Skip to main content

Configuring SSO

Configuring Single Sign On (SSO) for an Anyscale organization requires two distinct steps:

  1. Configuring the Identity Provider (IdP). This is Okta, Ping Identity or a similar service.
  2. Configuring the Service Provider (SP). This is Anyscale.

IdP Configuration

The exact steps to configure an IdP vary between provider. Ensure that all steps are completed before moving on to configure Anyscale. If your organization uses an IdP other than the following, please contact Anyscale support as additional allow-listing may be necessary.

After you complete IdP configuration, continue with SP Configuration.

  1. Log in to your organization's admin Okta account, this is the admin-<organization> domain.

  2. Navigate to the “Applications tab.

  3. Create a new app integration by clicking the Create App Integration button and select the SAML 2.0 option. SAML 2.0

  4. Add an appropriate App Name and (optionally) App logo. App Name

  5. Continue to the Configure SAML page and fill out the following two fields:

  • Single sign-on URL: Find your organization_id here.<organization_id>/saml_acs
  • Audience URI (SP Entity ID): Note that the trailing / is required.

Advanced SAML Configuration

  1. Scroll down and fill out the Attribute Statements. Anyscale requires that email, name and username attributes are provided. The source of each value is not important to Anyscale. Advanced SAML Attributes

  2. Finish application configuration by clicking next and completing the Feedback page.

  3. Ensure that your integration is active and assign appropriate users to the application.

SP Configuration (Anyscale)

Only Anyscale Organization administrators can configure SSO. Ensure that you are signed in with the appropriate account before continuing.

  1. Acquire the idp_metadata_url (a URL used to retrieve your IdPs metadata) or static_idp_config (static metadata for your IdP, fields shown below) from your IdP. The metadata URL is preferred as it is easier to include and will not require reconfiguration in the future. If you are not using one of the 4 providers used in this guide, collect the required information and skip to step 3.
"idp_entity_id": "string",
"idp_sso_url": "string",
"idp_sso_binding": "string",
"idp_x509cert": "string"
  1. Okta supports an idp_metadatal_url for sign-on. Navigate to your applications Sign On tab and copy the Metadata URL field for use in the next step.

SSO Config

  1. Navigate to the API docs page
  1. Create (or update) your organization's SSO configuration with the /sso_configs/ endpoint (titled Upsert Sso Config). Use only the idp_metadata_url field or the static_idp_config field depending on what your IdP supports.

SSO Config

  1. Click Execute and ensure that the server response is 200.

  2. Enable SSO for your Anyscale organization with the /organizations/{organization_id} endpoint (titled Partial Organization Update). Specify your organization's ID in the path field and select the sso_mode to enforce. The three possible values of sso_mode are listed below. It is recommended to start with optional and move to required once you have verified that SSO is working as expected.

  • off: SSO login is not enabled for your organization.
  • optional: SSO login is optional for your organization. Users normally log in with SSO, but can also log in with a password.
  • required: SSO login is the only way for users to log in to your organization.

When SSO is made required, the current SSO configuration will be the only way for most users to log into the organization. Organization Admins can always log in with Anyscale with a password. If you are not 100% confident that the SSO configuration is correct, or if you need to use a username/password for service accounts, use the string optional mode.

SSO Mode

  1. Click Execute and ensure that the server response is 200.

  2. Log in to Anyscale (preferably in a separate browser or in a private browsing window) to verify that the SSO log in flow with your IdP works as expected.

Fallback Access

Anyscale Organization admins always have the ability to log in to Anyscale with a username and password. This is a fallback mechanism in case SSO is unavailable or misconfigured. Admins can log in with the following CURL command:

curl -X POST \
-H 'Content-Type: application/json' \
-d '{"email": "<email>", "password": "<password>", "organization_id": "<organization_id>"}'

Logging in with SSO

Once SSO is configured, there are two ways users can log in to Anyscale: IdP initiated and SP initiated.

IdP Initiated

The IdP initiated flow begins from your identity provider (for example, Okta or Azure AD). Log in to your IdPs website and select the link for Anyscale. If Anyscale is not visible, ensure that your user has been assigned to the application.


First-time Anyscale users must use the IdP initiated flow to log in to Anyscale in order to trigger just-in-time account creation.

SP Initiated

The SP initiated flow begins on the Anyscale homepage. Insert your work email and click Next. You should be automatically redirected to your IdP and then back to Anyscale.