Skip to main content
For the complete documentation index for agents and LLMs, see llms.txt.

Enable Single Sign-On (SSO)

Connect your identity provider to Haystack Enterprise Platform so your team signs in with their corporate credentials.

About This Task​

Single Sign-On (SSO) is a user authentication method for accessing multiple systems with one set of credentials. Users log in once and gain access to connected systems without re-entering credentials.

Organization admins add, edit, enable, disable, and delete SSO connections from Settings > Organization > SSO.

Who Can See SSO

SSO is only visible to organization admins. If you don't see SSO in your organization settings, self-serve SSO isn't available for your organization yet. Reach out to your Haystack Platform representative to turn on SSO for Haystack Enterprise Platform.

Prerequisites​

  • You're a Haystack Platform organization admin.
  • You can create and configure applications in your identity provider. In Microsoft Entra ID, this means the Cloud Application Administrator role or higher.
  • You know at least one email domain your team signs in with. Public and free email providers are not accepted, for example gmail.com, outlook.com, hotmail.com, yahoo.com, icloud.com, proton.me, and gmx.net. To use subdomains, list them explicitly. You can add up to 50 domains per connection.
  • You have invited at least one pilot user to Haystack Enterprise Platform. For details, see Add Users to Organization.
  • You have an admin account on an email domain that you don't plan to route to SSO. When a connection goes live, everyone on a claimed domain is redirected to your identity provider. If the connection is misconfigured, this includes the admin who would need to turn it off.
Invite People First

SSO signs in members who already have a Haystack Platform account. It never creates new ones. SSO turns away anyone who authenticates successfully at your identity provider but hasn't been invited to Haystack Enterprise Platform. The email address your identity provider sends must match the address they were invited with.

Choose a Protocol​

SSO uses one of two protocols to exchange identity information between Haystack Enterprise Platform and your identity provider:

  • SAML uses signed XML messages and needs no client secret.
  • OIDC is built on OAuth 2.0 and authenticates with a client ID and secret.

For Microsoft Entra ID, we recommend SAML. It needs no client secret, so there's nothing to rotate. For Google Workspace and Okta, OIDC is the simpler path. If you have no preference and your provider supports both, choose OIDC.

Set Up a Connection​

Follow the guide for your identity provider:

Microsoft Entra ID

Microsoft Entra ID has no dedicated template. Set it up as a Generic SAML connection and follow Set Up Microsoft Entra ID with SAML.

Manage a Connection​

After you set up a connection, you can update, enable, disable, or delete it, and troubleshoot sign-in problems:

What To Do Next​