import{s as et,n as tt,o as it}from"../chunks/scheduler.9cda857a.js";import{S as st,i as nt,e as o,s as n,c as u,r as Ke,h as lt,a,d as i,b as l,f as Me,g as d,j as r,u as Xe,k as M,l as c,m as s,n as m,t as f,o as h,p as v}from"../chunks/index.f47f3121.js";import{C as ot}from"../chunks/CopyLLMTxtMenu.676ed699.js";import{C as at}from"../chunks/CodeBlock.24d62f98.js";import{H as J,E as rt}from"../chunks/MermaidChart.svelte_svelte_type_style_lang.64d112fc.js";function gt(Ae){let p,X,Y,ee,y,te,H,ie,x,Ie="In this guide, we will use Google Workspace as the SSO provider and with the Security Assertion Markup Language (SAML) protocol as our preferred identity protocol.",se,_,Ue='We currently support SP-initiated and IdP-initiated authentication. User provisioning is part of Enterprise Plus’s <a href="./enterprise-hub-advanced-sso">Advanced SSO</a>.',ne,$,Ge='<p>This feature is part of the <a href="https://huggingface.co/enterprise">Team &amp; Enterprise</a> plans.</p>',le,E,oe,A,Oe="<li>In your Google Workspace admin console, navigate to <code>Admin</code> &gt; <code>Apps</code> &gt; <code>Web and mobile apps</code>.</li> <li>Click <code>Add app</code> and then <code>Add custom SAML app</code>.</li> <li>You must provide a name for your application in the “App name” field.</li> <li>Click <code>Continue</code>.</li>",ae,L,Fe='<img class="block dark:hidden" src="https://huggingface.co/datasets/huggingface/documentation-images/resolve/main/hub/sso/sso-google-saml-app-details.png"/> <img class="hidden dark:block" src="https://huggingface.co/datasets/huggingface/documentation-images/resolve/main/hub/sso/sso-google-saml-app-details-dark.png"/>',re,I,ge,g,q,Pe="The next screen in the Google setup contains the SSO information for your application.",ye,z,je="In your Hugging Face organization settings, go to the <code>SSO</code> tab and select the <code>SAML</code> protocol.",He,B,Re="Copy the <strong>SSO URL</strong> from Google into the <strong>Sign-on URL</strong> field on Hugging Face.",xe,S,_e,Q,De="Certificate",Ee,U,ce,w,We='<img class="block dark:hidden" src="https://huggingface.co/datasets/huggingface/documentation-images/resolve/main/hub/sso/sso-google-saml-idp-details.png"/> <img class="hidden dark:block" src="https://huggingface.co/datasets/huggingface/documentation-images/resolve/main/hub/sso/sso-google-saml-idp-details-dark.png"/>',pe,G,Ne="<li>In the Google Workspace setup, click <code>Continue</code>.</li>",ue,O,de,F,Ve=`<li>In the “Service provider details” screen, you’ll need the <code>Assertion Consumer Service URL</code> and <code>SP Entity ID</code> from your Hugging Face SSO settings. Copy them into the corresponding <code>ACS URL</code> and <code>Entity ID</code> fields in Google.</li> <li>Ensure the following are set:
<ul><li>Check the <strong>Signed response</strong> box.</li> <li>Name ID format: <code>EMAIL</code></li> <li>Name ID: <code>Basic Information &gt; Primary email</code></li></ul></li>`,me,b,qe='<img class="block dark:hidden" src="https://huggingface.co/datasets/huggingface/documentation-images/resolve/main/hub/sso/sso-google-saml-sp-details.png"/> <img class="hidden dark:block" src="https://huggingface.co/datasets/huggingface/documentation-images/resolve/main/hub/sso/sso-google-saml-sp-details-dark.png"/>',fe,P,ze="<li>Click <code>Continue</code>.</li>",he,j,ve,R,Be='<li>On the “Attribute mapping” screen, click <code>Add mapping</code> and configure the attributes you want to send. This step is optional and depends on whether you want to use <a href="./security-sso#role-mapping">Role Mapping</a> or <a href="./security-sso#resource-group-mapping">Resource Group Mapping</a> on Hugging Face.</li>',$e,C,Qe='<img class="block dark:hidden" src="https://huggingface.co/datasets/huggingface/documentation-images/resolve/main/hub/sso/sso-google-saml-attribute-mapping.png"/> <img class="hidden dark:block" src="https://huggingface.co/datasets/huggingface/documentation-images/resolve/main/hub/sso/sso-google-saml-attribute-mapping-dark.png"/>',Le,D,Je="<li>Click <code>Finish</code>.</li>",Se,W,we,T,Ye="<p>Before testing, ensure you have granted access to the application for the appropriate users in the Google Workspace admin console under the app’s “User access” settings. The admin performing the test must have access. It may take a few minutes for user access changes to apply on Google Workspace.</p>",be,N,Ze='<li>Now, in your Hugging Face SSO settings, click on <strong>“Update and Test SAML configuration”</strong>.</li> <li>You should be redirected to your Google login prompt. Once logged in, you’ll be redirected to your organization’s settings page.</li> <li>A green check mark near the SAML selector will confirm that the test was successful.</li> <li>Once the test is successful, you can enable SSO for your organization by clicking the “Enable” button.</li> <li>Once enabled, members of your organization must complete the SSO authentication flow described in the <a href="./security-sso#how-does-it-work">How does it work?</a> section.</li>',Ce,V,Te,Z,ke;return y=new ot({props:{containerStyle:"float: right; margin-left: 10px; display: inline-flex; position: relative; z-index: 10;"}}),H=new J({props:{title:"How to configure SAML SSO with Google Workspace",local:"how-to-configure-saml-sso-with-google-workspace",headingTag:"h1"}}),E=new J({props:{title:"Step 1: Create SAML App in Google Workspace",local:"step-1-create-saml-app-in-google-workspace",headingTag:"h3"}}),I=new J({props:{title:"Step 2: Configure Hugging Face with Google’s IdP Details",local:"step-2-configure-hugging-face-with-googles-idp-details",headingTag:"h3"}}),U=new at({props:{code:"LS0tLS1CRUdJTiUyMENFUlRJRklDQVRFLS0tLS0lMEElN0JjZXJ0aWZpY2F0ZSU3RCUwQS0tLS0tRU5EJTIwQ0VSVElGSUNBVEUtLS0tLQ==",highlighted:`<span class="hljs-literal">-----</span><span class="hljs-comment">BEGIN CERTIFICATE</span><span class="hljs-literal">-----</span>
<span class="hljs-comment">{certificate}</span>
<span class="hljs-literal">-----</span><span class="hljs-comment">END CERTIFICATE</span><span class="hljs-literal">-----</span>`,wrap:!1}}),O=new J({props:{title:"Step 3: Configure Google with Hugging Face’s SP Details",local:"step-3-configure-google-with-hugging-faces-sp-details",headingTag:"h3"}}),j=new J({props:{title:"Step 4: Attribute Mapping",local:"step-4-attribute-mapping",headingTag:"h3"}}),W=new J({props:{title:"Step 5: Test and Enable SSO",local:"step-5-test-and-enable-sso",headingTag:"h3"}}),V=new rt({props:{source:"https://github.com/huggingface/hub-docs/blob/main/docs/hub/security-sso-google-saml.md"}}),{c(){p=o("meta"),X=n(),Y=o("p"),ee=n(),u(y.$$.fragment),te=n(),u(H.$$.fragment),ie=n(),x=o("p"),x.textContent=Ie,se=n(),_=o("p"),_.innerHTML=Ue,ne=n(),$=o("blockquote"),$.innerHTML=Ge,le=n(),u(E.$$.fragment),oe=n(),A=o("ul"),A.innerHTML=Oe,ae=n(),L=o("div"),L.innerHTML=Fe,re=n(),u(I.$$.fragment),ge=n(),g=o("ul"),q=o("li"),q.textContent=Pe,ye=n(),z=o("li"),z.innerHTML=je,He=n(),B=o("li"),B.innerHTML=Re,xe=n(),S=o("li"),_e=Ke("Copy the "),Q=o("strong"),Q.textContent=De,Ee=Ke(` from Google into the corresponding field on Hugging Face. The public certificate must have the following format:

	`),u(U.$$.fragment),ce=n(),w=o("div"),w.innerHTML=We,pe=n(),G=o("ul"),G.innerHTML=Ne,ue=n(),u(O.$$.fragment),de=n(),F=o("ul"),F.innerHTML=Ve,me=n(),b=o("div"),b.innerHTML=qe,fe=n(),P=o("ul"),P.innerHTML=ze,he=n(),u(j.$$.fragment),ve=n(),R=o("ul"),R.innerHTML=Be,$e=n(),C=o("div"),C.innerHTML=Qe,Le=n(),D=o("ul"),D.innerHTML=Je,Se=n(),u(W.$$.fragment),we=n(),T=o("blockquote"),T.innerHTML=Ye,be=n(),N=o("ul"),N.innerHTML=Ze,Ce=n(),u(V.$$.fragment),Te=n(),Z=o("p"),this.h()},l(e){const t=lt("svelte-u9bgzb",document.head);p=a(t,"META",{name:!0,content:!0}),t.forEach(i),X=l(e),Y=a(e,"P",{}),Me(Y).forEach(i),ee=l(e),d(y.$$.fragment,e),te=l(e),d(H.$$.fragment,e),ie=l(e),x=a(e,"P",{"data-svelte-h":!0}),r(x)!=="svelte-1re6lbe"&&(x.textContent=Ie),se=l(e),_=a(e,"P",{"data-svelte-h":!0}),r(_)!=="svelte-ptotpm"&&(_.innerHTML=Ue),ne=l(e),$=a(e,"BLOCKQUOTE",{class:!0,"data-svelte-h":!0}),r($)!=="svelte-16y0s3r"&&($.innerHTML=Ge),le=l(e),d(E.$$.fragment,e),oe=l(e),A=a(e,"UL",{"data-svelte-h":!0}),r(A)!=="svelte-1pjidn1"&&(A.innerHTML=Oe),ae=l(e),L=a(e,"DIV",{class:!0,"data-svelte-h":!0}),r(L)!=="svelte-cw39ln"&&(L.innerHTML=Fe),re=l(e),d(I.$$.fragment,e),ge=l(e),g=a(e,"UL",{});var k=Me(g);q=a(k,"LI",{"data-svelte-h":!0}),r(q)!=="svelte-1xyr0wf"&&(q.textContent=Pe),ye=l(k),z=a(k,"LI",{"data-svelte-h":!0}),r(z)!=="svelte-10qerlp"&&(z.innerHTML=je),He=l(k),B=a(k,"LI",{"data-svelte-h":!0}),r(B)!=="svelte-hv1hrv"&&(B.innerHTML=Re),xe=l(k),S=a(k,"LI",{});var K=Me(S);_e=Xe(K,"Copy the "),Q=a(K,"STRONG",{"data-svelte-h":!0}),r(Q)!=="svelte-1owsfwr"&&(Q.textContent=De),Ee=Xe(K,` from Google into the corresponding field on Hugging Face. The public certificate must have the following format:

	`),d(U.$$.fragment,K),K.forEach(i),k.forEach(i),ce=l(e),w=a(e,"DIV",{class:!0,"data-svelte-h":!0}),r(w)!=="svelte-1elp7zv"&&(w.innerHTML=We),pe=l(e),G=a(e,"UL",{"data-svelte-h":!0}),r(G)!=="svelte-wgov0y"&&(G.innerHTML=Ne),ue=l(e),d(O.$$.fragment,e),de=l(e),F=a(e,"UL",{"data-svelte-h":!0}),r(F)!=="svelte-mwyiwd"&&(F.innerHTML=Ve),me=l(e),b=a(e,"DIV",{class:!0,"data-svelte-h":!0}),r(b)!=="svelte-1yuxb1d"&&(b.innerHTML=qe),fe=l(e),P=a(e,"UL",{"data-svelte-h":!0}),r(P)!=="svelte-11k38sj"&&(P.innerHTML=ze),he=l(e),d(j.$$.fragment,e),ve=l(e),R=a(e,"UL",{"data-svelte-h":!0}),r(R)!=="svelte-lricn"&&(R.innerHTML=Be),$e=l(e),C=a(e,"DIV",{class:!0,"data-svelte-h":!0}),r(C)!=="svelte-1754t6v"&&(C.innerHTML=Qe),Le=l(e),D=a(e,"UL",{"data-svelte-h":!0}),r(D)!=="svelte-aioer9"&&(D.innerHTML=Je),Se=l(e),d(W.$$.fragment,e),we=l(e),T=a(e,"BLOCKQUOTE",{class:!0,"data-svelte-h":!0}),r(T)!=="svelte-m6bm4q"&&(T.innerHTML=Ye),be=l(e),N=a(e,"UL",{"data-svelte-h":!0}),r(N)!=="svelte-1jihcwc"&&(N.innerHTML=Ze),Ce=l(e),d(V.$$.fragment,e),Te=l(e),Z=a(e,"P",{}),Me(Z).forEach(i),this.h()},h(){M(p,"name","hf:doc:metadata"),M(p,"content",ct),M($,"class","warning"),M(L,"class","flex justify-center"),M(w,"class","flex justify-center"),M(b,"class","flex justify-center"),M(C,"class","flex justify-center"),M(T,"class","warning")},m(e,t){c(document.head,p),s(e,X,t),s(e,Y,t),s(e,ee,t),m(y,e,t),s(e,te,t),m(H,e,t),s(e,ie,t),s(e,x,t),s(e,se,t),s(e,_,t),s(e,ne,t),s(e,$,t),s(e,le,t),m(E,e,t),s(e,oe,t),s(e,A,t),s(e,ae,t),s(e,L,t),s(e,re,t),m(I,e,t),s(e,ge,t),s(e,g,t),c(g,q),c(g,ye),c(g,z),c(g,He),c(g,B),c(g,xe),c(g,S),c(S,_e),c(S,Q),c(S,Ee),m(U,S,null),s(e,ce,t),s(e,w,t),s(e,pe,t),s(e,G,t),s(e,ue,t),m(O,e,t),s(e,de,t),s(e,F,t),s(e,me,t),s(e,b,t),s(e,fe,t),s(e,P,t),s(e,he,t),m(j,e,t),s(e,ve,t),s(e,R,t),s(e,$e,t),s(e,C,t),s(e,Le,t),s(e,D,t),s(e,Se,t),m(W,e,t),s(e,we,t),s(e,T,t),s(e,be,t),s(e,N,t),s(e,Ce,t),m(V,e,t),s(e,Te,t),s(e,Z,t),ke=!0},p:tt,i(e){ke||(f(y.$$.fragment,e),f(H.$$.fragment,e),f(E.$$.fragment,e),f(I.$$.fragment,e),f(U.$$.fragment,e),f(O.$$.fragment,e),f(j.$$.fragment,e),f(W.$$.fragment,e),f(V.$$.fragment,e),ke=!0)},o(e){h(y.$$.fragment,e),h(H.$$.fragment,e),h(E.$$.fragment,e),h(I.$$.fragment,e),h(U.$$.fragment,e),h(O.$$.fragment,e),h(j.$$.fragment,e),h(W.$$.fragment,e),h(V.$$.fragment,e),ke=!1},d(e){e&&(i(X),i(Y),i(ee),i(te),i(ie),i(x),i(se),i(_),i(ne),i($),i(le),i(oe),i(A),i(ae),i(L),i(re),i(ge),i(g),i(ce),i(w),i(pe),i(G),i(ue),i(de),i(F),i(me),i(b),i(fe),i(P),i(he),i(ve),i(R),i($e),i(C),i(Le),i(D),i(Se),i(we),i(T),i(be),i(N),i(Ce),i(Te),i(Z)),i(p),v(y,e),v(H,e),v(E,e),v(I,e),v(U),v(O,e),v(j,e),v(W,e),v(V,e)}}}const ct='{"title":"How to configure SAML SSO with Google Workspace","local":"how-to-configure-saml-sso-with-google-workspace","sections":[{"title":"Step 1: Create SAML App in Google Workspace","local":"step-1-create-saml-app-in-google-workspace","sections":[],"depth":3},{"title":"Step 2: Configure Hugging Face with Google’s IdP Details","local":"step-2-configure-hugging-face-with-googles-idp-details","sections":[],"depth":3},{"title":"Step 3: Configure Google with Hugging Face’s SP Details","local":"step-3-configure-google-with-hugging-faces-sp-details","sections":[],"depth":3},{"title":"Step 4: Attribute Mapping","local":"step-4-attribute-mapping","sections":[],"depth":3},{"title":"Step 5: Test and Enable SSO","local":"step-5-test-and-enable-sso","sections":[],"depth":3}],"depth":1}';function pt(Ae){return it(()=>{new URLSearchParams(window.location.search).get("fw")}),[]}class vt extends st{constructor(p){super(),nt(this,p,pt,gt,et,{})}}export{vt as component};
