> ## Documentation Index
> Fetch the complete documentation index at: https://docs.landing.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Single Sign-On (SSO)

> Set up SSO via SAML 2.0 or OpenID Connect to manage ADE access through your identity provider.

## About SSO

Agentic Document Extraction supports SSO via **SAML 2.0** and **OpenID Connect (OIDC)**, letting your organization manage Agentic Document Extraction access through your existing identity provider (IdP). Common IdPs include Okta, Microsoft Entra ID (formerly Azure AD), OneLogin, Ping Identity, and Google Workspace.

<Info>
  Users can also sign in with Google or GitHub without any additional setup. This page covers SSO setup via SAML 2.0 and OIDC only.
</Info>

## Availability

SSO via SAML 2.0 and OIDC is available on the **Enterprise** plan.

## What to Know Before Enabling SSO

### SSO Replaces Existing Login Methods

Once SSO is enabled for your organization, it becomes the only way users can log in to Agentic Document Extraction. Users will no longer be able to sign in with a password, Google, or GitHub. This is by design; it ensures that all user access is managed through your IdP, so your organization's security policies are consistently enforced.

To avoid disruption, communicate this change to all Agentic Document Extraction users in your organization before enabling SSO.

### User Access and JIT Provisioning

Your IT department controls who can access Agentic Document Extraction through your IdP by managing user groups. Having a company email address does not automatically grant access. Users must be included in the group configured for Agentic Document Extraction in your IdP.

When setting up SSO, let the LandingAI team know which option you prefer for adding users to your Agentic Document Extraction organization:

* **By invitation**: Only users who have been invited to your Agentic Document Extraction organization can log in, even after SSO is enabled. For information about manually inviting users, see [Organizations & Members](./ade-members).
* **Just-in-Time (JIT) provisioning**: Any user in your IdP's user group who successfully authenticates via SSO is automatically added to your Agentic Document Extraction organization the first time they log in, with no invitation required.

## Enable SSO

SSO setup involves multiple steps and ongoing coordination between your team and the LandingAI team. Here is an overview of the process:

1. [Request SSO](#request-sso) through your Organization Settings.
2. The LandingAI team reaches out to begin the process.
3. Share the required information with the LandingAI team: [SAML 2.0](#required-information-for-saml-20) or [OIDC](#required-information-for-oidc).
4. The LandingAI team enters your information in the Agentic Document Extraction backend.
5. The LandingAI team shares configuration details with you. [Add these to your IdP](#complete-setup-in-your-idp).
6. [Test that SSO is working correctly](#test-that-sso-is-working-correctly).

### Request SSO

To request SSO:

1. Log in to [https://ade.landing.ai/](https://ade.landing.ai/).
2. Go to the [Organization Settings](https://ade.landing.ai/settings/organization/general) page (to navigate there manually, click your profile icon at the bottom left corner of the page and click **Organization Settings**).
3. In the **Single Sign-On (SSO)** box, click **Contact Support**. This sends an automated message to the LandingAI team. The team will contact you about next steps for setting up SSO.

### Required Information for SAML 2.0

Share the following information with the LandingAI team. Most of it can be found in your IdP's SAML configuration page.

The examples below are for Microsoft Entra ID. Formats and field names vary by IdP.

| Item | Description |
| - | - |
| IdP (Identity Provider) | The service provider your organization uses to manage email and SSO. <br /><br />**Example**: Okta, Microsoft Entra ID, etc. |
| JIT provisioning preference | Whether you want to enable Just-in-Time (JIT) provisioning for your organization. See [User Access and JIT Provisioning](#user-access-and-jit-provisioning). |
| Metadata URL | The URL that provides your IdP's SAML metadata, including the Entity ID, SSO login URL, and signing certificate. This URL allows LandingAI to automatically configure the SAML connection without requiring each value separately. <br /><br />In Microsoft Entra ID, this is called **App Federation Metadata URL**. In Okta, this is called **Identity Provider Metadata**. <br /><br />**Example**: `https://login.microsoftonline.com/123/federationmetadata/2007-06/federationmetadata.xml?appid=456` |
| Enterprise email domains | Each email domain that will need access to Agentic Document Extraction. <br /><br />**Example**: acme.com, acme.ai |
| Email claim | The Uniform Resource Identifier (URI) for the email claim type. This communicates the email address of the user. <br /><br />**Example**: `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress` |
| Name claim | Optional. The Uniform Resource Identifier (URI) for the name claim type. This communicates the name of the user. <br /><br />**Example**: `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name` |

### Required Information for OIDC

Share the following information with the LandingAI team. Most of it can be found in your IdP's OIDC configuration page.

The examples below are for Microsoft Entra ID. Formats and field names vary by IdP.

| Item | Description |
| - | - |
| IdP (Identity Provider) | The service provider your organization uses to manage email and SSO. <br /><br />**Example**: Okta, Microsoft Entra ID, etc. |
| JIT provisioning preference | Whether you want to enable Just-in-Time (JIT) provisioning for your organization. See [User Access and JIT Provisioning](#user-access-and-jit-provisioning). |
| Client ID | A unique identifier for the Agentic Document Extraction application registered in your IdP. Your IdP generates this when you create the application. |
| Client Secret | A secret key used to authenticate the Agentic Document Extraction application with your IdP. Share this with the LandingAI team through a secure channel. |
| Issuer URL | The base URL of your IdP's OIDC configuration, used to locate the OIDC metadata endpoint. <br /><br />**Example**: `https://login.microsoftonline.com/{tenant-id}/v2.0` |
| Scope | The permissions requested from your IdP. At minimum: `openid`, `profile`, `email`. |
| Enterprise email domains | Each email domain that will need access to Agentic Document Extraction. <br /><br />**Example**: acme.com, acme.ai |

### Complete Setup in Your IdP

After the LandingAI team enters your information in the Agentic Document Extraction backend, they will continue coordinating with you to complete the setup.

The LandingAI team will give you the following information to enter in your IdP configuration page:

| Protocol | Item | Description |
| - | - | - |
| SAML 2.0 | Assertion Consumer Service URL | In Microsoft Entra ID, this is called a "Reply URL". <br /><br />**Example**: `https://login.landing.ai/api/authn/...` |
| SAML 2.0 | Audience URI | Also called an "SP Entity ID". <br /><br />**Example**: `https://login.landing.ai/api/enterprise-sso/...` |
| OIDC | Redirect URI (Callback URL) | **Example**: `https://login.landing.ai/callback/1234` |

### Test That SSO Is Working Correctly

After adding the information from the LandingAI team, test that SSO is working correctly:

1. Go to [https://login.landing.ai/sign-in](https://login.landing.ai/sign-in).
2. If you are currently logged in, log out.
3. Click **Continue with Enterprise SSO** and follow the on-screen prompts to log in. If you're unable to log in, send an email to [support@landing.ai](mailto:support@landing.ai).

## View Your SSO Settings

After SSO has successfully been configured, you can view your SSO settings in read-only mode in Agentic Document Extraction:

1. Log in to [https://ade.landing.ai/](https://ade.landing.ai/).
2. Go to the [Organization Settings](https://ade.landing.ai/settings/organization/general) page (to navigate there manually, click your profile icon at the bottom left corner of the page and click **Organization Settings**).
3. In the **Single Sign-On (SSO)** box, click **View Details**. The SSO settings display.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.