> For clean Markdown of any page, append .md to the page URL. > For a complete documentation index, see https://docs.ada.cx/docs/other/team-access/sso/llms.txt. > For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.ada.cx/_mcp/server. # SSO ## Overview With SSO (Single Sign-On), you can sign into your Ada dashboard using your organization's authentication tool, rather than having to type in your username and password every time you log in. Setting up SSO requires work at different stages for both your Ada representative and your organization. Your Ada representative sets up Ada's Okta account to work with your organization's identity provider (IDP), and you set up your organization's IDP. Once you have completed this process, you can use the same IDP for multiple Ada instances. > **Note** > > Ada uses Okta as a service provider (SP), but that does not mean you have to use Okta for your organization's identity provider (IDP). ## Limitations SSO has the following limitations: * **No direct IDP login**: Logging in directly from your IDP is not currently supported. You must go to the Ada login page and click **Log in With SSO**. Consider hiding Ada in your IDP's dashboard to avoid confusion. * **Single login method per user**: Users can use only one method to log into Ada (password or SSO), but not both. * **Requires Ada representative**: Initial SSO setup requires coordination with your Ada representative. ## Use cases SSO simplifies authentication and strengthens security for your team. * **Centralize authentication**: Manage Ada access through your existing identity provider instead of maintaining separate credentials. * **Enforce security policies**: Apply your organization's authentication requirements, such as multi-factor authentication, to Ada logins. * **Support multiple Ada instances**: Use the same IDP configuration across all your Ada instances. ## Capabilities & configuration SSO integration supports the following: * **SAML-based authentication**: Connect any SAML 2.0 compliant identity provider to Ada. * **Multiple Ada instances**: Use the same IDP configuration across multiple Ada instances. * **User attribute mapping**: Pass `email`, `firstName`, and `lastName` attributes from your IDP to Ada. ## Quick start Set up SSO for your organization in a few steps. Contact your Ada representative to get the `ACS URL` and `Audience URI` values. Create a SAML application in your IDP and configure it with the values from step 1. Send your Ada representative the `entityID`, `Single Sign-On URL`, and certificate from your IDP. Assign users the Ada Support app in your IDP and re-add them in Ada with SSO as their login type. For detailed instructions, see [Implementation & usage](#implementation--usage). ## Implementation & usage Set up SSO by coordinating with your Ada representative and configuring your organization's identity provider. ### Set up SSO Configure your IDP to work with Ada's Okta instance. **To set up SSO:** 1. Contact your Ada representative so they can start setting up your IDP in Ada's Okta instance. They provide you with two values: * `ACS URL` * `Audience URI` You need these values when you configure your SAML application in the next step. 2. Create a SAML application in your IDP for Ada. Then, configure your SAML application with the following: * **Assertion Consumer Service URL** (aka **Single Sign-On URL**): Use the `ACS URL` your Ada representative provided. The **Recipient URL** should also use the same `ACS URL`. * **Entity ID** (aka **Audience URI**): Use the `Audience URI` your Ada representative provided. * **Name ID format**: `email` * **Application Username**: `email` * Add three more **user attributes** in addition to Name ID: `email`, `firstName`, and `lastName` This example shows a completed SAML application configuration in Okta. Note that there is also a button to download a certificate, which you need in step 4. Different tools make the certificate available in different places. ![](/_fern-img/d50fe90ed2f269591b391911a8f216681c0b0ec86744b8d6fe1df88521683b0a.webp) 3. Find your IDP's metadata. Different IDPs make this information available in different places. As an example, this is how you can find the metadata in Okta: ![](/_fern-img/666f9c99d3ff3c29cc91a4cc7f01375e41434698b126148f3f1ad34e6e4af83c.webp) In the metadata, find these two values: * `entityID` * `Single Sign-On URL` > **Note** > > Some IDPs have different names for these values. The most reliable way to find them is to find an IDP Metadata `.xml` file. That file contains these values in a standardized format. This is how they might look in the `.xml` file. The `Single Sign-On URL` is listed as the `Location` of the `SingleSignOnService` for `HTTP-POST`: 4. Find your IDP's certificate, which should come in the form of a `.crt`, `.cert`, or `.pem` file. If you find a string that looks like this, paste it into a text editor and save it with a `.pem` file extension: ``` -----BEGIN CERTIFICATE----- MIIDVjCCAj4CCQD7DEtIu02MpzANBgkqhkiG9w0BAQsFADBtMQswCQYDVQQGEwJV UzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzEQ blahblahblahyougettheidea1aYLG4r1w7QcnH8TYQb0ZqOTfTrl8HE+rD457zp 1QBTbbNWfiLLB0hAqkZuNormxaYRDb8rlAzDlargoVy/O4bxSiuoVrVTMxEkYYZ/ Ji3edZ7TXGbvp6TR9as+B8V2caeJ9TLmmtG1gg8mrsZSin+/ZtLZN8H3 -----END CERTIFICATE----- ``` 5. Send your Ada representative the `entityID` and `Single Sign-On URL` values and certificate from your IDP. They can then complete the setup process on their end. 6. To allow users to log in with SSO, assign them the Ada Support app in your IDP. Then, in your Ada dashboard, delete their existing accounts and add them again, selecting SSO as their login type. For more information, see [Manage users and permissions](/docs/other/team-access/my-team). ## Related features Explore additional access and security options. * [My team](/docs/other/team-access/my-team): Manage team members and permissions. * [Profile](/docs/other/team-access/profile): Configure your personal account settings. * [Session timeout](/docs/other/team-access/session-timeout): Set session limits for security compliance. --- Have any questions? Contact your Ada team, or email us at [](mailto:help@ada.cx?subject=Help%20Docs%20inquiry).