How to integrate OpenAI Enterprise with SSO
Quick answer
To integrate
OpenAI Enterprise with SSO, configure your identity provider (IdP) to connect via SAML 2.0 or OIDC with OpenAI's Enterprise console. This enables centralized authentication and secure user access management through your organization's existing SSO system.PREREQUISITES
Access to OpenAI Enterprise admin consoleConfigured Identity Provider (IdP) supporting SAML 2.0 or OIDCAdmin privileges on IdP and OpenAI EnterpriseBasic knowledge of SSO protocols (SAML/OIDC)
Setup OpenAI Enterprise SSO
Start by logging into your OpenAI Enterprise admin console. Navigate to the SSO Settings section to begin configuration. You will need metadata from your Identity Provider (IdP) such as the SAML metadata XML or OIDC discovery URL.
OpenAI supports both SAML 2.0 and OIDC protocols for SSO integration. Choose the protocol your IdP supports.
| Step | Description |
|---|---|
| 1 | Log in to OpenAI Enterprise admin console |
| 2 | Go to SSO Settings |
| 3 | Select SAML or OIDC as your SSO protocol |
| 4 | Upload IdP metadata or enter discovery URL |
| 5 | Configure attribute mappings (email, name, groups) |
| 6 | Save and enable SSO |
Step by step integration example
This example covers SAML 2.0 integration using Okta as the IdP.
import os
import requests
# Example: Fetch SAML metadata from Okta
okta_metadata_url = os.environ.get('OKTA_METADATA_URL')
response = requests.get(okta_metadata_url)
if response.status_code == 200:
saml_metadata_xml = response.text
print('Fetched Okta SAML metadata successfully')
else:
print('Failed to fetch metadata')
# In OpenAI Enterprise admin console:
# 1. Upload this SAML metadata XML
# 2. Map SAML attributes to OpenAI user fields (email, name)
# 3. Enable SSO
print('SSO integration setup complete') output
Fetched Okta SAML metadata successfully SSO integration setup complete
Common variations
- OIDC integration: Use your IdP's OIDC discovery URL in OpenAI Enterprise SSO settings instead of SAML metadata.
- Attribute mapping: Customize user attributes such as
email,name, andgroupsto control access and roles. - Testing: Use test users in your IdP to verify SSO login before rolling out to all users.
Troubleshooting tips
- If users cannot log in, verify that the IdP metadata or discovery URL is correct and accessible.
- Check that attribute mappings match the IdP's claims exactly (case-sensitive).
- Ensure your IdP's certificate is valid and not expired for SAML.
- Review OpenAI Enterprise logs for authentication errors.
- Contact OpenAI Enterprise support for assistance with complex SSO setups.
Key Takeaways
- Configure SSO in OpenAI Enterprise admin console using SAML or OIDC metadata from your IdP.
- Map user attributes precisely to enable seamless authentication and role assignment.
- Test SSO integration with a small user group before full deployment.
- Troubleshoot by verifying metadata, certificates, and attribute mappings carefully.