# Changing issuer in Auth0 SAML enterprise connection **URL:** \ **Category:** Get Help\ **Tags:** saml\ **Created:** [June 16, 2022, 7:17am UTC](https://community.auth0.com/t/changing-issuer-in-auth0-saml-enterprise-connection/85216 "2022-06-16T07:17:35Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![dsteblyuk](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dsteblyuk/32/38070_2.png) [@dsteblyuk](https://community.auth0.com/u/dsteblyuk)\ **Post date:** [June 16, 2022, 7:17am UTC](https://community.auth0.com/t/changing-issuer-in-auth0-saml-enterprise-connection/85216/1 "2022-06-16T07:17:35Z")
Is it possible to change issuer (default is “urn:auth0:YOUR\_TENANT:YOUR\_CONNECTION\_NAME”) in a SAML connection via Auth0 Management API? For context, we are migrating customers from old SSO system to Auth0 and they already have SAML configurations in their IDPs. Unfortunately, the issuer format we were using doesn’t match the one in Auth0 so we cannot do the migration without asking customers to change audience (and callback URL) in their IDPs. ---
**Author:** ![thameera](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/thameera/32/13430_2.png) [@thameera](https://community.auth0.com/u/thameera)\ **Post date:** [June 17, 2022, 2:09am UTC](https://community.auth0.com/t/changing-issuer-in-auth0-saml-enterprise-connection/85216/2 "2022-06-17T02:09:09Z")
Hey @dsteblyuk , the `entityId` of a SAML connection can be overridden by PATCHing the connection with the value you want. This attribute should go under the `options` object of the connection. One work of caution: the `options` object is overwritten when being patched, instead of being merged. So you will want to get the existing object by doing a GET first and send the existing contents when doing the PATCH. Example: ```bash curl -X PATCH 'https://TENANT_DOMAIN/api/v2/connections/CONNECTION_ID' \ --header 'Authorization: Bearer MGMT_API_TOKEN' \ --header 'Content-Type: application/json' \ --data-raw '{ "options": { "entityId": "some_new_value", // rest of the options you received from GET } }' ``` ---
**Author:** ![dsteblyuk](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dsteblyuk/32/38070_2.png) [@dsteblyuk](https://community.auth0.com/u/dsteblyuk)\ **Post date:** [June 17, 2022, 7:18am UTC](https://community.auth0.com/t/changing-issuer-in-auth0-saml-enterprise-connection/85216/3 "2022-06-17T07:18:39Z")
Hi @thameera! Thank you for a quick reply! I already tried changing issuer this way, but it was not working for me (I just double-checked). I tried it for google and okta. Google fails with `app_not_configured_for_user` (before redirecting to Auth0), which means **saml:Issuer** passed in SAML request doesn’t match Entity ID (configured in google workspace). Okta does redirect to Auth0, but then Auth0 replies/redirects with an error `Audience is invalid. Configured: urn:auth0:TENANT_DOMAIN:CONNECTION_NAME `. **EDIT** worth mentioning that the request itself will succeed, but I think that’s only due to Auth0 ignoring unknown options (I tried some gibberish option names and the requests didn’t fail). ---
**Author:** ![thameera](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/thameera/32/13430_2.png) [@thameera](https://community.auth0.com/u/thameera)\ **Post date:** [June 17, 2022, 1:43pm UTC](https://community.auth0.com/t/changing-issuer-in-auth0-saml-enterprise-connection/85216/4 "2022-06-17T13:43:59Z")
Hey @dsteblyuk , my bad - the option when Auth0 is the SAML SP is actually called `entityId`, not `issuer`. I just tested and verified this - can you try it? I’ll update the original answer as well. ---
**Author:** ![dsteblyuk](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dsteblyuk/32/38070_2.png) [@dsteblyuk](https://community.auth0.com/u/dsteblyuk)\ **Post date:** [June 20, 2022, 6:45am UTC](https://community.auth0.com/t/changing-issuer-in-auth0-saml-enterprise-connection/85216/5 "2022-06-20T06:45:48Z")
Hi @thameera, it worked, thank you so much! > my bad - the option when Auth0 is the SAML SP is actually called `entityId` , not `issuer` It was my bad actually - this was in the docs and I missed it: [https://auth0.com/docs/authenticate/identity-providers/enterprise-identity-providers/saml#specify-a-custom-entity-id](https://auth0.com/docs/authenticate/identity-providers/enterprise-identity-providers/saml#specify-a-custom-entity-id) However, changing `entityId` was not enough, as Auth0 also does verification of destination and recipient (both must be specified in SAML service provider). By default the recipient and destination are equal to `https://TENANT_DOMAIN/login/callback?connection=CONNECTION_NAME` in Auth0. Our customers have different values already specified in their IDPs. This causes `access_denied Recipient is invalid` and `Destination is invalid` errors. Is it possible to override these values in Auth0? P.S. I found an open topic about the same issue but it’s unanswered: > [@Can I skip Destination URL check as SAML Service Provider?](https://community.auth0.com/t/can-i-skip-destination-url-check-as-saml-service-provider/69115): > > Hello, I’m trying to replace my own authentication system to Auth0. My system has SAML as Service Provider feature and some users did setting their IdP to connect my Service Provider. Generally I have to ask them to update IdP setting to request to Auth0 but I want to let them use Auth0 instead of us without changing their IdP. I tried to receive SAML Response in my ACS and then call Auth0 ACS to passthrough SAML Response and RelayState however Auth0 returns error Destination endpoint did not … ---
**Author:** ![konrad.sopala](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/konrad.sopala/32/13516_2.png) [@konrad.sopala](https://community.auth0.com/u/konrad.sopala)\ **Post date:** [February 22, 2023, 11:38am UTC](https://community.auth0.com/t/changing-issuer-in-auth0-saml-enterprise-connection/85216/6 "2023-02-22T11:38:43Z")