Product documentation
Citrix Cloud™
View PDF

Create a SAML Connection using Metadata File Mode

March 31, 2026
Author:  Mark Dear

How does Metadata File mode differ from Metadata URL mode?

On premise SAML IdPs such as an ADFS or PingFederate server may have restrictions that block public access to their SAML metadata URL endpoint, so using metadata URL mode is not possible. Citrix Cloud administrators can still benefit from automatic configuration of Citrix Cloud SAML connections if they are provided with a metadata.xml file exported from the SAML IdP. Citrix Cloud administrators can still upload this file within the SAML connection creation wizard.

How is Metadata File mode less useful than Metadata URL mode?

Metadata File mode is a static configuration stored inside Citrix Cloud. Citrix Cloud SAML connections that were created using metadata file mode cannot detect changes in the SAML application AFTER it has been uploaded into Citrix Cloud.

Metadata URL mode is a dynamic configuration obtained on demand. Metadata URL mode continuously polls your SAML IdP and can detect changes made inside the SAML application configuration immediately after they are made.

Configure the Citrix Cloud SAML connection using your IdP Metadata File

  1. Download the metadata.xml file from the SAML application you wish to configure inside Citrix Cloud as a new SAML IdP connection.

  2. Save the file to disk as <filename>.xml and do not make any changes to its XML formatting or its contents. It is recommended you use completely unchanged and unformatted metadata.xml files taken directly from the SAML IdP after export.

    Important:

    metadata.xml files are often signed by the IdP to prevent tampering. Any changes to the data inside the metadata.xml such as reformatting it using XML beautifying tools will invalidate the embedded signature and cause a failure to upload and parse the metadata.xml.

  3. When you reach the Section 4 Service Provider section of the SAML wizard select Can’t use the metadata URL?.

    Cannot Use Metadata URL Mode

  4. Select Upload metadata file and drag and drop the metadata.xml file into the file upload dialogue or browse to the metadata.xml file on disk.

    Here is an Okta example of a successfully imported metadata file.

    Use Metadata File Uploaded

  5. Configure the SAML logout behaviour you want by either enabling or disabling SLO.
    Refer to this in-depth article for Logout Considerations.

  6. Okta SAML connections ONLY. If the metadata file contains an SSO endpoint and a DNS domain string containing “okta” then Send NameID Policy as Unspecified for Okta will be automatically enabled. Okta SAML applications that use an Okta custom domain like mytenant.domain.com cannot be autodetected and Send NameID Policy as Unspecified for Okta must be manually enabled by the Citrix admin by clicking the check box.

  7. Accept the default attribute mappings.

  8. Configure your Citrix Cloud Admin Sign-In URL.

  9. Examine the SAML wizard summary inside the Review section and verify the SAML configuration matches your expectations after parsing of the IdP metadata file.

    Use Metadata File Upload Summary

Create a SAML Connection using Metadata File Mode
March 31, 2026
Author:  Mark Dear
March 31, 2026
Author:  Mark Dear

In this article

Site feedback | Your privacy choices footer linkYour Privacy Choices | Privacy and legal terms | Cookie preferences | Consent settings | docs.cloud.com
© 1999- Cloud Software Group, Inc. All rights reserved.