# Set up SSO with SAML 2.0 dbt platform | Enterprise, Enterprise+ dbt Enterprise-tier plans support single-sign on (SSO) for any SAML 2.0-compliant identity provider (IdP). Currently supported features include: * IdP-initiated SSO * SP-initiated SSO * Just-in-time provisioning This document details the steps to integrate dbt with an identity provider in order to configure Single Sign On and [role-based access control](./about-user-access.md#role-based-access-control). ## Auth0 URIs The URI used for SSO connections will vary based on your dbt hosted region. To find the Auth0 URI (also called the **Single sign-on URL**, **Authorization URL**, or **Callback URI**) for your environment: 1. Navigate to your **Account settings** and click **SSO & SCIM** in the left menu. 2. In the **Single sign-on** pane, click **Get started** (if SSO has not been configured) or **Edit** (if it has already been set up). 3. Select the appropriate **Identity provider** from the **Provider type** dropdown. 4. The Auth0 URI is displayed under the **Identity provider values** section. The field label depends on the provider you selected: | Identity provider | Field label | Example URI | | ------------------ | --------------------------- | --------------------------------------------------------------- | | SAML 2.0 | **Single sign-on URL** | `https://YOUR_AUTH0_URI/login/callback` | | Okta | **Single sign-on URL** | `https://YOUR_AUTH0_URI/login/callback?connection=ACCOUNT_NAME` | | Google Workspace | **Authorized Redirect URI** | `https://YOUR_AUTH0_URI/login/callback` | | Microsoft Entra ID | **Callback URI** | `https://YOUR_AUTH0_URI/login/callback` | *Replace `YOUR_AUTH0_URI` and `ACCOUNT_NAME` with your account values.* [![Example of the identity provider values for a SAML 2.0 provider](/img/docs/dbt-platform/access-control/sso-uri.png?v=2 "Example of the identity provider values for a SAML 2.0 provider")](#)Example of the identity provider values for a SAML 2.0 provider Auth0 URI The Auth0 URI always contains YOUR\_AUTH0\_URI (for example, auth.cloud.getdbt.com), not your account-specific prefix URL (such as ks123.us1.dbt.com). This is because dbt uses Auth0 as a centralized authentication service across all regions and accounts. You don't need to replace this value with your cell-specific URL. ## Generic SAML 2.0 integrations If your SAML identity provider is one of Okta, Google, Azure or OneLogin, navigate to the relevant section further down this page. For all other SAML compliant identity providers, you can use the instructions in this section to configure that identity provider. ### Configure your identity provider You'll need administrator access to your SAML 2.0 compliant identity provider to configure the identity provider. You can use the following instructions with any SAML 2.0 compliant identity provider. ### Creating the application 1. Log into your SAML 2.0 identity provider and create a new application. 2. When promoted, configure the application with the following details: * **Platform:** Web * **Sign on method:** SAML 2.0 * **App name:** dbt * **App logo (optional):** You can optionally [download the dbt logo](https://drive.google.com/file/d/1fnsWHRu2a_UkJBJgkZtqt99x5bSyf3Aw/view?usp=sharing), and use as the logo for this app. #### Configuring the application The following steps use `YOUR_AUTH0_URI` and `YOUR_AUTH0_ENTITYID`. Replace these placeholders with the [appropriate Auth0 URI and Auth0 Entity ID](./sso-overview.md#auth0-uris) for your region. You can find these values in **Account settings** > **SSO & SCIM** > **Edit** or **Get started** after selecting your identity provider. To complete this section, you will need your login URL slug. This slug controls the URL where users on your account can log into your application. dbt automatically generates login URL slugs, which can't be altered. It will contain only letters, numbers, and dashes. For example, the login URL slug for dbt Labs would look something like `dbt-labs-afk123`. Login URL slugs are unique across all dbt accounts. Users can also sign in at to see accounts they have access to across instances. The enterprise login URL that includes your slug remains the URL used for IdP-initiated SSO flows with your identity provider. When prompted for the SAML 2.0 application configurations, supply the following values: * Single sign on URL: `https://YOUR_AUTH0_URI/login/callback?connection=` * Audience URI (SP Entity ID): `urn:auth0::{login URL slug}` - Relay State: `` (Note: Relay state may be shown as optional in the IdP settings; it is *required* for the dbt SSO configuration.) Additionally, you may configure the IdP attributes passed from your identity provider into dbt. [SCIM configuration](./scim.md) requires `NameID` and `email` to associate logins with the correct user. If you're using license mapping for groups, you need to additionally configure the `groups` attribute. We recommend using the following values: | name | name format | value | description | | ----------- | ----------- | ---------------- | ------------------------ | | email | Unspecified | user.email | The user's email address | | first\_name | Unspecified | user.first\_name | The user's first name | | last\_name | Unspecified | user.last\_name | The user's last name | | NameID | Unspecified | ID | The user's unchanging ID | `NameID` values can be persistent (`urn:oasis:names:tc:SAML:2.0:nameid-format:persistent`) rather than unspecified if your IdP supports these values. Using an email address for `NameID` will work, but dbt creates an entirely new user if that email address changes. Configuring a value that will not change, even if the user's email address does, is a best practice. dbt's [role-based access control](./about-user-access.md#role-based-access-control) relies on group mappings from the IdP to assign dbt users to dbt groups. To use role-based access control in dbt, also configure your identity provider to provide group membership information in user attribute called `groups`: | name | name format | value | description | | ------ | ----------- | ---------------- | --------------------------------------- | | groups | Unspecified | `` | The groups a user belongs to in the IdP | Note You may use a restricted group attribute statement to limit the groups set to dbt for each authenticated user. For example, if all of your dbt groups start with `DBT_CLOUD_...`, you may optionally apply a filter like `Starts With: DBT_CLOUD_`. ### Collect integration secrets After confirming your details, the IdP should show you the following values for the new SAML 2.0 integration. Keep these values somewhere safe, as you will need them to complete setup in dbt. * Identity Provider Issuer * Identity Provider SSO Url * X.509 Certificate (PEM format required) *  Example of PEM format ```text -----BEGIN CERTIFICATE----- MIIC8DCCAdigAwIBAgIQSANTIKwxA1221kqhkiG9w0dbtLabsBAQsFADA0MTIwMAYDVQQD EylNaWNyb3NvZnQgQXp1cmUgRmVkZXJhdGVkIFNTTyBDZXJ0aWZpY2F0ZTAeFw0yMzEyMjIwMDU1 MDNaFw0yNjEyMjIwMDU1MDNaMDQxMjAwBgNVBAMTKU1pY3Jvc29mdCBBenVyZSBGZWRlcmF0ZWQg U1NPIENlcnRpZmljYXRlMIIBIjANBgkqhkiG9w0BAEFAAFRANKIEMIIBCgKCAQEAqfXQGc/D8ofK aXbPXftPotqYLEQtvqMymgvhFuUm+bQ9YSpS1zwNQ9D9hWVmcqis6gO/VFw61e0lFnsOuyx+XMKL rJjAIsuWORavFqzKFnAz7hsPrDw5lkNZaO4T7tKs+E8N/Qm4kUp5omZv/UjRxN0XaD+o5iJJKPSZ PBUDo22m+306DE6ZE8wqxT4jTq4g0uXEitD2ZyKaD6WoPRETZELSl5oiCB47Pgn/mpqae9o0Q2aQ LP9zosNZ07IjKkIfyFKMP7xHwzrl5a60y0rSIYS/edqwEhkpzaz0f8QW5pws668CpZ1AVgfP9TtD Y1EuxBSDQoY5TLR8++2eH4te0QIDAQABMA0GCSqGSIb3DmAKINgAA4IBAQCEts9ujwaokRGfdtgH 76kGrRHiFVWTyWdcpl1dNDvGhUtCRsTC76qwvCcPnDEFBebVimE0ik4oSwwQJALExriSvxtcNW1b qvnY52duXeZ1CSfwHkHkQLyWBANv8ZCkgtcSWnoHELLOWORLD4aSrAAY2s5hP3ukWdV9zQscUw2b GwN0/bTxxQgA2NLZzFuHSnkuRX5dbtrun21USPTHMGmFFYBqZqwePZXTcyxp64f3Mtj3g327r/qZ squyPSq5BrF4ivguYoTcGg4SCP7qfiNRFyBUTTERFLYU0n46MuPmVC7vXTsPRQtNRTpJj/b2gGLk 1RcPb1JosS1ct5Mtjs41 -----END CERTIFICATE----- ``` ### Finish setup After creating the application, follow the instructions in the [dbt setup](#dbt-setup) section to complete the integration. ## Okta integration You can use the instructions in this section to configure Okta as your identity provider. 1. Log into your Okta account. Using the Admin dashboard, create a new app. [![Create a new app](/img/docs/dbt-platform/dbt-platform-enterprise/okta/okta-1-new-app.png?v=2 "Create a new app")](#)Create a new app 2. Select the following configurations: * **Platform**: Web * **Sign on method**: SAML 2.0 3. Click **Create** to continue the setup process. [![Configure a new app](/img/docs/dbt-platform/dbt-platform-enterprise/okta/okta-1-new-app-create.png?v=2 "Configure a new app")](#)Configure a new app ### Configure the Okta application The following steps use `YOUR_AUTH0_URI` and `YOUR_AUTH0_ENTITYID`. Replace these placeholders with the [appropriate Auth0 URI and Auth0 Entity ID](./sso-overview.md#auth0-uris) for your region. You can find these values in **Account settings** > **SSO & SCIM** > **Edit** or **Get started** after selecting your identity provider. To complete this section, you will need your login URL slug. This slug controls the URL where users on your account can log into your application. dbt automatically generates login URL slugs, which can't be altered. It will contain only letters, numbers, and dashes. For example, the login URL slug for dbt Labs would look something like `dbt-labs-afk123`. Login URL slugs are unique across all dbt accounts. Users can also sign in at to see accounts they have access to across instances. The enterprise login URL that includes your slug remains the URL used for IdP-initiated SSO flows with your identity provider. 1. On the **General Settings** page, enter the following details: * **App name**: dbt * **App logo** (optional): You can optionally [download the dbt logo](https://drive.google.com/file/d/1fnsWHRu2a_UkJBJgkZtqt99x5bSyf3Aw/view?usp=sharing), and upload it to Okta to use as the logo for this app. 2. Click **Next** to continue. [![Configure the app's General Settings](/img/docs/dbt-platform/dbt-platform-enterprise/okta/okta-2-general-settings.png?v=2 "Configure the app's General Settings")](#)Configure the app's General Settings ### Configure SAML Settings 1. On the **SAML Settings** page, enter the following values: * **Single sign on URL**: `https://YOUR_AUTH0_URI/login/callback?connection=` * **Audience URI (SP Entity ID)**: `urn:auth0::` * **Relay State**: `` * **Name ID format**: `Unspecified` * **Application username**: `Custom` / `user.getInternalProperty("id")` * **Update Application username on**: `Create and update` [![Configure the app's SAML Settings](/img/docs/dbt-platform/dbt-platform-enterprise/okta/okta-3-saml-settings-top.png?v=2 "Configure the app's SAML Settings")](#)Configure the app's SAML Settings 2. Map your organization's Okta User and Group Attributes to the format that dbt expects by using the Attribute Statements and Group Attribute Statements forms. [SCIM configuration](./scim.md) requires `email` to associate logins with the correct user. If you're using license mapping for groups, you need to additionally configure the `groups` attribute. 3. The following table illustrates expected User Attribute Statements: | Name | Name format | Value | Description | | ------------ | ----------- | ---------------- | -------------------------- | | `email` | Unspecified | `user.email` | *The user's email address* | | `first_name` | Unspecified | `user.firstName` | *The user's first name* | | `last_name` | Unspecified | `user.lastName` | *The user's last name* | 4. The following table illustrates expected **Group Attribute Statements**: | Name | Name format | Filter | Value | Description | | -------- | ----------- | ------------- | ----- | ------------------------------------- | | `groups` | Unspecified | Matches regex | `.*` | *The groups that the user belongs to* | You can instead use a more restrictive Group Attribute Statement than the example shown in the previous steps. For example, if all of your dbt groups start with `DBT_CLOUD_`, you may use a filter like `Starts With: DBT_CLOUD_`. **Okta only returns 100 groups for each user, so if your users belong to more than 100 IdP groups, you will need to use a more restrictive filter**. Please contact support if you have any questions. [![Configure the app's User and Group Attribute Statements](/img/docs/dbt-platform/dbt-platform-enterprise/okta/okta-3-saml-settings-bottom.png?v=2 "Configure the app's User and Group Attribute Statements")](#)Configure the app's User and Group Attribute Statements 5. Click **Next** to continue. ### Finish Okta setup 1. Select *I'm an Okta customer adding an internal app*. 2. Select *This is an internal app that we have created*. 3. Click **Finish** to finish setting up the app. [![Finishing setup in Okta](/img/docs/dbt-platform/dbt-platform-enterprise/okta/okta-4-feedback.png?v=2 "Finishing setup in Okta")](#)Finishing setup in Okta ### View setup instructions 1. On the next page, click **View Setup Instructions**. 2. In the steps below, you'll supply these values in your dbt Account Settings to complete the integration between Okta and dbt. [![Viewing the configured application](/img/docs/dbt-platform/dbt-platform-enterprise/okta/okta-5-view-instructions.png?v=2 "Viewing the configured application")](#)Viewing the configured application [![Application setup instructions](/img/docs/dbt-platform/dbt-platform-enterprise/okta/okta-5-instructions.png?v=2 "Application setup instructions")](#)Application setup instructions 3. After creating the Okta application, follow the instructions in the [dbt setup](#dbt-setup) section to complete the integration. ## Google integration Use this section if you are configuring Google as your identity provider. ### Configure the Google application The following steps use `YOUR_AUTH0_URI` and `YOUR_AUTH0_ENTITYID`. Replace these placeholders with the [appropriate Auth0 URI and Auth0 Entity ID](./sso-overview.md#auth0-uris) for your region. You can find these values in **Account settings** > **SSO & SCIM** > **Edit** or **Get started** after selecting your identity provider. To complete this section, you will need your login URL slug. This slug controls the URL where users on your account can log into your application. dbt automatically generates login URL slugs, which can't be altered. It will contain only letters, numbers, and dashes. For example, the login URL slug for dbt Labs would look something like `dbt-labs-afk123`. Login URL slugs are unique across all dbt accounts. Users can also sign in at to see accounts they have access to across instances. The enterprise login URL that includes your slug remains the URL used for IdP-initiated SSO flows with your identity provider. 1. Sign into your **Google Admin Console** via an account with super administrator privileges. 2. From the Admin console Home page, go to **Apps** and then click **Web and mobile apps**. 3. Click **Add**, then click **Add custom SAML app**. 4. Click **Next** to continue. 5. Make these changes on the App Details page: * Name the custom app * Upload an app logo (optional) * Click **Continue**. ### Configure SAML Settings 1. Go to the **Google Identity Provider details** page. 2. Download the **IDP metadata**. 3. Copy the **SSO URL** and **Entity ID** and download the **Certificate** (or **SHA-256 fingerprint**, if needed). 4. Enter the following values on the **Service Provider Details** window: * **ACS URL**: `https://YOUR_AUTH0_URI/login/callback?connection=` * **Audience URI (SP Entity ID)**: `urn:auth0::` - **Start URL**: `` 5. Select the **Signed response** checkbox. 6. The default **Name ID** is the primary email. Multi-value input is not supported. If your user profile has a unique, stable value that will persist across email address changes, it's best to use that; otherwise, email will work. 7. Use the **Attribute mapping** page to map your organization's Google Directory Attributes to the format that dbt expects. 8. Click **Add another mapping** to map additional attributes. Expected **Attributes**: | Name | Name format | Value | Description | | --------------- | ----------- | ------------ | ------------------------- | | `First name` | Unspecified | `first_name` | The user's first name. | | `Last name` | Unspecified | `last_name` | The user's last name. | | `Primary email` | Unspecified | `email` | The user's email address. | 9. To use [role-based access control](./about-user-access.md#role-based-access-control) in dbt, enter the groups in the **Group membership** field during configuration: | Google groups | App attributes | | -------------- | -------------- | | Name of groups | `groups` | 10. Click **Finish** to continue. ### Finish Google setup 1. From the Admin console Home page, go to **Apps** and then click **Web and mobile apps**. 2. Select your SAML app. 3. Click **User access**. 4. To turn on or off a service for everyone in your organization, click **On for everyone** or **Off for everyone**, and then click **Save**. 5. Ensure that the email addresses your users use to sign in to the SAML app match the email addresses they use to sign in to your Google domain. **Note:** Changes typically take effect in minutes, but can take up to 24 hours. ### Finish setup After creating the Google application, follow the instructions in the [dbt setup](#dbt-setup) ## Microsoft Entra ID (formerly Azure AD) integration If you're using Microsoft Entra ID (formerly Azure AD), the instructions below will help you configure it as your identity provider. ### Create a Microsoft Entra ID Enterprise application The following steps use `YOUR_AUTH0_URI` and `YOUR_AUTH0_ENTITYID`. Replace these placeholders with the [appropriate Auth0 URI and Auth0 Entity ID](./sso-overview.md#auth0-uris) for your region. You can find these values in **Account settings** > **SSO & SCIM** > **Edit** or **Get started** after selecting your identity provider. To complete this section, you will need your login URL slug. This slug controls the URL where users on your account can log into your application. dbt automatically generates login URL slugs, which can't be altered. It will contain only letters, numbers, and dashes. For example, the login URL slug for dbt Labs would look something like `dbt-labs-afk123`. Login URL slugs are unique across all dbt accounts. Users can also sign in at to see accounts they have access to across instances. The enterprise login URL that includes your slug remains the URL used for IdP-initiated SSO flows with your identity provider. Follow these steps to set up single sign-on (SSO) with dbt: 1. Log into your Azure account. 2. In the Entra ID portal, select **Enterprise applications** and click **+ New application**. 3. Select **Create your own application**. 4. Name the application "dbt" or another descriptive name. 5. Select **Integrate any other application you don't find in the gallery (Non-gallery)** as the application type. 6. Click **Create**. 7. You can find the new application by clicking **Enterprise applications** and selecting **All applications**. 8. Click the application you just created. 9. Select **Single sign-on** under Manage in the left navigation. 10. Click **Set up single sign on** under Getting Started. [![In your Overview page, select 'Set up single sign on](/img/docs/dbt-platform/access-control/single-sign-on-overview.jpg?v=2 "In your Overview page, select 'Set up single sign on")](#)In your Overview page, select 'Set up single sign on 11. Click **SAML** in "Select a single sign-on method" section. [![Select the 'SAML' card in the 'Seelct a single sign-on method' section. ](/img/docs/dbt-platform/access-control/saml.jpg?v=2 "Select the 'SAML' card in the 'Seelct a single sign-on method' section. ")](#)Select the 'SAML' card in the 'Seelct a single sign-on method' section. 12. Click **Edit** in the Basic SAML Configuration section. [![In the 'Set up Single Sign-On with SAML' page, click 'Edit' in the 'Basic SAML Configuration' card](/img/docs/dbt-platform/access-control/basic-saml.jpg?v=2 "In the 'Set up Single Sign-On with SAML' page, click 'Edit' in the 'Basic SAML Configuration' card")](#)In the 'Set up Single Sign-On with SAML' page, click 'Edit' in the 'Basic SAML Configuration' card 13. Use the following table to complete the required fields and connect to dbt: | Field | Value | | ---------------------------------------------- | ------------------------------------------------------------------------ | | **Identifier (Entity ID)** | Use `urn:auth0::`. | | **Reply URL (Assertion Consumer Service URL)** | Use `https://YOUR_AUTH0_URI/login/callback?connection=`. | | **Relay State** | `` | 14. Click **Save** at the top of the form. ### Creating SAML settings From the Set up Single Sign-On with SAML page: 1. Click **Edit** in the User Attributes & Claims section. 2. Click **Unique User Identifier (Name ID)** under **Required claim.** 3. Set **Name identifier format** to **Unspecified**. 4. Set **Source attribute** to **user.objectid**. 5. Delete all claims under **Additional claims.** 6. Click **Add new claim** and add the following new claims: | Name | Source attribute | | --------------- | ---------------- | | **email** | user.mail | | **first\_name** | user.givenname | | **last\_name** | user.surname | 7. Click **Add a group claim** from **User Attributes and Claims.** 8. If you assign users directly to the enterprise application, select **Security Groups**. If not, select **Groups assigned to the application**. 9. Set **Source attribute** to **Group ID**. 10. Under **Advanced options**, check **Customize the name of the group claim** and specify **Name** to **groups**. **Note:** Keep in mind that the Group ID in Entra ID maps to that group's GUID. It should be specified in lowercase for the mappings to work as expected. The Source Attribute field alternatively can be set to a different value of your preference. ### Finish setup 9. After creating the Azure application, follow the instructions in the [dbt setup](#dbt-setup) section to complete the integration. The names for fields in dbt vary from those in the Entra ID app. They're mapped as follows: | dbt field | Corresponding Entra ID field | | ----------------------------- | ---------------------------- | | **Identity Provider SSO URL** | Login URL | | **Identity Provider Issuer** | Microsoft Entra Identifier | ## OneLogin integration Use this section if you are configuring OneLogin as your identity provider. To configure OneLogin, you will need **Administrator** access. ### Configure the OneLogin application The following steps use `YOUR_AUTH0_URI` and `YOUR_AUTH0_ENTITYID`. Replace these placeholders with the [appropriate Auth0 URI and Auth0 Entity ID](./sso-overview.md#auth0-uris) for your region. You can find these values in **Account settings** > **SSO & SCIM** > **Edit** or **Get started** after selecting your identity provider. To complete this section, you will need your login URL slug. This slug controls the URL where users on your account can log into your application. dbt automatically generates login URL slugs, which can't be altered. It will contain only letters, numbers, and dashes. For example, the login URL slug for dbt Labs would look something like `dbt-labs-afk123`. Login URL slugs are unique across all dbt accounts. Users can also sign in at to see accounts they have access to across instances. The enterprise login URL that includes your slug remains the URL used for IdP-initiated SSO flows with your identity provider. 1. Log into OneLogin, and add a new SAML 2.0 Application. 2. Configure the application with the following details: * **Platform:** Web * **Sign on method:** SAML 2.0 * **App name:** dbt * **App logo (optional):** You can optionally [download the dbt logo](https://drive.google.com/file/d/1fnsWHRu2a_UkJBJgkZtqt99x5bSyf3Aw/view?usp=sharing), and use as the logo for this app. ### Configure SAML settings 3. Under the **Configuration tab**, input the following values: * **RelayState:** `` * **Audience (EntityID):** `urn:auth0::` * **ACS (Consumer) URL Validator:** `https://YOUR_AUTH0_URI/login/callback?connection=` * **ACS (Consumer) URL:** `https://YOUR_AUTH0_URI/login/callback?connection=` 4. Next, go to the **Parameters tab**. You must have a parameter for the Email, First Name, and Last Name attributes and include all parameters in the SAML assertions. When you add the custom parameters, make sure you select the **Include in SAML assertion** checkbox, and ensure that the casing and format matches exactly as seen in the following table. We recommend using the following values: | name | name format | value | | ----------- | ----------- | ----------- | | NameID | Unspecified | OneLogin ID | | email | Unspecified | Email | | first\_name | Unspecified | First Name | | last\_name | Unspecified | Last Name | dbt's [role-based access control](./about-user-access.md#role-based-access-control) relies on group mappings from the IdP to assign dbt users to dbt groups. To use role-based access control in dbt, also configure OneLogin to provide group membership information in user attribute called `groups`: | name | name format | value | description | | ------ | ----------- | ------------------------------------------------- | --------------------------------------- | | groups | Unspecified | Series of groups to be used for your organization | The groups a user belongs to in the IdP | ### Collect integration secrets 5. After confirming your details, go to the **SSO tab**. OneLogin should show you the following values for the new integration. Keep these values somewhere safe, as you will need them to complete setup in dbt. * Issuer URL * SAML 2.0 Endpoint (HTTP) * X.509 Certificate (PEM format required) *  Example of PEM format ```text -----BEGIN CERTIFICATE----- MIIC8DCCAdigAwIBAgIQSANTIKwxA1221kqhkiG9w0dbtLabsBAQsFADA0MTIwMAYDVQQD EylNaWNyb3NvZnQgQXp1cmUgRmVkZXJhdGVkIFNTTyBDZXJ0aWZpY2F0ZTAeFw0yMzEyMjIwMDU1 MDNaFw0yNjEyMjIwMDU1MDNaMDQxMjAwBgNVBAMTKU1pY3Jvc29mdCBBenVyZSBGZWRlcmF0ZWQg U1NPIENlcnRpZmljYXRlMIIBIjANBgkqhkiG9w0BAEFAAFRANKIEMIIBCgKCAQEAqfXQGc/D8ofK aXbPXftPotqYLEQtvqMymgvhFuUm+bQ9YSpS1zwNQ9D9hWVmcqis6gO/VFw61e0lFnsOuyx+XMKL rJjAIsuWORavFqzKFnAz7hsPrDw5lkNZaO4T7tKs+E8N/Qm4kUp5omZv/UjRxN0XaD+o5iJJKPSZ PBUDo22m+306DE6ZE8wqxT4jTq4g0uXEitD2ZyKaD6WoPRETZELSl5oiCB47Pgn/mpqae9o0Q2aQ LP9zosNZ07IjKkIfyFKMP7xHwzrl5a60y0rSIYS/edqwEhkpzaz0f8QW5pws668CpZ1AVgfP9TtD Y1EuxBSDQoY5TLR8++2eH4te0QIDAQABMA0GCSqGSIb3DmAKINgAA4IBAQCEts9ujwaokRGfdtgH 76kGrRHiFVWTyWdcpl1dNDvGhUtCRsTC76qwvCcPnDEFBebVimE0ik4oSwwQJALExriSvxtcNW1b qvnY52duXeZ1CSfwHkHkQLyWBANv8ZCkgtcSWnoHELLOWORLD4aSrAAY2s5hP3ukWdV9zQscUw2b GwN0/bTxxQgA2NLZzFuHSnkuRX5dbtrun21USPTHMGmFFYBqZqwePZXTcyxp64f3Mtj3g327r/qZ squyPSq5BrF4ivguYoTcGg4SCP7qfiNRFyBUTTERFLYU0n46MuPmVC7vXTsPRQtNRTpJj/b2gGLk 1RcPb1JosS1ct5Mtjs41 -----END CERTIFICATE----- ``` ### Finish setup 6. After creating the OneLogin application, follow the instructions in the [dbt setup](#dbt-setup) section to complete the integration. ## dbt setup ### Providing IdP values to dbt To complete setup, follow the steps below in dbt: 1. Navigate to **Account settings** > **SSO & SCIM**. 2. Click **Get started** if SSO has not been configured, or **Edit** if it has already been set up. 3. Provide the following SSO details: | Field | Value | | ------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Log in with | SAML 2.0 | | Identity Provider SSO Url | Paste the **Identity Provider Single Sign-On URL** shown in the IdP setup instructions | | Identity Provider Issuer | Paste the **Identity Provider Issuer** shown in the IdP setup instructions | | X.509 Certificate | Paste the **X.509 Certificate** shown in the IdP setup instructions;
**Note:** When the certificate expires, an Idp admin will have to generate a new one to be pasted into dbt for uninterrupted application access. | [![Configuring the application in dbt](/img/docs/dbt-platform/dbt-platform-enterprise/okta/okta-6-setup-integration.png?v=2 "Configuring the application in dbt")](#)Configuring the application in dbt 4. Click **Save** to complete setup for the SAML 2.0 integration. 5. After completing the setup, you can navigate to the URL generated for your account's *slug* to test logging in with your identity provider. Additionally, users added the the SAML 2.0 app will be able to log in to dbt from the IdP directly. ### Additional configuration options The **Single sign-on** section also contains additional configuration options which are located after the credentials fields. * **Sign SAML Auth Request:** dbt will sign SAML requests sent to your identity provider when users attempt to log in. Metadata for configuring this in your identity provider can be downloaded from the value shown in **SAML Metadata URL**. We recommend leaving this disabled for most situations. * **Attribute Mappings:** Associate SAML attributes that dbt needs with attributes your identity provider includes in SAML assertions. The value must be a valid JSON object with the `email`, `first_name`, `last_name`, or `groups` keys and values that are strings or lists of strings. For example, if your identity provider is unable to include an `email` attribute in assertions, but does include one called `EmailAddress`, then **Attribute Mappings** should be set to `{ "email": "EmailAddress" }`. The mappings are only needed if you cannot configure attributes as specified in the instructions on this page. If you can, the default value of `{}` is acceptable. Logging in Users can sign in at to view accounts they have access to across instances and choose where to open dbt platform. This is the recommended entry point for most users. For SSO through your identity provider, you can also use the following URL format with your account login URL slug. Replace `LOGIN_SLUG` with the value from the previous steps and `YOUR_ACCESS_URL` with the [appropriate Access URL](../about-platform/access-regions-ip-addresses.md) for your region and plan: `https://YOUR_ACCESS_URL/enterprise-login/LOGIN-SLUG` Account administrators can turn account discovery on or off with **Enable global account discovery** in [Account settings](../account-settings.md#enable-global-account-discovery). ### Setting up RBAC After configuring an identity provider, you will be able to set up [role-based access control](./enterprise-permissions.md) for your account. For common questions and troubleshooting — including "Access Denied" after SAML authentication, ACS URL or Entity ID changes, and email verification issues — refer to [SSO FAQs and troubleshooting](./sso-faq.md). ## Was this page helpful? YesNo [Privacy policy](https://www.getdbt.com/cloud/privacy-policy)[Create a GitHub issue](https://github.com/dbt-labs/docs.getdbt.com/issues) This site is protected by reCAPTCHA and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply.