hub/pr_2521/en/_app/immutable/nodes/175.4e647014.js

import{s as Fe,n as De,o as Ge}from"../chunks/scheduler.409792a1.js";import{S as Ue,i as Ae,e as o,s,c as E,h as We,a as l,d as i,b as a,f as Be,g as j,j as r,l as q,m as Ve,n,o as B,p as F,q as D,r as G}from"../chunks/index.92d389ff.js";import{C as Ke}from"../chunks/CopyLLMTxtMenu.dcf7fb47.js";import{H as W,E as Qe}from"../chunks/MermaidChart.svelte_svelte_type_style_lang.0c189c7e.js";function Ye(Se){let u,V,U,K,h,Q,d,Y,g,ye='<p>This feature is part of the <a href="https://huggingface.co/enterprise">Team &amp; Enterprise</a> plans.</p>',R,v,$e="Basic SSO adds an access-control layer on top of the standard Hugging Face login. It allows you to enforce authentication through your Identity Provider (IdP) when members access resources under your organization’s namespace, such as private models, datasets, and Spaces.",J,b,we='For a comparison with Managed SSO, see the <a href="./enterprise-sso">SSO overview</a>.',N,S,X,c,ke="<p><strong>Basic SSO does not replace the Hugging Face login.</strong> Your members will still need to sign in to Hugging Face with their own credentials (email/password, Google, or GitHub) before being prompted to complete SSO authentication to access your organization’s resources. This is by design: Basic SSO secures access to your organization without taking over the user’s Hugging Face identity.</p>",Z,y,Te="When Single Sign-On is enabled, organization members authenticate through your Identity Provider (IdP). You pick whether SSO is <strong>enforced</strong> or <strong>optional</strong>:",ee,$,xe="<li><strong>Enforced</strong> (default): Members have to complete SSO authentication before accessing anything under the organization’s namespace.</li> <li><strong>Optional</strong>: Members get prompted via a banner at the top of the page to set up SSO, but can skip it and still access the organization. This is handy when you’re migrating a lot of users and want to give them time to sort out their accounts before definitely enforcing SSO.</li>",te,m,Me='<img class="block dark:hidden" src="https://huggingface.co/datasets/huggingface/documentation-images/resolve/main/hub/sso/sso-enabled-without-enforcement.png"/> <img class="hidden dark:block" src="https://huggingface.co/datasets/huggingface/documentation-images/resolve/main/hub/sso/sso-enabled-without-enforcement-dark.png"/>',ie,w,He="Public content is still accessible to everyone, including non-members.",ne,k,Ce='<strong>We use email addresses to identify SSO users. As a user, make sure that your organizational email address (e.g. your company email) has been added to <a href="https://huggingface.co/settings/account" rel="nofollow">your user account</a>.</strong>',se,T,Oe="When users log in, they will be prompted to complete the Single Sign-On authentication flow with a banner similar to the following:",ae,p,Le='<img class="block dark:hidden" src="https://huggingface.co/datasets/huggingface/documentation-images/resolve/main/hub/security-sso-prompt.png"/> <img class="hidden dark:block" src="https://huggingface.co/datasets/huggingface/documentation-images/resolve/main/hub/security-sso-prompt-dark.png"/>',oe,x,_e="Single Sign-On only applies to your organization. Members may belong to other organizations on Hugging Face.",le,M,re,H,Pe="Basic SSO can be configured directly from your organization’s settings. Hugging Face Hub can work with any OIDC-compliant or SAML Identity Provider, including Okta, OneLogin, and Microsoft Entra ID (Azure AD).",ue,C,ze='See our <a href="./security-sso-configuration-guides">Configuration Guides</a> for step-by-step setup instructions.',ge,O,ce,L,Ie="Once SSO is enabled on your organization, a direct join link can be copied and shared with new members. This SSO join link is available in both the <strong>SSO</strong> and <strong>Members</strong> settings tabs. Since organizations with SSO enabled cannot use classic invite links, the SSO join link is the primary method for inviting teammates to your organization. Simply click the copy button to copy the link to your clipboard and share it with the members you want to invite. When recipients click the shared link, they will be able to authenticate via SSO and directly join your organization.",me,f,Ee='<img class="block dark:hidden" src="https://huggingface.co/datasets/huggingface/documentation-images/resolve/main/hub/sso-join-link.png"/> <img class="hidden dark:block" src="https://huggingface.co/datasets/huggingface/documentation-images/resolve/main/hub/sso-join-link-dark.png"/>',pe,_,je='Organizations on the Enterprise plan can also use <a href="./enterprise-scim">SCIM</a> to automate invitation-based provisioning from your Identity Provider. See the <a href="./enterprise-scim">SCIM guide</a> for more details.',fe,P,he,z,qe='Basic SSO supports <a href="./security-sso-user-management">role mapping, resource group mapping, session timeout, matching email domains, and external collaborators</a>. These features are configurable from your organization’s settings.',de,I,ve,A,be;return h=new Ke({props:{containerStyle:"float: right; margin-left: 10px; display: inline-flex; position: relative; z-index: 10;"}}),d=new W({props:{title:"Basic SSO",local:"basic-sso",headingTag:"h1"}}),S=new W({props:{title:"How it works",local:"how-it-works",headingTag:"h2"}}),M=new W({props:{title:"Getting started",local:"getting-started",headingTag:"h2"}}),O=new W({props:{title:"User provisioning",local:"user-provisioning",headingTag:"h2"}}),P=new W({props:{title:"SSO features",local:"sso-features",headingTag:"h2"}}),I=new Qe({props:{source:"https://github.com/huggingface/hub-docs/blob/main/docs/hub/security-sso-basic.md"}}),{c(){u=o("meta"),V=s(),U=o("p"),K=s(),E(h.$$.fragment),Q=s(),E(d.$$.fragment),Y=s(),g=o("blockquote"),g.innerHTML=ye,R=s(),v=o("p"),v.textContent=$e,J=s(),b=o("p"),b.innerHTML=we,N=s(),E(S.$$.fragment),X=s(),c=o("blockquote"),c.innerHTML=ke,Z=s(),y=o("p"),y.innerHTML=Te,ee=s(),$=o("ul"),$.innerHTML=xe,te=s(),m=o("div"),m.innerHTML=Me,ie=s(),w=o("p"),w.textContent=He,ne=s(),k=o("p"),k.innerHTML=Ce,se=s(),T=o("p"),T.textContent=Oe,ae=s(),p=o("div"),p.innerHTML=Le,oe=s(),x=o("p"),x.textContent=_e,le=s(),E(M.$$.fragment),re=s(),H=o("p"),H.textContent=Pe,ue=s(),C=o("p"),C.innerHTML=ze,ge=s(),E(O.$$.fragment),ce=s(),L=o("p"),L.innerHTML=Ie,me=s(),f=o("div"),f.innerHTML=Ee,pe=s(),_=o("p"),_.innerHTML=je,fe=s(),E(P.$$.fragment),he=s(),z=o("p"),z.innerHTML=qe,de=s(),E(I.$$.fragment),ve=s(),A=o("p"),this.h()},l(e){const t=We("svelte-u9bgzb",document.head);u=l(t,"META",{name:!0,content:!0}),t.forEach(i),V=a(e),U=l(e,"P",{}),Be(U).forEach(i),K=a(e),j(h.$$.fragment,e),Q=a(e),j(d.$$.fragment,e),Y=a(e),g=l(e,"BLOCKQUOTE",{class:!0,"data-svelte-h":!0}),r(g)!=="svelte-16y0s3r"&&(g.innerHTML=ye),R=a(e),v=l(e,"P",{"data-svelte-h":!0}),r(v)!=="svelte-1hykw65"&&(v.textContent=$e),J=a(e),b=l(e,"P",{"data-svelte-h":!0}),r(b)!=="svelte-c2buv8"&&(b.innerHTML=we),N=a(e),j(S.$$.fragment,e),X=a(e),c=l(e,"BLOCKQUOTE",{class:!0,"data-svelte-h":!0}),r(c)!=="svelte-1r5uuon"&&(c.innerHTML=ke),Z=a(e),y=l(e,"P",{"data-svelte-h":!0}),r(y)!=="svelte-zos8pt"&&(y.innerHTML=Te),ee=a(e),$=l(e,"UL",{"data-svelte-h":!0}),r($)!=="svelte-iwqi5f"&&($.innerHTML=xe),te=a(e),m=l(e,"DIV",{class:!0,"data-svelte-h":!0}),r(m)!=="svelte-1t4fl3p"&&(m.innerHTML=Me),ie=a(e),w=l(e,"P",{"data-svelte-h":!0}),r(w)!=="svelte-jembiq"&&(w.textContent=He),ne=a(e),k=l(e,"P",{"data-svelte-h":!0}),r(k)!=="svelte-195k6t6"&&(k.innerHTML=Ce),se=a(e),T=l(e,"P",{"data-svelte-h":!0}),r(T)!=="svelte-1oub8n8"&&(T.textContent=Oe),ae=a(e),p=l(e,"DIV",{class:!0,"data-svelte-h":!0}),r(p)!=="svelte-1qv3q0l"&&(p.innerHTML=Le),oe=a(e),x=l(e,"P",{"data-svelte-h":!0}),r(x)!=="svelte-1k296rr"&&(x.textContent=_e),le=a(e),j(M.$$.fragment,e),re=a(e),H=l(e,"P",{"data-svelte-h":!0}),r(H)!=="svelte-oa6291"&&(H.textContent=Pe),ue=a(e),C=l(e,"P",{"data-svelte-h":!0}),r(C)!=="svelte-fcovr"&&(C.innerHTML=ze),ge=a(e),j(O.$$.fragment,e),ce=a(e),L=l(e,"P",{"data-svelte-h":!0}),r(L)!=="svelte-ushy8m"&&(L.innerHTML=Ie),me=a(e),f=l(e,"DIV",{class:!0,"data-svelte-h":!0}),r(f)!=="svelte-ihg49b"&&(f.innerHTML=Ee),pe=a(e),_=l(e,"P",{"data-svelte-h":!0}),r(_)!=="svelte-1kt91i7"&&(_.innerHTML=je),fe=a(e),j(P.$$.fragment,e),he=a(e),z=l(e,"P",{"data-svelte-h":!0}),r(z)!=="svelte-1wyb626"&&(z.innerHTML=qe),de=a(e),j(I.$$.fragment,e),ve=a(e),A=l(e,"P",{}),Be(A).forEach(i),this.h()},h(){q(u,"name","hf:doc:metadata"),q(u,"content",Re),q(g,"class","warning"),q(c,"class","note"),q(m,"class","flex justify-center"),q(p,"class","flex justify-center"),q(f,"class","flex justify-center")},m(e,t){Ve(document.head,u),n(e,V,t),n(e,U,t),n(e,K,t),B(h,e,t),n(e,Q,t),B(d,e,t),n(e,Y,t),n(e,g,t),n(e,R,t),n(e,v,t),n(e,J,t),n(e,b,t),n(e,N,t),B(S,e,t),n(e,X,t),n(e,c,t),n(e,Z,t),n(e,y,t),n(e,ee,t),n(e,$,t),n(e,te,t),n(e,m,t),n(e,ie,t),n(e,w,t),n(e,ne,t),n(e,k,t),n(e,se,t),n(e,T,t),n(e,ae,t),n(e,p,t),n(e,oe,t),n(e,x,t),n(e,le,t),B(M,e,t),n(e,re,t),n(e,H,t),n(e,ue,t),n(e,C,t),n(e,ge,t),B(O,e,t),n(e,ce,t),n(e,L,t),n(e,me,t),n(e,f,t),n(e,pe,t),n(e,_,t),n(e,fe,t),B(P,e,t),n(e,he,t),n(e,z,t),n(e,de,t),B(I,e,t),n(e,ve,t),n(e,A,t),be=!0},p:De,i(e){be||(F(h.$$.fragment,e),F(d.$$.fragment,e),F(S.$$.fragment,e),F(M.$$.fragment,e),F(O.$$.fragment,e),F(P.$$.fragment,e),F(I.$$.fragment,e),be=!0)},o(e){D(h.$$.fragment,e),D(d.$$.fragment,e),D(S.$$.fragment,e),D(M.$$.fragment,e),D(O.$$.fragment,e),D(P.$$.fragment,e),D(I.$$.fragment,e),be=!1},d(e){e&&(i(V),i(U),i(K),i(Q),i(Y),i(g),i(R),i(v),i(J),i(b),i(N),i(X),i(c),i(Z),i(y),i(ee),i($),i(te),i(m),i(ie),i(w),i(ne),i(k),i(se),i(T),i(ae),i(p),i(oe),i(x),i(le),i(re),i(H),i(ue),i(C),i(ge),i(ce),i(L),i(me),i(f),i(pe),i(_),i(fe),i(he),i(z),i(de),i(ve),i(A)),i(u),G(h,e),G(d,e),G(S,e),G(M,e),G(O,e),G(P,e),G(I,e)}}}const Re='{"title":"Basic SSO","local":"basic-sso","sections":[{"title":"How it works","local":"how-it-works","sections":[],"depth":2},{"title":"Getting started","local":"getting-started","sections":[],"depth":2},{"title":"User provisioning","local":"user-provisioning","sections":[],"depth":2},{"title":"SSO features","local":"sso-features","sections":[],"depth":2}],"depth":1}';function Je(Se){return Ge(()=>{new URLSearchParams(window.location.search).get("fw")}),[]}class tt extends Ue{constructor(u){super(),Ae(this,u,Je,Ye,Fe,{})}}export{tt as component};