# Single Sign-On (SSO)

## Single Sign-On

Single Sign-On (SSO) lets your users authenticate to Tabnine using your existing identity provider (IdP). You can configure SSO using either SAML or OAuth 2.0 / OpenID Connect, depending on what your IdP supports. Each organization can use one of these protocols at a time (SAML or OAuth 2.0, not both).

### How To Configure Single Sign-On

In the Tabnine Admin Console, go to **Settings**, then **General**.

Next, open the <mark style="color:blue;">**Single Sign-On**</mark> section and toggle Enable Single Sign-On (SSO) on.

Then, under **SSO Protocol**, choose either **SAML** or **OAuth 2.0**.

<figure><img src="https://3436682446-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FY2qxVf5VTm3fmwP4B4Gx%2Fuploads%2FmV9KA7FFFAqf9QdAa8zC%2Funknown.jpeg?alt=media&#x26;token=aeab8b6f-a056-4bf9-8755-231a91222157" alt=""><figcaption></figcaption></figure>

{% tabs %}
{% tab title="Configuring SAML" %}
![](https://3436682446-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FY2qxVf5VTm3fmwP4B4Gx%2Fuploads%2FoymYayOQ9AjbPJJkjmrz%2Funknown.png?alt=media\&token=62b2e723-b078-4379-aac4-d4b380cda308)

When **SAML** is selected as your SSO protocol:

1. Copy the **SAML Callback** URL from the Tabnine console.
2. In your IdP (for example Azure AD or Okta), paste this URL into the SAML application as the **Reply URL / Assertion Consumer Service URL (ACS)**.
3. In the Tabnine console, fill in the following **SAML provider parameters** with values from your IdP:

   * **Certificate** – the IdP’s X.509 certificate (Base64‑encoded).
   * **Entry point** – the IdP’s SAML SSO / login URL.
   * **Identifier format** (optional) – the SAML NameID format your IdP uses (for example, email address).
   * **AuthnContext** (optional) – the authentication context class your IdP requires.

   “Identifier format” refers to the name identifier format of the request your IdP expects.\
   “`AuthnContext`” specifies the authentication mechanism and level of assurance the IdP should use.
4. (Optional) Adjust the SAML flags if required by your IdP:
   * **`wantAuthnResponseSigned`**
   * **`wantsAssertionSigned`**
   * **`disableRequestedAuthnContext`**
5. Click **Save**.
   {% endtab %}

{% tab title="Configure OAuth 2.0" %}

### <br>

<figure><img src="https://3436682446-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FY2qxVf5VTm3fmwP4B4Gx%2Fuploads%2FZDl135XRATAR4t8yuP36%2Funknown.png?alt=media&#x26;token=7e5d02bc-1359-4257-a9b6-fd93329f5aab" alt=""><figcaption></figcaption></figure>

When OAuth 2.0 (supported since [6.0.0](https://docs.tabnine.com/main/release-notes#v6.0.0)) is selected as your SSO protocol:

1. Copy the OAuth Redirect URI from the Tabnine console.
2. In your IdP / OAuth provider, paste this URI into the application configuration as the Redirect URI / Callback URL.
3. In the Tabnine console, fill in the following OAuth provider parameters with values from your IdP:

* **Client ID** – the application’s client identifier.
* **Client Secret** – the application’s client secret.
* Auth URL – the authorization endpoint URL (for example, `https://provider.com/oauth/authorize`).
* **Token URL** – the token endpoint URL.
* **User Info URL** – the user info endpoint URL (if your provider uses one).
* **Scopes** (optional) – used when retrieving the user’s identity&#x20;
  * For example, `openid email profile` (used by default) is used when using OpenID Connect.

4. Expand **Advanced Settings** and configure:

<figure><img src="https://3436682446-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FY2qxVf5VTm3fmwP4B4Gx%2Fuploads%2FSybcAHsUgY8ku7pkPR5o%2Fimage.png?alt=media&#x26;token=a926779b-2f32-4ba9-93a6-bdff810ed934" alt=""><figcaption></figcaption></figure>

* **Email Claim** (optional) – the field in the token that contains the user’s email (for example, `email` or `upn`).
* **Name Claim** (optional) – the field that contains the user’s display name (for example, `name`).
* **Resource** (optional) – a resource / audience value if your IdP requires it.
* **Custom CA Cert** (optional) – a Base64‑encoded CA certificate if your IdP uses a custom CA.

5. Click **Save**.
   {% endtab %}
   {% endtabs %}

After saving, test logging in via SSO to make sure the email and name claims map correctly to your Tabnine users.

### <img src="https://3436682446-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FY2qxVf5VTm3fmwP4B4Gx%2Fuploads%2Fgit-blob-9288c7921771207cbb2c42cb9b757df708a0e4fa%2Fazure%20logo.svg?alt=media" alt="" data-size="line"> Use Azure as a SAML IdP

1. Enter <https://portal.azure.com/>.
2. After logging into Azure, go to the **Azure Active Directory** tab.
3. Select **Enterprise applications** service.
4. Choose **New application.**
5. Choose **Create your own application.**
6. Choose **Non-gallery application.** (Integrate any other application you don't find in the gallery.)
7. Name it (for example, "TabnineSSO") and click **Add.**
8. Choose **Setup single sign-on**.
9. Select **SAML-based Sign-on** as the SSO mode.
10. Next, add the Tabnine service provider details to the configuration in Azure. Set the following values in **Identifier (Entity ID)** and **Reply URL (Assertion Consumer Service URL),** replacing **tabnine.customer.com** with your Tabnine cluster domain:\\

    <figure><img src="https://3436682446-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FY2qxVf5VTm3fmwP4B4Gx%2Fuploads%2Fgit-blob-023abca927410cab7f2935d1cfa5a699b05b34b2%2Fsso1%20(1).webp?alt=media" alt=""><figcaption></figcaption></figure>
11. Choose **user.mail** as the value for **Unique User Identifier:**\\

    <figure><img src="https://3436682446-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FY2qxVf5VTm3fmwP4B4Gx%2Fuploads%2Fgit-blob-518ad5719a487cbd67522eae7cbafbdea474ff3a%2Fsso2%20(1).webp?alt=media" alt=""><figcaption></figcaption></figure>
12. In Section 3 - SAML Certificates, choose **Download certificate (Base64).**
13. In Section 4, copy **Login URL** **value** to use in the next step.
14. Finally, make sure the following are checked at the bottom:\
    \&#xNAN;**☑ wantsAssertionSigned** and **☑ disableRequestedAuthnContext**

<figure><img src="https://3436682446-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FY2qxVf5VTm3fmwP4B4Gx%2Fuploads%2Fgit-blob-a32889cb168311f728ba8c6fa2a2229ea8b8fe33%2Fimage.png?alt=media" alt=""><figcaption><p>Be sure to have checked off <strong>☑ wantsAssertionSigned</strong> and <strong>☑ disableRequestedAuthnContext</strong> for Azure configurations</p></figcaption></figure>

### <picture><source srcset="https://3436682446-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FY2qxVf5VTm3fmwP4B4Gx%2Fuploads%2Fgit-blob-5e007ad462944a955a0a5cdeb108fec4f05fbdd4%2FOkta_Aura_White_L.png?alt=media" media="(prefers-color-scheme: dark)"><img src="https://3436682446-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FY2qxVf5VTm3fmwP4B4Gx%2Fuploads%2Fgit-blob-498d994363f704ce6b160eee04153dd8ca5128bb%2Fokta-logo.png?alt=media" alt="" data-size="line"></picture> Use Okta as a SAML IdP

1. Enter your Okta admin panel in **Applications > Create App Integration > SAML2 integration.**
2. Set an App name (e.g., "Tabnine"):\\

   <figure><img src="https://3436682446-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FY2qxVf5VTm3fmwP4B4Gx%2Fuploads%2Fgit-blob-875c72d602f166151fb88395e72c15a8517e148c%2Fsso3%20(1).webp?alt=media" alt=""><figcaption></figcaption></figure>
3. Next, set the following values:\
   \
   **Single sign-on URL:** *https\://**tabnine.customer.com**/auth/sign-in/sso/saml/callback*\
   \
   **Audience URI (SP Entity ID):** *https\://**tabnine.customer.com**/auth/sign-in/sso/saml*\
   \
   **Name ID format:** `EmailAddress`\
   \
   \&#xNAN;*NOTE: Replace **tabnine.customer.com** with your Tabnine cluster domain.*\\

<figure><img src="https://3436682446-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FY2qxVf5VTm3fmwP4B4Gx%2Fuploads%2Fgit-blob-06593635ac1a6a5bbc4b10463ee3e72b575a9e9f%2Fsso4%20(1).webp?alt=media" alt=""><figcaption></figcaption></figure>

4. Choose 🔵 **I'm an Okta customer adding an internal app.**\\

<figure><img src="https://3436682446-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FY2qxVf5VTm3fmwP4B4Gx%2Fuploads%2Fgit-blob-ec3a968a31cdbf657e17c5e46dd1876a6e5cbd9b%2Fsso5%20(1).webp?alt=media" alt=""><figcaption></figcaption></figure>

5. In the created App in Okta ("Tabnine"), Sign on tab, copy **Sign on URL** value and **Signing Certificate** values.