> For the complete documentation index, see [llms.txt](https://docs.snyk.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.snyk.io/platform-administration/user-management/single-sign-on-sso-for-authentication-to-snyk/configure-self-serve-single-sign-on-sso.md). # Configure Self-Serve Single Sign-On (SSO) How Group Admins on Enterprise plans configure Self-Serve SSO with SAML for Snyk Group Admins on a Snyk Enterprise plan who use SAML for SSO can configure Snyk Single Sign-on themselves. Ensure you have at least one Group and Organization where you can assign new users. See [Manage Groups and Organizations](/platform-administration/snyk-hierarchy/groups-and-organizations.md). {% hint style="info" %} To enable the self-serve SSO option, contact your Snyk account team or [Snyk support](https://support.snyk.io).\ \ This option does not accommodate [custom role mapping](/platform-administration/user-management/single-sign-on-sso-for-authentication-to-snyk/custom-mapping.md). To set up custom role mapping with SSO for your Snyk Group, contact your Snyk account team. {% endhint %} ## Use SAML for SSO: process overview The process of establishing trust between your identity provider (IdP) and Snyk requires that the Group Admin do the following: 1. Configure your identity provider (IdP) by using the details about the Snyk environment displayed on-screen and user attributes. 2. Enter SAML attributes from your identity provider(IdP) on the Group SSO Settings page. 3. Configure Snyk SSO settings, choosing how you want your members to log in. 4. Verify SSO login to confirm the login process is working correctly. {% hint style="info" %} After SSO is configured both from Snyk and your company's network, a trust relationship is established with Snyk, Auth0 (on behalf of Snyk), and your network. Any sensitive data is encrypted and stored in Auth0 only for the purposes of enabling user logins. Although not all the examples following this page cover verifying the Snyk signature, it is recommended that you improve the trust relationship and ensure integrity even further. Follow your respective IdP's documentation to add SP signature verification where possible. {% endhint %} ## **User login** Users are [provisioned ](/platform-administration/user-management/single-sign-on-sso-for-authentication-to-snyk/choose-a-provisioning-option.md)to Snyk when they log in. If the new user role selected is Group Member, the new user sees only a list of your Organizations until the admin adds them to the appropriate Organizations. ## High-level configuration steps ### **Configuring the IdP** 1. In the Snyk web UI, navigate to **Group** > **Settings.** 2. Select **SSO** and copy the needed information in step 1, namely **Entity ID**, **ACS URL,** and the Snyk **signing certificate URL**. 3. Enter these details in the IdP where appropriate and upload the Snyk signing certificate after downloading it locally in case the IdP does not accept only the certificate URL. 4. Before moving back to the Snyk UI, copy the IdP provided sign in URL and copy or download the IdP-provided **X509 signing certificate** details. ### **Configuring Snyk** 1. In Step 2 of the SSO settings page in the Snyk web UI, enter the details collected from the IdP by providing the sign in URL, sign out URL if available and desired, the IdP signing certificate and domains and subdomains that will be served over the SSO connection. 2. In case the connection requires HTTP-Redirect protocol binding, change that option from the default HTTP-POST. 3. Finally, verify if an IdP-initiated workflow should be enabled and then select **Create Connection** or **Save changes** if you are modifying an existing connection**.** ### **Setting up user provisioning** 1. To make sure users are assigned the correct role when logging in for the first time, choose either **Group member**, **Org Collaborator** or **Org Admin**. Refer to [choosing a provisioning option](/platform-administration/user-management/single-sign-on-sso-for-authentication-to-snyk/choose-a-provisioning-option.md) for details on the options in this step. 2. In the section **Profile Attributes**, the fields are auto-populated but verify that **Email**, **Name** and **Username**, if known, exactly match the corresponding keys in the SAML payload raw JSON sent by the IdP to Snyk. Select **Save Changes** and move to the final step where you verify the setup. ### **Testing and verifying the configuration** 1. Provided all details have been entered correctly, the direct URL from the top of **Step 3** in the Snyk web UI can now be used to verify the configuration works as intended by logging in as a user in the directory of the IdP. 2. When all stored details are verified to be accurate (name, e-mail, permissions), Snyk generally recommends existing users that previously were logged in through Social login methods be removed from the Snyk platform. This can be accomplished under the Group menu **Members.** --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.snyk.io/platform-administration/user-management/single-sign-on-sso-for-authentication-to-snyk/configure-self-serve-single-sign-on-sso.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.