Skip to main content
Version: 25.5

Configure SAML SSO

This document will guide you through the process of setting up SAML-based authentication for single sign-on (SSO) in the Snorkel AI Data Development Platform. By the end of the step-by-step guide, you will be able to log in to Snorkel using your identity provider (IDP) mediated by SAML 2.0.

Prerequisites​

  • An existing Snorkel AI Data Development Platform
  • Superadmin access to the Snorkel AI Data Development Platform
  • A SAML 2.0-compatible Identity Provider (e.g. Okta, Google, or PingIdentity)

Configuring your identity provider​

We recommend having three windows open: one for Snorkel, another for your IDP, and a third with these instructions. You will be asked to copy and paste metadata between the two systems.

Initial configuration​

Open the Admin Settings page in Snorkel, and navigate to the Authentication Settings tab. Change SSO Status to Enabled and SSO Type to SAML.

warning

DO NOT set SSO Status to Required until you have successfully verified your setup, otherwise you risk being locked out of the instance. Once the SSO Status is set to Required, you will no longer be able to log in with username/password.

saml_setup_31.webp

Registering Snorkel with your identity provider​

In order for your IDP to provide authentication for Snorkel, you will need to provide information about your Snorkel AI Data Development Platform to your IDP.

First, in your IDP management console, add a new service provider. We recommend naming the service provider after your Snorkel AI Data Development Platform. Each IDP has their own name for service providers, such as “Applications” or “Connections.” Note that if you have multiple Snorkel AI Data Development Platforms, you will need to repeat this for each instance.

Your IDP will then ask you to enter standard metadata about the newly created service provider. These can be retrieved from the Service Provider Settings section in the Snorkel AI Data Development Platform.

  1. Service Provider Entity ID: Unique identifier that names your Snorkel AI Data Development Platform.
  2. ACS URL: URL where requests are sent after successful authentication with your IDP.
  3. Signed Response: Look for a checkbox that says “Sign Assertion & Response” or “Sign Response” and check it.
  4. ACS Binding: In many cases, this value is optional. Paste the value as given in the Snorkel settings or look for an option called Binding and select Redirect.
  5. Name ID Format: Snorkel uses each user’s email address for SSO login. Paste the value as given in Snorkel settings or look for an option called Name ID Format and select “Email” or “Email Address”.
  6. X509 Certificate: Certificate provided by Snorkel, often referred to as the Verification Certificate by IDPs. Paste the value for this certificate directly into this field in your IDP or upload file containing this content.
info

In the diagram below, the numbered fields correspond to the descriptions above.

saml_setup_11.webp

Registering your identity provider with Snorkel​

  1. Identity Provider Entity ID: This may also be called the Issuer ID, and also tends to be a URL. Paste the value from your IDP here.
  2. SSO URL: This may also be called the SSO Service URL, and frequently will end with a code like start or startsso. Paste the value from your IDP here.
  3. SSO Binding: This is commonly the string urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST, but if your IDP specifies a different value, paste it here.
  4. X509 Certificate: This is frequently a file downloaded from your IDP called the Signing Certificate. You may also see a body of text to copy and paste. Download this file, copy the contents and paste them into this field.
saml_setup_21.webp

Once you’ve finished the configuration above, click the Save button.

Testing the connection​

You can test the connection to your IDP by using the Test SSO button on the Admin Settings page. This will attempt to perform an authentication handshake between your IDP and your Snorkel AI Data Development Platform. If the connection is successful you will be redirected back to the Admin Settings page with a success message. If not, you will be presented an error message.

If you run into an error, review your steps through the guide above to ensure everything was configured correctly. If you need additional assistance, contact Snorkel AI support.

Requiring SSO login​

As an administrator, you can require that all Snorkel authentication use your SSO provider. This is enabled by changing the SSO Status from Enabled to Required.

As a prerequisite, all users must have email addresses assigned to their profile in Snorkel. Emails can be provided by Snorkel administrators on the User Management tab on the Admin Settings page.

warning

DO NOT set SSO Status to Required until you have successfully verified your setup, otherwise you risk being locked out of the instance. Once the SSO Status is set to Required, you will no longer be able to log in with username/password.

Provider-specific guides​

PingIdentity​

Initial configuration​

  1. Add a Connection in the PingOne console.
  2. Select “Web App” as the application type.
  3. Select “Manually Enter” under app metadata.

Registering Snorkel with your identity provider​

  1. Copy ACS URL from Snorkel into the information pane.
  2. Download the signing certificate and open the file in a text editor. Copy and paste the content into the “x509 Cert” field under Identity Provider Settings on Snorkel.
  3. Select “Sign Assertion and Response”.
  4. Leave the default Signing Algorithm in place.
  5. Do not enable encryption.
  6. Under the field Entity ID, copy the field called “Entity ID” under Service Provider Settings in Snorkel. Paste this value into this field.
  7. Leave SLO Endpoint and SLO Response Endpoint blank.
  8. Set the field “Assertion Validity Duration (In Seconds)” to 300.
  9. Set the field “Target Application URL” to the URL of your Snorkel AI Data Development Platform. This is generally the same as the URL you pasted for the Entity ID.
  10. Select “Enforce Signed Auth Request”.
  11. Under the “Verification Certificate”, first copy the contents of the x509 Cert under the Service Provider Settings and paste it into a file. Save this file, then choose to import this file as the verification certificate on PingIdentity.
  12. Click Save and Continue.

Registering your identity provider with Snorkel​

  1. From the list of Connections on PingIdentity, select the Snorkel connection you just created.
  2. Click the menu button on the right side of the application.
  3. Click the “Configuration” tab in the Snorkel application details.
  4. Copy the Issuer ID beginning with https://auth.pingone.com and paste it as the Entity ID under Identity Provider Settings in Snorkel.
  5. Copy the Single Sign-on Service URL beginning with https://auth.pingone.com and paste it as the SSO URL under Identity Provider Settings in Snorkel.
  6. Enter urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect as the SSO Binding under Identity Provider Settings in Snorkel.
  7. Click Save in Snorkel.