# Enabling single sign-on (SSO)

This guide describes how to enable single sign-on (SSO), which allows users to authenticate to Lambda Cloud through your organization's existing identity provider (IdP). Enabling SSO offers several advantages:

- Users don't need to manage a separate set of credentials for Lambda Cloud.
- Your organization's users are automatically added to your domain-wide account when they first log in.
- Your IdP remains the single source of truth for managing user access.

## Prerequisites

To set up SSO for your Lambda Cloud account, you must have:

- A 1-Click Cluster (1CC).
- The [Admin role](https://docs.lambda.ai/public-cloud/access-security/#account-level-roles) in your Lambda Cloud account.
- Permission to set up application integrations for your identity provider.
- Permission to create and modify DNS `TXT` records for the domain name that you plan to enroll in SSO.

## Getting started

### Close out other accounts on your target domain

Before you can set up SSO for a domain, you must ensure that your domain has only one Lambda Cloud account associated with it. Verify that:

- All other Lambda Cloud accounts associated with that domain name have been closed.
- None of the emails on that domain belong to users in other accounts. If they do, you'll need to reach out to admin users of those accounts and ask them to remove the relevant users from their accounts.

### Request an invitation to set up SSO

After you've closed out all existing accounts on the domain, ask your Lambda account manager for an invitation email to set up SSO for your existing Lambda Cloud account.

## Setting up SSO

### Configure SSO for your identity provider

To configure SSO for your identity provider:

1. Open the invitation email, and then click the link to begin enrolling your account in SSO. You're taken to the SSO setup wizard.
   
   **Note**  
   The invitation link can only be used once. After you open the link, you have six hours to complete the SSO configuration process. If your link expires, contact your Lambda account manager and ask them to generate a new link.

2. On the **Configure Your Connection** page, click **Single Sign-On**.

3. Select your identity provider from the list of supported providers, and then click **Next**. If you don't see your provider on the list, choose **Custom SAML** or **Custom OIDC**, depending on your provider's authentication protocol.
4. Follow the instructions to configure SSO for your selected provider. If your provider uses SAML authentication, make sure the provider is set up to send the following attributes in its assertions:
   - _NameID formatting:_ Use the `urn:oasis:names:tc:SAML:2.0:nameid-format:persistent` format.
   - _Email attribute:_ Include the user's email address in either the `email` attribute or the `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress` attribute.
5. After you've finished the setup process, click **Done**. You're taken back to the **Configure Your Connection** page.

### Verify ownership of your domain

To complete SSO setup for your domain, you must verify that you own the domain:

1. On the **Configure Your Connection** page, click **Domain Verification**.
2. In the **Add Domain** tab, input your target domain and then click **Add Domain**.
3. Follow the instructions for verifying your domain.
4. After your domain name has been verified, click **Done**. You're taken back to the **Configure Your Connection** page.
5. On the **Configure Your Connection** page, click **Enable Connection**. A modal appears.
6. Click **Proceed** to finish enabling SSO for your domain.

## Next steps

For more information about access control on Lambda Cloud, see the [Access and security overview](https://docs.lambda.ai/public-cloud/access-security/).