> ## Documentation Index > Fetch the complete documentation index at: https://docs.usecompiler.com/llms.txt > Use this file to discover all available pages before exploring further. # Single sign-on > Let people sign in to Compiler through your identity provider with SAML. This guide connects your self-hosted instance to an identity provider over SAML 2.0, so people sign in with their company account instead of a Compiler password. It works with any SAML identity provider, such as Okta, Microsoft Entra ID, Google Workspace, OneLogin or JumpCloud. You set it up in **Settings** > **Security** > **SAML**. Nothing goes in environment variables, and nothing needs a restart. ## Prerequisites * You're an owner or admin of your instance's first organization. Single sign-on applies to everyone on the instance, so only that organization's admins can manage it. * You can create a SAML app in your identity provider, or someone who can is helping you. * `PUBLIC_URL` is set to the address people use to reach your instance, such as `https://compiler.yourdomain.com`. Compiler builds the addresses your identity provider needs from it. Your identity provider doesn't need to reach your instance, because the browser carries every sign-in to it. ## How it works * People click **Continue with SAML SSO** on the login page, or open Compiler from their identity provider's dashboard. Both work. * Compiler identifies people by email address, so the identity provider must send it. See [Step 1](#step-1-create-the-saml-app-in-your-identity-provider). * The first time someone signs in, Compiler creates their account and adds them to the organization as a member. If they were invited with a different role, they get that role instead. * Compiler accepts a SAML response only once and only for a few minutes, and the assertion must be signed. ## Step 1: Create the SAML app in your identity provider In your identity provider's admin console, create a new SAML 2.0 app, sometimes called a custom or non-gallery app. Fill it in from **Settings** > **Security** > **SAML** in Compiler, where each value has a **Copy** button. If your identity provider can import service provider metadata, click **Download** next to **Metadata** and upload the file instead. | Setting | Value | Your identity provider may call it | | - | - | - | | Assertion consumer service URL | Compiler's **ACS URL**, such as `https://compiler.yourdomain.com/auth/saml/callback` | Single sign-on URL, Reply URL, ACS URL | | Entity ID | Compiler's **Entity ID or audience**, such as `https://compiler.yourdomain.com/auth/saml/metadata` | Audience URI, Identifier, SP Entity ID | | Name ID | The person's email address, in the `EmailAddress` format | Name ID format, Application username, Unique user identifier | | Assertion signing | Signed. Most identity providers sign assertions by default. | Assertion signature, Signing option | | Name attribute | An attribute named `displayName` holding the person's full name. Most identity providers don't send one until you add it. Without it, people appear in Compiler as the part of their email address before the `@`. | Attribute statement, Attribute mapping, Claim | Leave the relay state blank. If the Name ID can't be the email address, send the email address as an attribute named `email` instead. ## Step 2: Assign people In your identity provider, assign the people or groups who should use Compiler to the app. People who aren't assigned can't sign in through it. ## Step 3: Give Compiler the identity provider's details Your identity provider shows three values once the app is created, often on a page called setup instructions or SAML metadata. Copy them into **Settings** > **Security** > **SAML** in Compiler and click **Save**: | Compiler field | Value | Your identity provider may call it | | - | - | - | | **Provider name** | Any label, such as the identity provider's name | | | **Entity ID or issuer** | The identity provider's entity ID | Issuer, Identity Provider Issuer, Entity ID | | **SSO URL** | The address Compiler sends people to for signing in | Single Sign-On URL, Login URL, SSO URL | | **Certificate** | The signing certificate in PEM format, including the `-----BEGIN CERTIFICATE-----` and `-----END CERTIFICATE-----` lines | X.509 certificate, Signing certificate, Certificate (Base64) | ## Step 4: Turn on single sign-on 1. Go back to **Settings** > **Security**. 2. Under **Authentication methods**, turn on **Single sign-on**. 3. In a private browser window, open Compiler and click **Continue with SAML SSO**. Your identity provider signs you in and sends you back to Compiler. ## Turn off password sign-in Once single sign-on works, you can make everyone use it. In **Settings** > **Security**, turn off **Password sign-in**. The login page then shows only **Continue with SAML SSO**, and Compiler refuses passwords for every account on the instance. > [!WARNING] > > Make sure your own account can sign in through your identity provider first. With password sign-in off, an admin who isn't assigned to the SAML app can't sign in. To turn password sign-in back on, an admin signs in through single sign-on and turns it on again. One of the two methods always stays on. ## Remove someone's access Removing someone from the SAML app in your identity provider stops them signing in again, but doesn't remove them from Compiler. A session they already have keeps working until it expires. To remove someone straight away, also remove them in **Settings** > **Members**. ## Rotate the certificate When your identity provider's signing certificate changes, paste the new certificate into **Settings** > **Security** > **SAML** and click **Save**. Compiler trusts one certificate at a time, so sign-ins fail between the identity provider switching certificates and you saving the new one. Do both within a few minutes of each other. ## Troubleshooting | Message on the login page | What to check | | - | - | | **SSO authentication failed** | The **Entity ID or issuer** and **Certificate** in Compiler match your identity provider exactly, the identity provider's audience matches Compiler's **Entity ID or audience**, and the assertion is signed. Also check that the clocks on your instance and identity provider are correct, since Compiler refuses responses more than a few minutes old. | | **Your account is not authorized to access this application** | The person already belongs to another organization on this instance. Only members of the first organization can sign in through single sign-on. | | **SSO is not configured for this organization** | **Single sign-on** is turned on under **Settings** > **Security**. | If your identity provider shows an error before sending you back to Compiler, check that the person is assigned to the app and that its assertion consumer service URL matches Compiler's **ACS URL**, including `https`. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.