Delete DOC.md
Browse files
    	
        DOC.md
    DELETED
    
    | @@ -1,106 +0,0 @@ | |
| 1 | 
            -
            # How to Configure SAML 2.0 for Hugging Face Enterprise Hub
         | 
| 2 | 
            -
             | 
| 3 | 
            -
            
         | 
| 4 | 
            -
             | 
| 5 | 
            -
            ---
         | 
| 6 | 
            -
             | 
| 7 | 
            -
            ## Prerequisites
         | 
| 8 | 
            -
             | 
| 9 | 
            -
            Before you begin, make sure the following conditions are met:
         | 
| 10 | 
            -
             | 
| 11 | 
            -
            - Your Hugging Face organization must be on an **Enterprise** or **Enterprise Plus** plan to enable SAML-based Single Sign-On (SSO).  
         | 
| 12 | 
            -
            - You must have **administrator privileges** in both your **Okta** organization and your **Hugging Face Enterprise Hub** organization.  
         | 
| 13 | 
            -
            - Your Hugging Face organization must have a unique **Organization Name** and **Organization ID**.  
         | 
| 14 | 
            -
              - These can be found in **Organization Settings → SSO → SAML** in Hugging Face.  
         | 
| 15 | 
            -
            - You need your **Okta Identity Provider (IdP) metadata**, including:
         | 
| 16 | 
            -
              - **Identity Provider Single Sign-On URL**
         | 
| 17 | 
            -
              - **X.509 Certificate** (full text including `-----BEGIN CERTIFICATE-----` and `-----END CERTIFICATE-----`)
         | 
| 18 | 
            -
            - For more information about Hugging Face’s Enterprise SSO, visit the [Hugging Face Enterprise SSO Documentation](https://huggingface.co/docs/hub/en/enterprise-sso).
         | 
| 19 | 
            -
             | 
| 20 | 
            -
            ---
         | 
| 21 | 
            -
             | 
| 22 | 
            -
            ## Supported Features
         | 
| 23 | 
            -
             | 
| 24 | 
            -
            The Okta / Hugging Face Enterprise Hub SAML integration supports the following features:
         | 
| 25 | 
            -
             | 
| 26 | 
            -
            | Feature | Supported | Description |
         | 
| 27 | 
            -
            |----------|------------|-------------|
         | 
| 28 | 
            -
            | **IdP-initiated SSO** | ✅ | Users can sign in directly from the Okta dashboard. |
         | 
| 29 | 
            -
            | **SP-initiated SSO** | ✅ | Users accessing Hugging Face are redirected to Okta for authentication. |
         | 
| 30 | 
            -
            | **JIT (Just-In-Time) Provisioning** | ✅ | Accounts are created automatically on first login via SSO. |
         | 
| 31 | 
            -
            | **Single Logout (SLO)** | ❌ | Not currently supported. |
         | 
| 32 | 
            -
             | 
| 33 | 
            -
            ---
         | 
| 34 | 
            -
             | 
| 35 | 
            -
            ## Configuration Steps
         | 
| 36 | 
            -
             | 
| 37 | 
            -
            ### Step 1 — Add the Hugging Face App from Okta Integration Network (OIN)
         | 
| 38 | 
            -
             | 
| 39 | 
            -
            1. Sign in to your **Okta Admin Console**.  
         | 
| 40 | 
            -
            2. Navigate to **Applications → Browse App Catalog**.  
         | 
| 41 | 
            -
            3. Search for **Hugging Face** and click **Add Integration**.
         | 
| 42 | 
            -
             | 
| 43 | 
            -
            ### Step 2 — Configure the Hugging Face App in Okta
         | 
| 44 | 
            -
             | 
| 45 | 
            -
            4. On the **General Settings** page, specify:
         | 
| 46 | 
            -
               - **Application label:** `Hugging Face`
         | 
| 47 | 
            -
               - **Organization Name:** Your Hugging Face organization name
         | 
| 48 | 
            -
               - **Organization ID:** Your Hugging Face organization ID  
         | 
| 49 | 
            -
               *(These values are visible under **Organization Settings → SSO → SAML** in Hugging Face.)*
         | 
| 50 | 
            -
             | 
| 51 | 
            -
               
         | 
| 52 | 
            -
             | 
| 53 | 
            -
            5. Click **Next**, verify the sign-on options (username format should be **Email**), and then click **Done**.  
         | 
| 54 | 
            -
            6. Ensure the administrator performing these steps is **assigned** to the Hugging Face app under the **Assignments** tab.
         | 
| 55 | 
            -
             | 
| 56 | 
            -
            ### Step 3 — Copy SAML Configuration from Okta
         | 
| 57 | 
            -
             | 
| 58 | 
            -
            7. In the Hugging Face app in Okta, open the **Sign On** tab.  
         | 
| 59 | 
            -
            8. Locate the **SAML 2.0** section and click **View SAML Setup Instructions**.  
         | 
| 60 | 
            -
            9. Copy the following values:
         | 
| 61 | 
            -
               - **Identity Provider Single Sign-On URL**
         | 
| 62 | 
            -
               - **X.509 Certificate** — full text including `BEGIN` and `END` certificate markers.
         | 
| 63 | 
            -
             | 
| 64 | 
            -
            ### Step 4 — Configure SAML in Hugging Face
         | 
| 65 | 
            -
             | 
| 66 | 
            -
            10. In Hugging Face, go to **Organization Settings → SSO → SAML**.  
         | 
| 67 | 
            -
            11. Enter the values copied from Okta:
         | 
| 68 | 
            -
                - **Sign On URL:** Paste the Identity Provider Single Sign-On URL.  
         | 
| 69 | 
            -
                - **X.509 Certificate:** Paste the full certificate text.  
         | 
| 70 | 
            -
            12. Click **Update and Test SAML Configuration**.  
         | 
| 71 | 
            -
            13. If the test succeeds, toggle **Enable SAML SSO** to activate SSO for your organization.
         | 
| 72 | 
            -
             | 
| 73 | 
            -
            ---
         | 
| 74 | 
            -
             | 
| 75 | 
            -
            ## SP-Initiated SSO
         | 
| 76 | 
            -
             | 
| 77 | 
            -
            Hugging Face supports SP-initiated Single Sign-On. To start the login flow directly from Hugging Face:
         | 
| 78 | 
            -
             | 
| 79 | 
            -
            1. Go to [https://huggingface.co/login](https://huggingface.co/login).  
         | 
| 80 | 
            -
            2. Select **Sign in with your Enterprise SSO**.  
         | 
| 81 | 
            -
            3. Enter your **organization name** and click **Continue**.  
         | 
| 82 | 
            -
            4. You’ll be redirected to Okta for authentication, then returned to your Hugging Face workspace.
         | 
| 83 | 
            -
             | 
| 84 | 
            -
            Users can also trigger this flow automatically when trying to access organization content — they’ll see a banner prompting **“Login with SSO”** that redirects them to Okta.
         | 
| 85 | 
            -
             | 
| 86 | 
            -
            ---
         | 
| 87 | 
            -
             | 
| 88 | 
            -
            ## Notes
         | 
| 89 | 
            -
             | 
| 90 | 
            -
            - This configuration covers **Standard SSO**.  
         | 
| 91 | 
            -
              For **Advanced SSO** (with SCIM user provisioning and advanced network security), see the [Hugging Face Advanced SSO Documentation](https://huggingface.co/docs/hub/en/enterprise-hub-advanced-sso).  
         | 
| 92 | 
            -
            - Make sure that the **Organization Name** and **Organization ID** used in Okta **exactly match** the values in your Hugging Face settings.  
         | 
| 93 | 
            -
            - Once SAML is enabled, access to organization content requires Okta authentication.
         | 
| 94 | 
            -
             | 
| 95 | 
            -
            ---
         | 
| 96 | 
            -
             | 
| 97 | 
            -
            ## Customer Support Contact
         | 
| 98 | 
            -
             | 
| 99 | 
            -
            If you need help with setup or troubleshooting, contact Hugging Face Enterprise Support:
         | 
| 100 | 
            -
             | 
| 101 | 
            -
            - **Email:** [enterprise-support@huggingface.co](mailto:enterprise-support@huggingface.co)  
         | 
| 102 | 
            -
            - **Documentation:** [https://huggingface.co/docs/hub/en/enterprise-sso](https://huggingface.co/docs/hub/en/enterprise-sso)
         | 
| 103 | 
            -
             | 
| 104 | 
            -
            ---
         | 
| 105 | 
            -
             | 
| 106 | 
            -
            © Hugging Face, Inc. All rights reserved.
         | 
|  | |
|  | |
|  | |
|  | |
|  | |
|  | |
|  | |
|  | |
|  | |
|  | |
|  | |
|  | |
|  | |
|  | |
|  | |
|  | |
|  | |
|  | |
|  | |
|  | |
|  | |
|  | |
|  | |
|  | |
|  | |
|  | |
|  | |
|  | |
|  | |
|  | |
|  | |
|  | |
|  | |
|  | |
|  | |
|  | |
|  | |
|  | |
|  | |
|  | |
|  | |
|  | |
|  | |
|  | |
|  | |
|  | |
|  | |
|  | |
|  | |
|  | |
|  | |
|  | |
|  | |
|  | |
|  | |
|  | |
|  | |
|  | |
|  | |
|  | |
|  | |
|  | |
|  | |
|  | |
|  | |
|  | |
|  | |
|  | |
|  | |
|  | |
|  | |
|  | |
|  | |
|  | |
|  | |
|  | |
|  | |
|  | |
|  | |
|  | |
|  | |
|  | |
|  | |
|  | |
|  | |
|  | |
|  | |
|  | |
|  | |
|  | |
|  | |
|  | |
|  | |
|  | |
|  | |
|  | |
|  | |
|  | |
|  | |
|  | |
|  | |
|  | |
|  | |
|  | |
|  | |
|  | |
|  | 

