> ## Documentation Index
> Fetch the complete documentation index at: https://docs.coderabbit.ai/llms.txt
> Use this file to discover all available pages before exploring further.
# Custom SAML SSO setup
> Configure SAML-based single sign-on between a custom identity provider and CodeRabbit from your organization's account management page.
export const EnterprisePlanBadge = ({tip = "This feature is available exclusively as part of the Enterprise plan. Please refer to our pricing page for more information about our plans and features.", title = "Enterprise Plan", cta = "Read more", href = "https://coderabbit.ai/pricing", disabled = false}) => {
return
{title}
;
};
export const AdminRoleBadge = ({tip = "This feature requires an organization owner, an admin role or the corresponding permission. Regular Members do not have access.", title = "Admin Only", cta = "View roles", href = "/management/roles", disabled = false}) => {
return
{title}
;
};
Use this guide to configure a SAML 2.0 identity provider that is not covered by a provider-specific CodeRabbit guide. The account management SSO wizard provides the CodeRabbit service provider values, expected SAML attributes, metadata configuration step, test flow, and activation step.
After SSO is activated, users with a verified email domain must sign in to CodeRabbit through your identity provider.
## Before you start
Make sure you have:
* **Critical: You must have an invitation to your CodeRabbit organization from your CodeRabbit account team before starting this setup.**
* Organization admin access in the CodeRabbit account management page
* Administrator access to your identity provider
* Permission to create and configure SAML 2.0 applications in your identity provider
* Access to your DNS provider if your email domain still needs verification
* The users, groups, or organizational units that should be allowed to sign in through SSO
If you do not see the **Security** section or the **Start configuration** button in your organization profile, contact your CodeRabbit account team. Your organization must be prepared for self-serve SSO before the account management SSO wizard appears.
## Set up Custom SAML self-serve SSO
Accept your CodeRabbit organization invitation and sign in to the account management page. Open the organization switcher, find the invited organization, and click **Manage**.
In the organization profile, select **Security**, and click **Start configuration**.
In **Domains**, enter the email domain that should use your identity provider for CodeRabbit sign-in, then click **Add**.
If the wizard asks you to add a DNS record, add the generated `TXT` record in your DNS provider and wait for the domain to show **Verified** before continuing.
In **Connection**, select **Custom SAML Provider** as the identity provider.
In your identity provider, create a new SAML 2.0 application for CodeRabbit. Use a clear app name such as `CodeRabbit`.
Copy the CodeRabbit service provider values from the account management SSO wizard into the matching fields in your identity provider:
| Identity provider field | Value |
| ------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------- |
| Assertion consumer service URL, ACS URL, single sign-on URL, or reply URL | Copy the **Assertion consumer service (ACS) URL** from the account management SSO wizard |
| Entity ID, audience URI, or SP Entity ID | Copy the **Entity ID** from the account management SSO wizard |
| Name ID or subject | Use the user's primary email address if your identity provider requires this field |
Configure your identity provider so the SAML response includes the attributes CodeRabbit expects. Attribute names are case-sensitive.
| Attribute name | User attribute |
| -------------- | -------------- |
| `mail` | Primary email |
| `firstName` | First name |
| `lastName` | Last name |
The `mail` attribute is required. `firstName` and `lastName` are optional, but adding them helps CodeRabbit populate user profile details correctly.
In your identity provider, assign the users, groups, or organizational units that should be allowed to sign in to CodeRabbit through SSO.
Users cannot complete SSO sign-in until they are assigned to the SAML application in your identity provider.
In your identity provider's SAML application, retrieve the metadata URL.
Return to the account management SSO wizard. In **Configure identity provider metadata**, keep **Add via metadata** selected, paste the metadata URL, and continue.
If your identity provider does not provide a metadata URL, select **Configure manually** and enter the SAML metadata values from your identity provider.
In **Test**, click **Open test URL** and complete the sign-in flow with a user who has access to the SAML app and whose email matches your verified domain.
Return to the account management SSO wizard and click **Refresh logs** until the latest test result shows **Success**. Do not activate SSO while the latest result is **Pending** or failed.
In **Activate**, review the activation message and click **Activate SSO**.
Activation changes sign-in behavior for the verified domain. After activation, users with that email domain must sign in to CodeRabbit through your identity provider.
## What's next
Return to the SSO overview to understand how Enterprise SSO fits into your CodeRabbit rollout.
Pair SSO with the right access controls by reviewing how roles work in your CodeRabbit organization.
Contact CodeRabbit if the Security section is missing or the SSO test does not succeed.