Skip to main content

Step-by-Step Guide to SSO Integration with Your Platform

Abubakar Saad
Updated

Summary

This guide walks you through integrating Single Sign-On (SSO) with Label Studio Enterprise via SAML 2.0. You’ll copy Service Provider (SP) endpoints from Label Studio, configure your Identity Provider (IdP) such as Okta, Google SAML, Ping, OneLogin, or Microsoft AD, map the required user attributes and groups, upload IdP metadata back to Label Studio, and test the login flow. Optional steps cover enforcing SSO-only access, and automating user/group provisioning with SCIM 2.0. Links are included for IdP-specific examples, SCIM setup, and user management

Step-by-Step Guide to SSO Integration

  1. Confirm edition and permissions
  • SSO is available in Label Studio Enterprise only. Log in with an Owner or Administrator account.
  • Reference: Set up SSO authentication
  1. Decide your IdP and group strategy
  • Supported SAML 2.0 IdPs: Okta, Google SAML, Ping, OneLogin, Microsoft Active Directory, and others using SAML assertions.
  • Plan which IdP groups will map to Organization roles, Workspaces, and Project roles.
  • References: Set up SSO authentication, User management overview
  1. Get SP details from Label Studio
  • In Label Studio: Organization → SSO & SAML. Copy:
    • Assertion Consumer Service (ACS) URL (with Audience/EntityID and Recipient/Reply details)
    • Login URL
    • Logout URL
  • Ensure the Organization domain matches your IdP domain(s).
  • Reference: Set up SSO authentication
  1. Create a SAML app in your IdP
  • For Okta, Ping, Microsoft AD, OneLogin, etc.: add a SAML 2.0 application and paste ACS/Audience details from Label Studio.
  • Google SAML specifics: use the ACS URL for both ACS and Entity ID; leave “Signed Response” unchecked, then map attributes.
  • References: Set up SSO authentication, Google SAML example, Ping Identity example
  1. Map SAML attributes (required) / For Azure EntraiD, make sure to include the Group Claims URL Example: (http://schemas.microsoft.com/{param}/2008/06/identity/claims/groups) :  under Groups section for appropriate configuration
  • Email → Email
  • First name → FirstName
  • Last name → LastName
  • Group name(s) → Groups/ example: http://schemas.microsoft.com/{param}/2008/06/identity/claims/groups
  • Ensure your IdP sends these attributes in the assertion.
  • Reference: Set up SSO authentication
  1. Upload IdP metadata to Label Studio
  • In Organization → SSO & SAML, upload your IdP metadata XML or provide the metadata URL.
  • Reference: Set up SSO authentication
  1. Map groups to access in Label Studio
  • Configure:
    • Organization Roles to Groups Mapping (e.g., Admin, Manager, Reviewer, Annotator)
    • Workspaces to Groups Mapping (membership visibility)
    • Projects to Groups Mapping (Annotator/Reviewer/Inherit)
  • Group names must exactly match what your IdP sends.
  • Reference: Set up SSO authentication
  1. Test the login flow
  • From the Label Studio login page, choose SSO Login, enter your domain if prompted, authenticate in the IdP, and verify roles/workspace visibility after redirect.
  • Reference: Set up SSO authentication
  1. (Optional) Enforce SSO-only and manage access via SSO
  • Self-managed deployments: to manage access only via SSO and disable manual assignment, set environment variables:
MANUAL_PROJECT_MEMBER_MANAGEMENT=0
MANUAL_WORKSPACE_MANAGEMENT=0
MANUAL_ROLE_MANAGEMENT=0
  1. (Optional) Automate provisioning with SCIM 2.0
  • SCIM requires SSO configured first. In your IdP (example: Okta), enable SCIM provisioning:
    • SCIM base URL: https://<YOUR_LSE_BASE_URL>/scim/v2/
    • Unique identifier for users: use email (not userName)
    • HTTP header: Authorization: Bearer <OWNER_ACCESS_TOKEN> (must use Bearer; only the Owner’s token is valid)
    • Supported actions: Import/Pull users, Push new users, Push updates, Push Groups
  • Then in Label Studio Organization → SCIM, map roles/workspaces/projects to groups.
  • Reference: SCIM setup
  1. Assign and sync users/groups in the IdP
  • Assign the Label Studio app to people and/or groups in your IdP.
  • For Okta, also use Push Groups to create/link groups in Label Studio and sync memberships.
  • Reference: SCIM setup
  1. Ongoing administration
  • Prefer managing access through IdP groups and (optionally) SCIM.
  • Users in “Not Activated” or “Deactivated” states do not count towards seats.
  • References: SCIM setup, User management overview

Tips

  • If SSO succeeds at the IdP but fails in Label Studio, verify you uploaded the IdP metadata and that attribute names configured in Label Studio match what your IdP sends.
  • For Google SAML, re-check the ACS/Entity ID choices and attribute mapping steps.
  • For SCIM with Okta, use email as the unique identifier and the Owner’s Bearer token in the header.
  • References: SSO setup, Google SAML example, SCIM setup 

Setting up your SSO SAML using Entra ID 
 

Label Studio doesn’t care if the claim is called Groups, groups, or a long URI — it just needs to match whatever SAML Attribute Name your IdP actually sends.With Microsoft Entra ID (ex-Azure AD), when you “Add groups claim” and do not tick “Customize the name of the group claim”, Entra uses the default SAML attribute name:
 
http://schemas.microsoft.com/ws/2008/06/identity/claims/groups
 
This is the technical claim type URI, and it’s what appears in the SAML assertion as the Attribute Name. Many products (Sysdig, Jira, etc.) explicitly document that if you don’t customize the name, you must use this exact URI on the SP side as the “group attribute name”. Sysdig Docs+1Entra can send group claims in several ways (by object ID, sAMAccountName, display name), but whatever you choose, they all come under that claim type unless you override it. Microsoft LearnLabel Studio Enterprise docs show Groups in the SAML attributes table simply as a conventional name for “the attribute that contains groups”. For IdPs like Ping, Okta, etc., you often configure a friendly attribute called Groups or groups. For Entra, the default is the URI, so LSE must be configured to use the URI, otherwise it won’t see any groups.
You can instead tell Entra to rename the claim to groups/Groups by enabling “Customize the name of the group claim”; then LSE can stay with Groups and not use the URI. devinsight.ai+1
So:
 


 

Related to

Related articles