CharlieBoyer HF Staff commited on
Commit
69c239e
·
verified ·
1 Parent(s): e42963e

Delete DOC.md

Browse files
Files changed (1) hide show
  1. DOC.md +0 -106
DOC.md DELETED
@@ -1,106 +0,0 @@
1
- # How to Configure SAML 2.0 for Hugging Face Enterprise Hub
2
-
3
- ![Hugging Face logo](https://huggingface.co/front/assets/huggingface_logo-noborder.svg)
4
-
5
- ---
6
-
7
- ## Prerequisites
8
-
9
- Before you begin, make sure the following conditions are met:
10
-
11
- - Your Hugging Face organization must be on an **Enterprise** or **Enterprise Plus** plan to enable SAML-based Single Sign-On (SSO).
12
- - You must have **administrator privileges** in both your **Okta** organization and your **Hugging Face Enterprise Hub** organization.
13
- - Your Hugging Face organization must have a unique **Organization Name** and **Organization ID**.
14
- - These can be found in **Organization Settings → SSO → SAML** in Hugging Face.
15
- - You need your **Okta Identity Provider (IdP) metadata**, including:
16
- - **Identity Provider Single Sign-On URL**
17
- - **X.509 Certificate** (full text including `-----BEGIN CERTIFICATE-----` and `-----END CERTIFICATE-----`)
18
- - For more information about Hugging Face’s Enterprise SSO, visit the [Hugging Face Enterprise SSO Documentation](https://huggingface.co/docs/hub/en/enterprise-sso).
19
-
20
- ---
21
-
22
- ## Supported Features
23
-
24
- The Okta / Hugging Face Enterprise Hub SAML integration supports the following features:
25
-
26
- | Feature | Supported | Description |
27
- |----------|------------|-------------|
28
- | **IdP-initiated SSO** | ✅ | Users can sign in directly from the Okta dashboard. |
29
- | **SP-initiated SSO** | ✅ | Users accessing Hugging Face are redirected to Okta for authentication. |
30
- | **JIT (Just-In-Time) Provisioning** | ✅ | Accounts are created automatically on first login via SSO. |
31
- | **Single Logout (SLO)** | ❌ | Not currently supported. |
32
-
33
- ---
34
-
35
- ## Configuration Steps
36
-
37
- ### Step 1 — Add the Hugging Face App from Okta Integration Network (OIN)
38
-
39
- 1. Sign in to your **Okta Admin Console**.
40
- 2. Navigate to **Applications → Browse App Catalog**.
41
- 3. Search for **Hugging Face** and click **Add Integration**.
42
-
43
- ### Step 2 — Configure the Hugging Face App in Okta
44
-
45
- 4. On the **General Settings** page, specify:
46
- - **Application label:** `Hugging Face`
47
- - **Organization Name:** Your Hugging Face organization name
48
- - **Organization ID:** Your Hugging Face organization ID
49
- *(These values are visible under **Organization Settings → SSO → SAML** in Hugging Face.)*
50
-
51
- ![Screenshot: Hugging Face SSO settings](/static/images/hf-sso-saml-screenshot.png)
52
-
53
- 5. Click **Next**, verify the sign-on options (username format should be **Email**), and then click **Done**.
54
- 6. Ensure the administrator performing these steps is **assigned** to the Hugging Face app under the **Assignments** tab.
55
-
56
- ### Step 3 — Copy SAML Configuration from Okta
57
-
58
- 7. In the Hugging Face app in Okta, open the **Sign On** tab.
59
- 8. Locate the **SAML 2.0** section and click **View SAML Setup Instructions**.
60
- 9. Copy the following values:
61
- - **Identity Provider Single Sign-On URL**
62
- - **X.509 Certificate** — full text including `BEGIN` and `END` certificate markers.
63
-
64
- ### Step 4 — Configure SAML in Hugging Face
65
-
66
- 10. In Hugging Face, go to **Organization Settings → SSO → SAML**.
67
- 11. Enter the values copied from Okta:
68
- - **Sign On URL:** Paste the Identity Provider Single Sign-On URL.
69
- - **X.509 Certificate:** Paste the full certificate text.
70
- 12. Click **Update and Test SAML Configuration**.
71
- 13. If the test succeeds, toggle **Enable SAML SSO** to activate SSO for your organization.
72
-
73
- ---
74
-
75
- ## SP-Initiated SSO
76
-
77
- Hugging Face supports SP-initiated Single Sign-On. To start the login flow directly from Hugging Face:
78
-
79
- 1. Go to [https://huggingface.co/login](https://huggingface.co/login).
80
- 2. Select **Sign in with your Enterprise SSO**.
81
- 3. Enter your **organization name** and click **Continue**.
82
- 4. You’ll be redirected to Okta for authentication, then returned to your Hugging Face workspace.
83
-
84
- Users can also trigger this flow automatically when trying to access organization content — they’ll see a banner prompting **“Login with SSO”** that redirects them to Okta.
85
-
86
- ---
87
-
88
- ## Notes
89
-
90
- - This configuration covers **Standard SSO**.
91
- For **Advanced SSO** (with SCIM user provisioning and advanced network security), see the [Hugging Face Advanced SSO Documentation](https://huggingface.co/docs/hub/en/enterprise-hub-advanced-sso).
92
- - Make sure that the **Organization Name** and **Organization ID** used in Okta **exactly match** the values in your Hugging Face settings.
93
- - Once SAML is enabled, access to organization content requires Okta authentication.
94
-
95
- ---
96
-
97
- ## Customer Support Contact
98
-
99
- If you need help with setup or troubleshooting, contact Hugging Face Enterprise Support:
100
-
101
- - **Email:** [enterprise-support@huggingface.co](mailto:enterprise-support@huggingface.co)
102
- - **Documentation:** [https://huggingface.co/docs/hub/en/enterprise-sso](https://huggingface.co/docs/hub/en/enterprise-sso)
103
-
104
- ---
105
-
106
- © Hugging Face, Inc. All rights reserved.