> ## Documentation Index
> Fetch the complete documentation index at: https://hc.starbridge.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Configure single sign-on (SSO)

## Overview

SAML SSO lets your organization centrally manage authentication and user access. Once enabled, users will authenticate through your identity provider, such as Okta, Azure AD, OneLogin, Ping, or any SAML-compatible system.

Starbridge supports both **SP-initiated** and **IdP-initiated** login:

* **SP-initiated login** — Users start at the Starbridge login page and are redirected to your identity provider to authenticate.
* **IdP-initiated login** — Users start from your identity provider's app portal (for example, the Okta dashboard or Azure My Apps) and are signed directly into Starbridge without visiting the login page first.

No additional configuration is required to enable IdP-initiated login. Once SSO is configured, both login flows work automatically.

You'll be asked to copy values from your identity provider (IdP) into Starbridge. After you save the configuration, Starbridge will display the remaining values you need to paste back into your IdP to complete the connection.

<Steps>
  <Step title="Choose your authentication mode">
    In **Authentication Mode**, choose how your users should authenticate going forward:

    <Tabs>
      <Tab title="Password-only">
        Users sign in using only their Starbridge password. SSO is disabled.
      </Tab>

      <Tab title="SSO required">
        Everyone must log in through your identity provider.

        * Password logins will be disabled
        * Ensures centralized access control and improved security
      </Tab>

      <Tab title="SSO + password">
        Users can choose whether to log in with SSO or with their Starbridge password.

        <Tip>
          This mode is helpful for testing before enforcing SSO, and for phased rollouts.
        </Tip>
      </Tab>
    </Tabs>
  </Step>

  <Step title="Enter your identity provider (IdP) details">
    Your IdP will provide two pieces of information that must be entered into Starbridge.

    **Sign-in URL**

    This is your IdP's SAML login endpoint (often called the "SSO URL," "Login URL," or "Identity Provider SSO URL"). Paste the full URL from your identity provider.

    **X.509 certificate**

    Paste the X.509 certificate provided by your IdP. This certificate is used to verify signed SAML responses returned by your identity provider.

    <Tip>
      Copy only the certificate text, including the `----BEGIN CERTIFICATE-----` and `----END CERTIFICATE-----` lines. If your IdP provides multiple certificates, use the active signing certificate.
    </Tip>
  </Step>

  <Step title="Save your configuration">
    After pasting your Sign-in URL and X.509 certificate, click **Save**.

    If the settings validate successfully, Starbridge will display the remaining values your IdP needs to complete the SSO connection.
  </Step>

  <Step title="Copy Starbridge values back to your IdP">
    Starbridge will display your application-specific SAML details, including:

    * Domain
    * **Entity ID**
    * **SSO URL**

    Copy these values into your identity provider's SAML configuration, then follow your IdP's prompts to finalize.
  </Step>

  <Step title="Test your SSO connection">
    Test logging in with SSO. If your IdP supports IdP-initiated login, also verify that clicking the Starbridge app tile in your IdP's portal signs you in successfully.

    <Warning>
      We strongly recommend testing before enforcing SSO for all users.
    </Warning>
  </Step>
</Steps>

## Need help?

If you need assistance configuring your identity provider or troubleshooting SSO, contact [**support@starbridge.ai**](mailto:support@starbridge.ai) and include:

* Your IdP (Okta, Azure AD, etc.)
* A screenshot of your SAML configuration
* The error message seen during login (if any)

## Related articles

<CardGroup cols={2}>
  <Card title="Set up users, roles, and teams" icon="users" href="/admins/adding-new-users-configuring-roles-and-teams-s">
    Add users, assign roles, and create teams after enabling SSO.
  </Card>

  <Card title="Setting up your Organization Profile" icon="building" href="/admins/organization-business-context">
    Configure your org context so Starbridge personalizes signals and AI features correctly.
  </Card>
</CardGroup>