> ## Documentation Index
> Fetch the complete documentation index at: https://docs.braintrust.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Setting up SSO integration in Braintrust

> Set up SAML or OIDC SSO with Braintrust, including provider requirements, connection values, and optional JIT group mapping.

> [!NOTE]
>
> **Applies to:**
>
> * Plan - Enterprise
> * Deployment - Any
> *
> * SSO

Contact [support@braintrust.dev](mailto:support@braintrust.dev) to set up an SSO integration. Braintrust supports the following protocols and identity providers (IdPs):

* **SAML**: Okta Workforce, Microsoft Entra ID, Google Workspace, or a custom SAML provider.
* **OpenID Connect (OIDC)**: A custom OIDC provider.

## Information to include

Include the IdP and protocol you will use, the email domain or domains to configure, and the protocol-specific details below.

## SAML connections

For a SAML connection, include whether you want to enable IdP-initiated login, such as launching Braintrust from an Okta tile.

Braintrust support will provide connection-specific values for your SAML service provider (SP) configuration:

* **Single sign-on URL**.
* **Audience URI (SP Entity ID)**.

Add these values to your SAML application instead of using generic Braintrust URLs.

Configure the SAML response to include:

* `mail`: The user's primary email address.
* `public_metadata_groups` (optional): The SAML group value or values configured in your Braintrust domain mappings. Send each group as a separate attribute value, not a comma-separated string. Include this attribute only if a domain mapping also matches a SAML group value.

See [Domain mappings](https://docs.braintrust.dev/admin/authentication.md#domain-mappings) for JIT provisioning behavior and limitations.

Test the connection with a new user who has access to the SAML application. If the domain mapping also matches a SAML group value, add the test user to a mapped IdP group.

### Okta Workforce

Provide the metadata URL. If it is unavailable, provide:

* Identity Provider Single Sign-On URL.
* Identity Provider Issuer.
* The SSL/TLS certificate to use.

For current Okta configuration steps, see [Add Okta Workforce as a SAML connection](https://clerk.com/docs/guides/configure/auth-strategies/enterprise-connections/saml/okta).

### Microsoft Entra ID

Provide the metadata URL. If it is unavailable, provide:

* Login URL.
* Microsoft Entra Identifier.
* The SSL/TLS certificate to use.

### Google Workspace

Provide the metadata URL. If it is unavailable, provide:

* SSO URL.
* Entity ID.
* The SSL/TLS certificate to use.

### Custom SAML provider

Provide the metadata URL. If it is unavailable, provide:

* SSO URL.
* Entity ID.
* The SSL/TLS certificate to use.

## OIDC connections

For a custom OIDC provider, provide the discovery endpoint. If it is unavailable, provide:

* Authorization URL.
* Token URL.
* User Info URL.

Also include:

* The client ID.
* The client secret.
* Any scopes.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.