System Functions (System Control)


Migrates an existing SAML identity provider (i.e. IdP) configuration as defined by the account parameter SAML_IDENTITY_PROVIDER to a security integration.

If the account parameter SAML_IDENTITY_PROVIDER is present, SYSTEM$MIGRATE_SAML_IDP_REGISTRATION creates a new security integration using the data in the SAML_IDENTITY_PROVIDER parameter.

If the SAML_IDENTITY_PROVIDER account parameter is not present, the function fails. If this occurs, create a security integration where TYPE = SAML2 as shown in CREATE SECURITY INTEGRATION.


SYSTEM$MIGRATE_SAML_IDP_REGISTRATION( '<integration_name>', '<issuer>' )



Name of the new SAML2 security integration that will be created by the function.

Note that the entire name must be enclosed in single quotes.



The EntityID / Issuer of the IdP.

The entire name must be enclosed in single quotes.

Required if not specified in the SAML_IDENTITY_PROVIDER parameter as the Issuer attribute.


If the SAML_IDENTITY_PROVIDER parameter does not contain a value for Issuer, use your IdP’s metadata to locate the exact value. Depending on the IdP, you might be able to locate the issuer value through the user interface administrator settings, a URL your IdP provides, or by downloading the SAML federation metadata XML to a local file.

As a representative example, the following references detail how to locate the issuer value for Okta and Microsoft Azure AD:


The following is a representative example that migrates the IdP successfully and shows how to view the newly created security integration:

-- migrate an existing IDP configuration

select system$migrate_saml_idp_registration('my_fed_integration', '');

| SUCCESS : [MY_FED_INTEGRATION] Fed SAML integration created                     |

-- view the newly created security integration

desc integration my_fed_integration;