> ## Documentation Index
> Fetch the complete documentation index at: https://documentation.kodelabs.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Configure Single Sign-On (SSO)

> Set up SSO with OIDC or SAML

SSO lets users sign in to Launchpad through their organization's identity provider instead of separate KODE Labs credentials. Launchpad supports OIDC and SAML, with pre-built integrations for several identity providers. You configure sign-in methods from **Sign In Methods** in the sidebar.

## Benefits of Single Sign-On

SSO simplifies the sign-in experience by eliminating the need to manage separate credentials for each platform. Users authenticate once through their organization's identity provider and gain access to Launchpad and other connected applications without repeated logins. This reduces password-related support requests and frees IT teams to focus on higher-priority work.

* Centralized authentication through your existing identity provider
* Reduced credential fatigue, as users rely on one set of credentials across platforms
* Stronger security posture by enforcing your organization's authentication policies
* Simplified user management, with user provisioning and de-provisioning handled through your IdP
* Fewer password-related support tickets for IT teams

## Supported Sign-in Methods

Launchpad supports SSO through the following authentication protocols.

* **OpenID Connect (OIDC)** -- a modern authentication protocol commonly used for web and mobile applications.
* **Security Assertion Markup Language (SAML)** -- an XML-based protocol widely adopted for enterprise SSO across web applications.

KODE Labs has integrated with the following identity providers:

* `CyberArk`
* `Azure Active Directory (Azure AD)`
* `Okta`
* `Auth0`
* `JumpCloud`

<Note>
  You can also configure a custom OIDC or SAML integration with any IdP that supports these protocols.
</Note>

## Configuration

Setting up SSO requires configuring a sign-in method in Launchpad and connecting the corresponding application in your identity provider. You complete both from a single form in Launchpad.

<Info>
  Before you begin, verify that you have an admin role in your Launchpad workspace and access to your identity provider's configuration settings.
</Info>

<Tabs>
  <Tab title="OIDC">
    <Steps>
      <Step title="Open sign-in methods">
        In the Launchpad sidebar, click **Sign In Methods**, then click **+ Add Sign in Method**. Select one of the pre-configured identity providers that uses OIDC, or choose a custom OIDC configuration if your provider is not listed.
      </Step>

      <Step title="Copy callback URL">
        Launchpad generates an **Authentication Callback URL** at the top of the form. Copy this value -- you need to enter it in your IdP as the Redirect URL or Callback URL.

        <ParamField path="Authentication Callback URL" type="Field">
          The callback endpoint your IdP redirects users to after authentication. This value is auto-generated and read-only.
        </ParamField>
      </Step>

      <Step title="Name sign-in method">
        In the **Sign In Method Name** field, enter a unique name for this method. You can optionally upload an IdP picture.

        <Warning>
          The sign-in method name cannot be changed after you save it.
        </Warning>
      </Step>

      <Step title="Set up app in IdP">
        Log in to your identity provider and create a new application for KODE Labs. Provide the Authentication Callback URL you copied from Launchpad. After configuring the application, your IdP provides the values needed for the next step.
      </Step>

      <Step title="Enter IdP details">
        Back in the Launchpad form, enter the following values from your IdP:

        <ParamField path="OpenID Well-known URL" type="Field">
          The OpenID Connect discovery endpoint provided by your IdP (typically ending in `/.well-known/openid-configuration`).
        </ParamField>

        <ParamField path="Client ID" type="Field">
          The unique identifier your IdP assigned to the KODE Labs application.
        </ParamField>

        <ParamField path="Client Secret" type="Field">
          The secret key your IdP generated for this application.
        </ParamField>
      </Step>

      <Step title="Configure email claim">
        Under **Claim configuration for email**, verify that the **Email** field is set to the claim your IdP uses for email addresses (defaults to `email`).
      </Step>

      <Step title="Save">
        Optionally check **Set as default Sign In Method** if you want this to be the primary sign-in option for your organization. Click **Save**.
      </Step>
    </Steps>
  </Tab>

  <Tab title="SAML">
    <Steps>
      <Step title="Open sign-in methods">
        In the Launchpad sidebar, click **Sign In Methods**, then click **+ Add Sign in Method**. Select one of the pre-configured identity providers that uses SAML, or choose a custom SAML configuration if your provider is not listed.
      </Step>

      <Step title="Copy generated values">
        Launchpad generates several values at the top of the form. Copy or download these -- you need them when configuring the application in your IdP.

        <ParamField path="Assertion Consumer Service URL" type="Field">
          The endpoint where your IdP sends SAML responses after authentication. Copy this into your IdP's ACS URL field.
        </ParamField>

        <ParamField path="SP Certificate" type="Field">
          The service provider certificate (`x509Certificate.pem`). Click **Download** to save it.
        </ParamField>
      </Step>

      <Step title="Name sign-in method">
        In the **Sign In Method Name** field, enter a unique name for this method. You can optionally upload an IdP picture.

        <Warning>
          The sign-in method name cannot be changed after you save it.
        </Warning>
      </Step>

      <Step title="Review pre-configured fields">
        The following fields are pre-configured in Launchpad and must match the corresponding values in your IdP:

        <ParamField path="SP Entity ID" type="Field">
          The unique identifier for Launchpad as a service provider.
        </ParamField>

        <ParamField path="SAML Subject NameID Format" type="Field">
          The format used to identify users. Pre-set to EmailAddress.
        </ParamField>

        <ParamField path="Signature Algorithm" type="Field">
          The algorithm used to sign SAML assertions. Pre-set to RSA-SHA256.
        </ParamField>

        <ParamField path="Protocol Binding" type="Field">
          The transport method for SAML messages. Pre-set to HTTP-POST.
        </ParamField>

        <ParamField path="Sign Request" type="Toggle">
          When enabled, Launchpad signs outgoing SAML requests. Disabled by default.
        </ParamField>
      </Step>

      <Step title="Set up app in IdP">
        Log in to your identity provider and create a new application for KODE Labs. Provide the Assertion Consumer Service URL, SP Entity ID, NameID Format, Signature Algorithm, and Protocol Binding values from the Launchpad form. Configure attribute mapping in your IdP for `firstName`, `lastName`, and optionally `roles` to synchronize role assignments.
      </Step>

      <Step title="Enter IdP details">
        Back in the Launchpad form, you can either upload a metadata XML file to autofill the fields below, or enter them manually:

        <ParamField path="Upload MetaData" type="Field">
          Upload your IdP's metadata XML file to autofill the IdP URL, IdP Entity ID, and Certificate fields.
        </ParamField>

        <ParamField path="IdP URL" type="Field">
          The SSO endpoint provided by your IdP for SAML authentication.
        </ParamField>

        <ParamField path="IdP Entity ID" type="Field">
          The unique identifier for your identity provider.
        </ParamField>

        <ParamField path="Certificate" type="Field">
          The public certificate your IdP uses to sign SAML assertions. Upload a `.pem` or `.der` file.
        </ParamField>
      </Step>

      <Step title="Configure email claim">
        Under **Claim configuration for email**, enter the attribute your IdP uses for email addresses in the **Email** field.
      </Step>

      <Step title="Save">
        Optionally check **Set as default Sign In Method** if you want this to be the primary sign-in option for your organization. Click **Save**.
      </Step>
    </Steps>
  </Tab>
</Tabs>