# SSO Setup Guide for Other Providers


{{< announcement >}}
The Single Sign-On (SSO) feature is available in the [Enterprise](https://www.rudderstack.com/enterprise-quote/) plan only.
{{< /announcement >}}

This guide lists the generic configuration settings required to set up and enable SSO for your organization, depending on your SSO vendor.

{{< info >}}
RudderStack supports only the [SAML 2.0 protocol](https://auth0.com/intro-to-iam/what-is-saml) for SSO.
{{< /info >}}

## Configuration settings

| Setting | Value |
| :-------| :------|
| Audience (Entity ID) | `urn:amazon:cognito:sp:us-east-1_ABZiTjXia` |
| Recipient | `https://auth2.rudderstack.com/saml2/idpresponse` |
| ACS Consumer URL | `https://auth2.rudderstack.com/saml2/idpresponse` |
| Login URL | `https://app.rudderstack.com/sso?domain=<your_website>]` |

{{< warning >}}
Make sure to enter the correct domain name in the **Login URL** setting. 

For example, if your employee email is `john@example.com`, then your **Login URL** will be `https://app.rudderstack.com/sso?domain=example.com`.
{{< /warning >}}

## Configure SAML 2.0 custom attributes

Note that the SAML 2.0 custom attributes may vary depending on the SSO vendor. Make sure to:

- Set the property/parameter associated with the user's email address to `Email`. 
- Set the property/parameter associated with the user's last name to `LastName`.
- Set the SAML nameID format to the property associated with the **email address**. For this setting, the IdP vendors generally provide a dropdown list with various options for selection.

{{< danger >}}
Your SSO authentication will fail if these mandatory custom attributes are not set up correctly.
{{< /danger >}}

## Enable SSO

{{< warning >}}
Before sharing the final Metadata URL or metadata file, verify that the IdP metadata declares both HTTP-Redirect and HTTP-POST SAML bindings. 

RudderStack uses AWS Cognito, which sends the initial login request with HTTP-Redirect, so metadata that advertises only HTTP-POST will be rejected.
{{< /warning >}}

Share the final Metadata URL or metadata file with the [RudderStack team](mailto:support@rudderstack.com) to enable SSO for your organization.

{{< info >}}
While sharing the metadata, also let the RudderStack team know:

- Which workspace you would like to set as the **default workspace** for your organization. New users who sign in through SSO for the first time will automatically land in this workspace.
- Whether you want RudderStack to also create a **personal organization** for each new SSO user. This is **off by default**.

You can also opt out of setting up a default workspace altogether if you don't want your SSO users to get automatic access to a shared workspace.
{{< /info >}}

## Debugging

{{< customreadfile "/includes/sso-debugging.md" >}}

#### Invalid samlResponse or relayState from identity provider

{{< image src="images/user-guides/sso-errors-1.webp" alt="SSO errors" >}}

The above error indicates you tried the [IdP](https://support.okta.com/help/s/article/okta-saml?language=en_US)-initiated authentication flow. RudderStack's SSO integrations support only [Service Provider (SP)-initiated SSO flow](#supported-features).

RudderStack recommends following all the SSO configuration steps correctly and initiating the SSO authentication using the **Login URL** (`https://app.rudderstack.com/sso?domain=<your_website>]`).

#### Required String parameter 'RelayState' is not present

{{< image src="images/user-guides/sso-errors-2.webp" alt="SSO errors" >}}

The above error indicates that you did not set up your SSO app correctly. Verify your SSO configuration in that case.

<br />