Configuring SAML SSO for multi-tenant AI Hub

Multi-tenant AI Hub customers can use security assertion markup language (SAML)-based authentication to manage AI Hub access. Configuring OIDC-based single sign-on (SSO) allows members to authenticate using your organization’s existing identity provider (IdP) without requiring separate AI Hub passwords. Organization members must be added to your organization before they can sign in using SSO.

AI Hub supports IdPs that use SAML 2.0. You can add multiple SSO configurations for your organization, including both SAML and OpenID Connect (OIDC) configurations. Admins can add and manage SSO configurations.

Configuration overview

Adding an SSO configuration involves both creating an app registration in your IdP with AI Hub-provided details, and adding information from your IdP to the configuration in AI Hub.

IdP configuration requirements

When creating your app registration, there are required values for the service provider entity ID, application label, and assertion consumer service (ACS) URL.

For each required value, the following table provides the names of corresponding fields in select IdPs. The accuracy of the Corresponding IdP field column isn’t guaranteed as external product user interfaces aren’t closely monitored.

Field	Where to find in AI Hub	Corresponding IdP field
Service provider entity ID	Provided on the first screen of the Add SAML configuration dialog.	The service provider entity ID value is set in the following IdP fields: • AD FS — Relying Party Trust Identifier • Auth0 — The audience attribute within the SAML assertion When using Auth0 as your IdP, the SP entity ID value in AI Hub corresponds to the audience attribute in the SAML assertion. By default the audience value is the same as the Auth0 issuer. You must edit the audience value to match your AI Hub base URL (or whatever value you’re using as the SP entity ID). See the Auth0 customize SAML assertions documentation for details. • JumpCloud — Audience/Entity ID • Microsoft Entra ID — Identifier (Entity ID) • Okta — Audience URI (SP Entity ID)/Audience Restriction • OneLogin — Audience (EntityID) • PingFederate — Partner’s Entity ID (Connection ID)
Application label	Provided on the first screen of the Add SAML configuration dialog.	The application label value is set in the following IdP fields: • AD FS — Display name • Auth0 — Name (Application name) • JumpCloud — Display label • Microsoft Entra ID — Application name • Okta — Application label • OneLogin — Display name • PingFederate — Connection name
Assertion consumer service (ACS) URL	Provided on the last screen of the Add SAML configuration dialog. Also accessible after adding a configuration from the configurations list. Click the overflow icon > Show ACS URL.	The ACS URL value is set in the following IdP fields: • AD FS — Relying Party SAML 2.0 SSO service URL • Auth0 — Application Callback URL • JumpCloud — ACS URLs • Microsoft Entra ID — Reply URL (Assertion Consumer Service URL) • Okta — Single Sign On URL • OneLogin — ACS (Consumer) URL • PingFederate — Assertion Consumer Service URL

Attribute configuration and mapping

Beyond these technical requirements, you can configure your IdP to send user information via attributes to automatically populate member profiles and manage select permissions in AI Hub.

If attributes are passed using the default attribute names listed below, their values automatically populate member profiles. To use custom attribute names, map them to the corresponding attribute during configuration. Attribute values override any existing values in AI Hub.

AI Hub configuration requirements

When adding your SSO configuration in AI Hub, you must provide the IdP metadata XML from your app registration. You can upload the XML file, paste its contents, or provide the remote access value. If uploading or pasting the XML, use the local access value to view or download the XML document.

The following table outlines where you can find the local or remote access value for the metadata XML in select IdPs. The accuracy of this table isn’t guaranteed as external product user interfaces aren’t closely monitored.

Adding SAML configurations

1. In the header, click the initials icon and select Settings.

2. Select the Security tab.

3. Click Add configuration > SAML configuration.

4. Copy the provided application label and service provider entity ID values, then click Next. In your IdP, add the values to your app registration.

5. Add a display name to identify the configuration.

6. Select your identity provider.

7. Select a configuration method for how you’re providing the metadata XML.

   • Remote metadata URL — Provide the remote access URL.

   • Metadata XML file — Upload the .xml file.

   • Metadata XML — Paste the metadata XML directly.

8. (Optional) Configure attribute mappings.

9. (Optional) Expand Advanced settings to configure advanced security settings.

   • Response signed — Requires the entire SAML response message to be digitally signed by the identity provider. This provides message integrity protection for the complete response structure containing the assertion. Defaults to not required (not selected).

   • Assertion signed — Requires the SAML assertion within the response to be digitally signed by the identity provider. The SAML 2.0 specification requires IdPs to digitally sign assertions as the minimum security requirement. Defaults to required (selected).

   • Authentication requests signed — Requires authentication requests sent from AI Hub to the identity provider to be digitally signed. This prevents tampering with authentication requests and ensures request integrity. Defaults to not required (not selected).

   • Logout requests signed — Requires SAML logout requests to be digitally signed when users sign out. This ensures the integrity of logout operations between AI Hub and the identity provider. Defaults to required (selected).

   • Allow unsolicited — Allows the identity provider to initiate authentication flows without a prior request from AI Hub. When enabled, users can start the login process directly from the IdP (IdP-initiated SSO) rather than from AI Hub. Defaults to enabled (selected).

10. Click Save.

11. Copy the provided ACS URL, then click Close. In your IdP, add the ACS URL to your app registration, and save your changes.

You can now test your configuration.

Testing SAML configurations

Your configuration doesn’t undergo validation, so it must be tested. At minimum test with your own account and optionally engage other organization members to test that they can successfully sign in using SSO.

1. Log out of your AI Hub account.

2. Log back in to AI Hub, and, when presented with sign-in options, click Continue with SSO.

3. Complete sign in with your identity provider.

If you encounter any issues, review all configuration settings.

After successfully testing your configuration, you can optionally turn off the Allow sign-in with email and password toggle to enforce SSO for all organization members.

Updating SAML configurations

Select configuration changes are supported.

1. In the header, click the initials icon and select Settings.

2. Select the Security tab.

3. In the configurations list, hover over the configuration, then click the edit icon.

4. Make any changes, then click Save

5. Test your updated configuration.

Disabling and deleting SAML configurations

You can disable or delete your configuration. Disabling a configuration removes it as a supported sign-in option, but the configuration is preserved and can later be re-enabled.

1. In the header, click the initials icon and select Settings.

2. Select the Security tab.

3. In the configurations list, hover over the configuration, then click the overflow icon.

4. Select Disable configuration or Delete.

5. Click Disable or Delete to confirm.