Skip to main content
Applies to:
  • Plan -
  • Deployment -
Contact support@braintrust.dev to set up an SSO integration. Braintrust supports the following protocols and identity providers (IdPs):
  • SAML: Okta Workforce, Microsoft Entra ID, Google Workspace, or a custom SAML provider.
  • OpenID Connect (OIDC): A custom OIDC provider.

​
Information to include

Include the IdP and protocol you will use, the email domain or domains to configure, and the protocol-specific details below.

​
SAML connections

For a SAML connection, include whether you want to enable IdP-initiated login, such as launching Braintrust from an Okta tile. Braintrust support will provide connection-specific values for your SAML service provider (SP) configuration:
  • Single sign-on URL.
  • Audience URI (SP Entity ID).
Add these values to your SAML application instead of using generic Braintrust URLs. Configure the SAML response to include:
  • mail: The user’s primary email address.
  • public_metadata_groups (optional): The SAML group value or values configured in your Braintrust domain mappings. Send each group as a separate attribute value, not a comma-separated string. Include this attribute only if a domain mapping also matches a SAML group value.
See Domain mappings for JIT provisioning behavior and limitations. Test the connection with a new user who has access to the SAML application. If the domain mapping also matches a SAML group value, add the test user to a mapped IdP group.

​
Okta Workforce

Provide the metadata URL. If it is unavailable, provide:
  • Identity Provider Single Sign-On URL.
  • Identity Provider Issuer.
  • The SSL/TLS certificate to use.
For current Okta configuration steps, see Add Okta Workforce as a SAML connection.

​
Microsoft Entra ID

Provide the metadata URL. If it is unavailable, provide:
  • Login URL.
  • Microsoft Entra Identifier.
  • The SSL/TLS certificate to use.

​
Google Workspace

Provide the metadata URL. If it is unavailable, provide:
  • SSO URL.
  • Entity ID.
  • The SSL/TLS certificate to use.

​
Custom SAML provider

Provide the metadata URL. If it is unavailable, provide:
  • SSO URL.
  • Entity ID.
  • The SSL/TLS certificate to use.

​
OIDC connections

For a custom OIDC provider, provide the discovery endpoint. If it is unavailable, provide:
  • Authorization URL.
  • Token URL.
  • User Info URL.
Also include:
  • The client ID.
  • The client secret.
  • Any scopes.