SSO & SAML

Configure enterprise single sign-on using SAML 2.0.

Add LH42 as a SAML application in your IdP:

Setting	Value
ACS URL	`https://app.lakehouse42.com/auth/saml/callback`
Entity ID	`https://app.lakehouse42.com`
Name ID	Email address

- IdP SSO URL

- IdP Entity ID

- X.509 Certificate

- email → User email

- firstName → First name

- lastName → Last name

- groups → Role assignment (optional)

Click "Test SSO" to verify configuration.

email → user.email
firstName → user.firstName
lastName → user.lastName

Once configured, enforce SSO for all users:

python

client.settings.update({
    "sso_required": True,
    "allowed_email_domains": ["yourcompany.com"]
})

"Invalid signature": Ensure certificate is correctly formatted

"User not found": Check email attribute mapping

"Access denied": Verify user is assigned to the app in IdP