ACS URLs and Entity ID field add for now some dummy data, like https://example.com

    * This data will be updated with the correct data in a subsequent step.

    Select **Save**.

1. Go to the **Configuration** tab and save the following information:

    * Issuer ID
    * Single Logout Service
    * Single Signon Service

    This information will be needed once we configure SAML in the Redis Cloud console.

    * Select **Download Metadata**. An XML file will be downloaded. Open it and copy the certificate, which is required for the configuration in Redis Cloud console.

5. Go to the **Attribute Mappings** tab. Add the following attributes:

    * saml_subject
    * Email
    * FirstName
    * LastName
    * redisAccountMapping

Step 2: Configure SAML support in Redis Cloud

Now that we have our Ping Identity IdP server ready, we need to configure support for SAML in Redis Cloud.

Sign in to Redis Cloud

Activate SAML in access management

To activate SAML, you must have a local user (or social sign-on user) with the **owner** role. If you have the correct permissions, you will see the **Single Sign-On** tab.

1. Fill in the information you copied previously, including:

    * **Issuer (IdP Entity ID)**: `Issuer ID`
    * **IdP server URL**: `Single Signon Service`
    * **Single logout URL**: `Single Logout Service`
    * **Assertion signing certificate**: Certificate info you copied from the Ping Identity XML file

    Also add:

    * **Email domain binding**: The domain used in your company's email addresses

    Select **Enable** and wait a few seconds for the status to change.

1. You will then be able to **Download** the service provider (SP) metadata. Save the file to your local hard disk.

1. Open the file in any text editor. Save the following text from the metadata:

    * **EntityID**: The unique name of the service provider (SP)

    * **Location**: The location of the assertion consumer service

Step 3: Finish SAML configuration in Ping Identity

1. In Ping Identity, go to **Administrators > Connections > Applications** and select your application name. Select the **Configuration** tab and select **Edit**.

    This is where we had entered mock data. We will now enter the correct data for this step:

    * Paste **EntityID** information in the **Entity ID** field.

    * Paste **Location** link in the ACS URLS field.

    * For the **Sign on URL** field, add URL `https://cloud.redis.io/#/login/?idpId=`, where you need to add the ID from the Reply URL ID, for example, `https://cloud.redis.io/#/login/?idpId=0oa5pwatz2JfpfCb91d7`.

    Select **Save**.

1. Select the slider to enable the app.

Step 4: Return to Redis Cloud console

1. Return to the Redis Cloud console and select **Activate**.

1. A popup appears, explaining that to test the SAML connection, you need to log in with credentials of a user defined in Ping Federate. Select **Continue** to go to the Ping Federate login screen.

1. The Ping Federate login screen will appear. Enter the credentials and select **Sign In**.

If everything is configured correctly, you will see the the Redis Cloud console screen. Your local account is now considered a SAML account.

To log in to the Redis Cloud console from now on, click on **Sign in with SSO**.

IdP-initiated SSO

`https://cloud.redis.io/#/login/?idpId=`

1. In Ping Identity, go to **Administrators > Connections > Applications** and select your application name. Select the **Configuration** tab and select **Edit**.

1. Go to **Target Application URL** and enter: **https://{enviroment}/#/login/?idpId={idpId}**, where idpId is the ID found in the Location field, after the last '/'

1. Select **Save**.

1. Go to **https://apps.pingone.com/{environment}/myapps/#**, where environment is the environment ID, found in **Administrators -> Environment** for your app.

   You are redirected to the Redis Cloud console.


Social login

Summary: Social login with Redis Cloud.

Overview

Redis Cloud supports the following social logins:
- [GitHub](https://github.com/)
- [Google](https://accounts.google.com/)

If your Google and GitHub accounts share an email address (such as Gmail), you can use either one to sign in to the same Redis Cloud account.

Create a new account with social login

To set up Google login:

1. Select **Google** from the [sign-in](https://cloud.redis.io/) screen.
1. Sign in with the Google account you would like to use.
1. Select **Confirm** on the **Sign in with Google** prompt.

To set up GitHub login:

1. Select **Github** from the [sign-in](https://cloud.redis.io/) screen.
2. Sign in with the Github account you would like to use.
3. Select **Authorize** on the **Authorize Redis Okta Auth Github** prompt.

If the email address associated with your GitHub account is not public, you will see an error message that your sign in attempt failed. You need to [make your email address public](https://docs.github.com/en/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-email-preferences) on GitHub before you try again.

Migrate an existing account to social login

If you already have a Redis Cloud account that requires an email address and password to sign in, you can migrate your existing account to use a social login associated with that same email address instead.

Once you migrate your account to use social login, you cannot revert to your old email/password sign in method.

To migrate your account to Google social login:

1. Select **Google** on the [sign-in](https://cloud.redis.io/) screen.
1. Choose your preferred account from the list.
1. A confirmation prompt will display and warn that you cannot revert to your old sign in method if you proceed with the migration to social login.
1. Select **Confirm** to continue migration.

To migrate your account to GitHub social login:

1. Select **Github** on the [sign-in](https://cloud.redis.io/) screen.
1. Select **Authorize** on the **Authorize Redis Okta Auth Github** prompt.
1. Enter your GitHub password to **Confirm access**. A confirmation prompt warns that you cannot revert to your old sign-in method if you proceed with the migration to social login.
1. Select **Confirm** to continue migration.