Product documentation
Citrix Cloud™
View PDF

Create a SAML Connection using Metadata URL Mode

March 31, 2026
Author:  Mark Dear

Citrix recommends that all new SAML connections be created using metadata URL mode. Obtain the metadata URL for your SAML application from inside your IdP. Citrix Cloud can consume SAML IdP metadata to configure a SAML connection automatically.

Simplicity. The SAML connection inside Citrix Cloud is set up automatically using a combination of default connection setting values and values obtained from inside the metadata.

IdP metadata contains all the following information required to set up the SAML connection inside Citrix Cloud:

  • SAML Entity ID
  • SSO Endpoint
  • SLO Endpoint (if configured inside the IdP)
  • Supported SAML bindings
  • Public keys and signing certificates

Reduced Maintenance. Automatic handling of changes made inside the SAML IdP and IdP certificate rotations.

How does Citrix Cloud handle IdP certificate rotations when Metadata URL mode is used?

Automatically. When your SAML IdP admin updates the SAML application to include a new IdP signing certificate, or replace the existing certificate, Citrix Cloud implicitly trusts all SAML signing certificates provided inside the IdP metadata. Metadata URL mode eliminates the need for manual IdP certificate rotations within Citrix Cloud. Any changes made by IdP admins are automatically detected. Your SAML application’s metadata URL is used during each SAML logon to get the latest copy of your SAML application’s signing certificates.

Configure the Citrix Cloud SAML connection using your IdP Metadata URL

  1. Obtain the link to your SAML application’s metadata and enter it into a browser to prove it is contactable and there are no firewall rules blocking Citrix Cloud’s access to it.

    Example:
    https://tenant.okta.com/app/zxv1r8qo70l2q5LNT359/sso/saml/metadata

  2. When you reach the Section 4 Service Provider section of the SAML wizard, enter your SAML application’s metadata URL here and click Verify.

    IMPORTANT:
    If your SAML application exists on an on-premise server such as an ADFS or PingFederate server and SAML IdP metadata URL fails to verify, check your firewall rules. Verify your metadata URL is contactable inside a browser from any client outside of your organization.

  3. After Citrix Cloud has parsed the metadata URL you should see this success message and Re-Verify.

    Here is an Okta example of a successfully imported metadata connection.

    Enter Metadata URL

  4. Configure the SAML logout behaviour you want by either enabling or disabling SLO.
    Refer to this in-depth article for Logout Considerations.

    Important:

    Okta SAML connections ONLY. If the metadata URL contains an SSO endpoint and a DNS domain string containing “okta” then Send NameID Policy as Unspecified for Okta will be automatically enabled. Okta SAML applications that use an Okta custom domain like mytenant.domain.com cannot be autodetected and Send NameID Policy as Unspecified for Okta must be manually enabled by the Citrix admin by clicking the check box.

  5. Accept the default attribute mappings.

  6. Configure your Citrix Cloud Admin Sign-In URL.

  7. Examine the SAML wizard summary inside the Review section and verify the SAML configuration matches your expectations after parsing of the IdP metadata URL.

    Use Metadata URL Upload Summary

Create a SAML Connection using Metadata URL Mode
March 31, 2026
Author:  Mark Dear
March 31, 2026
Author:  Mark Dear

In this article

Site feedback | Your privacy choices footer linkYour Privacy Choices | Privacy and legal terms | Cookie preferences | Consent settings | docs.cloud.com
© 1999- Cloud Software Group, Inc. All rights reserved.