If you wish to federate your identity provider (IdP) with the Medtronic Customer Identity and Access Management (CIAM) broker using SAML 2.0, please follow these instructions.
To federate using OIDC core 1.0, see the OIDC page instead.
Optional: Enter placeholders in your IdP
If you use Microsoft Entra or another IdP that requires an Assertion Consumer Service (ACS) URL and an Audience URL before it can generate metadata, please use these placeholders.
ACS/Reply URL:
Non-production: https://stage.login.medtronic.com/sso/saml2
Production: https://stage.login.medtronic.com/sso/saml2
Audience/Identifier URL: https://www.okta.com/saml2/service-provider
You must update these URLs later, after we have created the federation.
Register your IdP in Touch Surgery™
If you already have a federation configured and tested in your non-production environment, click Set up in Production and skip to step 5.
In Touch Surgery™:
Go to your Account Settings.
Select SSO setup.
Select Add a connection.
Choose SAML from the dropdown menu.
Provide a Metadata URL, if you have one, to fill the form automatically. Otherwise, select Enter data manually and proceed with steps 6 to 9 below.
In the field “IdP entity ID/URL”, input the unique URL of the IdP or SAML connector. This may be called the Issuer ID/URL.
In the field “IdP SAML single sign-on URL”, input the audience URL. This is where users should be redirected to when they attempt to log in.
In the field “Logout URL”, input your IdP’s single logout service endpoint.
In the field “X.509 certificate”, input the text of your X.509 certificate.
Submit the form. Our team requires up to 2 business days to create your federation in the Medtronic CIAM broker.
While you wait, you may continue with verifying your domains.
Obtain details in Touch Surgery™
When the federation setup is complete, you receive an email confirmation. You can now view your SAML metadata on the Account Settings page.
In Touch Surgery™:
Go to your Account Settings.
Click Complete setup.
Copy the ACS/Reply URL for later use.
Copy the Audience/Identifier URL for later use.
Finish configuring your connector in your IdP
If you used placeholders for the ACS/Reply URL and the Audience/Identifier URL, you must update them now.
In your IdP:
1. Select the option to create or update a SAML connector or application.
2. In the field for SAML Audience URL (or Valid Redirect URL), input the ACS/Redirect URL you copied.
3. In the field for SP Entity ID (or ClientID), input the Audience/Identifier URL you copied.
4. In the section for Parameters (or Claim Attributes), map the following attributes:
email, mapped to the user’s email.
firstName, mapped to the user’s first (given) name.
lastname, mapped to the user’s last (family) name.
countryCode, mapped to the user’s country, expressed as a 2-character country code. (See ISO 3166-1 alpha 2 "short" code format.) Optional.
personID, mapped to your institution’s unique ID for the user. Optional.
5. If your IdP has one: In the field for Name (or Label), input Medtronic CIAM-%environment%, where environment is production or non-production, as appropriate.
6. Save the connector.
Next steps
Verify your domains, if not complete already