> For the complete documentation index, see [llms.txt](https://docs.overleaf.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.overleaf.com/commons/single-sign-on-sso/configuring-sso.md). # Configuring SSO {% hint style="warning" %} If you're not familiar with your organization's Identity Provider (IdP) and SSO setup, make sure someone who has this information is involved in the SSO setup process. {% endhint %} Overleaf Commons provides a standard SAML-based single sign-on (SSO) option which requires your Identity Provider (IdP) to return a small set of SAML attributes to associate users with their Overleaf accounts and verify their participation in the subscription. We're a registered Service Provider in UKAMF. Our SAML metadata is available from UKAMF, other affiliated federations, and [online](https://www.overleaf.com/saml/ukamf/sp/entity). ## Configuration process The SSO configuration process will be explained during your onboarding. You, or someone from your IT team, will be asked to: 1. Configure your IdP with Overleaf's SAML metadata. All authenticated users should be authorized to access the Overleaf application, and the attributes described on this page should be released. 2. Provide your IdP's metadata to the Overleaf onboarding team and identify which attributes will be used. 3. Assist with testing the trust relationship and verifying that the expected attributes are being sent. Once the configuration is complete and tested, the Service Provider side of the configuration is reviewed by the Overleaf engineering team. SSO is then enabled when the subscription itself is enabled. ## Required attributes We ask you to provide attributes as follows: * **A unique, persistent, non-reassigned user identifier**. Typically this is ‘eduPersonPrincipalName’, provided it is unique, persistent, and non-reassigned, but it can be any ID field that meets those requirements. * **An organization/institution email address.** This identifies the user's affiliation in our system and may be used to provide notifications, such as invitations to their collaborators' projects. Usually, this is the ‘mail’ attribute. * **First and last name attributes (optional).** These attributes are used to initialize the user's account information, which can be updated by the user at any time. * **An entitlement attribute (not always required).** The value provided in this attribute can be used to identify users that should be placed on the subscription. ## Authorization and entitlement In almost all cases, all authenticated users should be authorized to access the Overleaf service. This allows users who are not participating in the subscription to continue to access the service but remain on the free plan.\ \ Subscription enrollment can be restricted by defining a user group through your IdP-provided tools. Group membership status can be sent to Overleaf as part of the SAML data during user authentication. ## Updating the SSO Configuration If any updates to the SSO configuration are required, including the provision of new certificates, please [contact Overleaf Support](/commons/intro-to-overleaf-commons.md). --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.overleaf.com/commons/single-sign-on-sso/configuring-sso.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.