Skip to content

Commit 0c55787

Browse files
authored
docs: Add more about entra id and saml mappings (#9214)
1 parent 69a1675 commit 0c55787

File tree

1 file changed

+30
-2
lines changed

1 file changed

+30
-2
lines changed

docs/source/guide/auth_setup.md

Lines changed: 30 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,8 @@ The organization Owner or Administrator for Label Studio Enterprise can set up S
2727
- [Google SAML](google_saml.html)
2828
- [Ping Federate and Ping Identity SAML SSO Setup Example](pingone.html)
2929
- OneLogin
30-
- Microsoft Active Directory
30+
- Microsoft Entra ID (formerly Azure Active Directory, Azure AD)
31+
- Auth0
3132
- Others that use SAML assertions
3233

3334
After setting up the SSO, you can use native authentication to access the Label Studio UI, however it's not a recommended option especially for the user with the Owner role.
@@ -63,13 +64,40 @@ The details will vary depending on your IdP, but in general you will complete th
6364
2. Generate a metadata XML file, or a URL that specifies the metadata for the IdP.
6465
3. Set up or confirm setup of the following SAML attributes. Label Studio Enterprise expects specific attribute mappings for user identities.
6566

66-
| Data | Required Attribute |
67+
**The default attribute names are:**
68+
69+
| Data | Default Attribute |
6770
| --- | --- |
6871
| Email address | Email |
6972
| First or given name | FirstName |
7073
| Last or family name | LastName |
7174
| Group name | Groups |
7275

76+
!!! note Note
77+
Different Identity Providers use different attribute names. Label Studio provides **presets** in the SSO & SAML settings page to quickly configure the correct attribute mappings for popular IdPs. You can also manually configure custom attribute names if your IdP uses different values.
78+
79+
**Attribute presets by IdP:**
80+
81+
| IdP | Email | FirstName | LastName | Groups |
82+
| --- | --- | --- | --- | --- |
83+
| Default | `Email` | `FirstName` | `LastName` | `Groups` |
84+
| Auth0 | `email` | `given_name` | `family_name` | `groups` |
85+
| Entra ID (short) | `emailAddress` | `givenName` | `surname` | `groups` |
86+
| Google | `Email` | `FirstName` | `LastName` | `Groups` |
87+
| PingOne | `emailAddress` | `givenName` | `surname` | `Groups` |
88+
| Okta | `email` | `firstName` | `lastName` | `groups` |
89+
90+
**Microsoft Entra ID with full URI format:**
91+
92+
If your Entra ID is configured with default claim URIs, use:
93+
94+
| Attribute | URI |
95+
| --- | --- |
96+
| Email | `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress` |
97+
| FirstName | `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname` |
98+
| LastName | `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname` |
99+
| Groups | `http://schemas.microsoft.com/ws/2008/06/identity/claims/groups` |
100+
73101

74102

75103
###### From Label Studio:

0 commit comments

Comments
 (0)