Delete DOC.md
Browse files
DOC.md
DELETED
|
@@ -1,106 +0,0 @@
|
|
| 1 |
-
# How to Configure SAML 2.0 for Hugging Face Enterprise Hub
|
| 2 |
-
|
| 3 |
-

|
| 4 |
-
|
| 5 |
-
---
|
| 6 |
-
|
| 7 |
-
## Prerequisites
|
| 8 |
-
|
| 9 |
-
Before you begin, make sure the following conditions are met:
|
| 10 |
-
|
| 11 |
-
- Your Hugging Face organization must be on an **Enterprise** or **Enterprise Plus** plan to enable SAML-based Single Sign-On (SSO).
|
| 12 |
-
- You must have **administrator privileges** in both your **Okta** organization and your **Hugging Face Enterprise Hub** organization.
|
| 13 |
-
- Your Hugging Face organization must have a unique **Organization Name** and **Organization ID**.
|
| 14 |
-
- These can be found in **Organization Settings → SSO → SAML** in Hugging Face.
|
| 15 |
-
- You need your **Okta Identity Provider (IdP) metadata**, including:
|
| 16 |
-
- **Identity Provider Single Sign-On URL**
|
| 17 |
-
- **X.509 Certificate** (full text including `-----BEGIN CERTIFICATE-----` and `-----END CERTIFICATE-----`)
|
| 18 |
-
- For more information about Hugging Face’s Enterprise SSO, visit the [Hugging Face Enterprise SSO Documentation](https://huggingface.co/docs/hub/en/enterprise-sso).
|
| 19 |
-
|
| 20 |
-
---
|
| 21 |
-
|
| 22 |
-
## Supported Features
|
| 23 |
-
|
| 24 |
-
The Okta / Hugging Face Enterprise Hub SAML integration supports the following features:
|
| 25 |
-
|
| 26 |
-
| Feature | Supported | Description |
|
| 27 |
-
|----------|------------|-------------|
|
| 28 |
-
| **IdP-initiated SSO** | ✅ | Users can sign in directly from the Okta dashboard. |
|
| 29 |
-
| **SP-initiated SSO** | ✅ | Users accessing Hugging Face are redirected to Okta for authentication. |
|
| 30 |
-
| **JIT (Just-In-Time) Provisioning** | ✅ | Accounts are created automatically on first login via SSO. |
|
| 31 |
-
| **Single Logout (SLO)** | ❌ | Not currently supported. |
|
| 32 |
-
|
| 33 |
-
---
|
| 34 |
-
|
| 35 |
-
## Configuration Steps
|
| 36 |
-
|
| 37 |
-
### Step 1 — Add the Hugging Face App from Okta Integration Network (OIN)
|
| 38 |
-
|
| 39 |
-
1. Sign in to your **Okta Admin Console**.
|
| 40 |
-
2. Navigate to **Applications → Browse App Catalog**.
|
| 41 |
-
3. Search for **Hugging Face** and click **Add Integration**.
|
| 42 |
-
|
| 43 |
-
### Step 2 — Configure the Hugging Face App in Okta
|
| 44 |
-
|
| 45 |
-
4. On the **General Settings** page, specify:
|
| 46 |
-
- **Application label:** `Hugging Face`
|
| 47 |
-
- **Organization Name:** Your Hugging Face organization name
|
| 48 |
-
- **Organization ID:** Your Hugging Face organization ID
|
| 49 |
-
*(These values are visible under **Organization Settings → SSO → SAML** in Hugging Face.)*
|
| 50 |
-
|
| 51 |
-

|
| 52 |
-
|
| 53 |
-
5. Click **Next**, verify the sign-on options (username format should be **Email**), and then click **Done**.
|
| 54 |
-
6. Ensure the administrator performing these steps is **assigned** to the Hugging Face app under the **Assignments** tab.
|
| 55 |
-
|
| 56 |
-
### Step 3 — Copy SAML Configuration from Okta
|
| 57 |
-
|
| 58 |
-
7. In the Hugging Face app in Okta, open the **Sign On** tab.
|
| 59 |
-
8. Locate the **SAML 2.0** section and click **View SAML Setup Instructions**.
|
| 60 |
-
9. Copy the following values:
|
| 61 |
-
- **Identity Provider Single Sign-On URL**
|
| 62 |
-
- **X.509 Certificate** — full text including `BEGIN` and `END` certificate markers.
|
| 63 |
-
|
| 64 |
-
### Step 4 — Configure SAML in Hugging Face
|
| 65 |
-
|
| 66 |
-
10. In Hugging Face, go to **Organization Settings → SSO → SAML**.
|
| 67 |
-
11. Enter the values copied from Okta:
|
| 68 |
-
- **Sign On URL:** Paste the Identity Provider Single Sign-On URL.
|
| 69 |
-
- **X.509 Certificate:** Paste the full certificate text.
|
| 70 |
-
12. Click **Update and Test SAML Configuration**.
|
| 71 |
-
13. If the test succeeds, toggle **Enable SAML SSO** to activate SSO for your organization.
|
| 72 |
-
|
| 73 |
-
---
|
| 74 |
-
|
| 75 |
-
## SP-Initiated SSO
|
| 76 |
-
|
| 77 |
-
Hugging Face supports SP-initiated Single Sign-On. To start the login flow directly from Hugging Face:
|
| 78 |
-
|
| 79 |
-
1. Go to [https://huggingface.co/login](https://huggingface.co/login).
|
| 80 |
-
2. Select **Sign in with your Enterprise SSO**.
|
| 81 |
-
3. Enter your **organization name** and click **Continue**.
|
| 82 |
-
4. You’ll be redirected to Okta for authentication, then returned to your Hugging Face workspace.
|
| 83 |
-
|
| 84 |
-
Users can also trigger this flow automatically when trying to access organization content — they’ll see a banner prompting **“Login with SSO”** that redirects them to Okta.
|
| 85 |
-
|
| 86 |
-
---
|
| 87 |
-
|
| 88 |
-
## Notes
|
| 89 |
-
|
| 90 |
-
- This configuration covers **Standard SSO**.
|
| 91 |
-
For **Advanced SSO** (with SCIM user provisioning and advanced network security), see the [Hugging Face Advanced SSO Documentation](https://huggingface.co/docs/hub/en/enterprise-hub-advanced-sso).
|
| 92 |
-
- Make sure that the **Organization Name** and **Organization ID** used in Okta **exactly match** the values in your Hugging Face settings.
|
| 93 |
-
- Once SAML is enabled, access to organization content requires Okta authentication.
|
| 94 |
-
|
| 95 |
-
---
|
| 96 |
-
|
| 97 |
-
## Customer Support Contact
|
| 98 |
-
|
| 99 |
-
If you need help with setup or troubleshooting, contact Hugging Face Enterprise Support:
|
| 100 |
-
|
| 101 |
-
- **Email:** [enterprise-support@huggingface.co](mailto:enterprise-support@huggingface.co)
|
| 102 |
-
- **Documentation:** [https://huggingface.co/docs/hub/en/enterprise-sso](https://huggingface.co/docs/hub/en/enterprise-sso)
|
| 103 |
-
|
| 104 |
-
---
|
| 105 |
-
|
| 106 |
-
© Hugging Face, Inc. All rights reserved.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|