> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.nvidia.com/sdgm/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.nvidia.com/sdgm/_mcp/server.

# SSO Configuration Guide

Kumo uses Auth0 to support a variety of secure single-sign-on mechanisms to simplify user management for your team. The two easiest integrations are:

1. Google Workspace Single Sign On
2. OIDC - OpenID Connect - supporting many other services including Okta and Azure Active Directory

![SSO configuration options in Kumo](https://fdr-prod-docs-files-public.s3.us-east-1.amazonaws.com/nvidia-sdgm.docs.buildwithfern.com/2282d7f3536c4ee0622e2d4b68539f95cd02dcbae4be0567ed2c4145129213ff/images/SSOConfigurationGuideImage.png?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Content-Sha256=UNSIGNED-PAYLOAD&X-Amz-Credential=AKIA6KXJSKKNFOCF7G4B%2F20260920%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20260920T154542Z&X-Amz-Expires=604800&X-Amz-Signature=4cd8b4630958a821d6b529bffea985f97f41b08376d4152c97e9b2914d8fba31&X-Amz-SignedHeaders=host&x-amz-checksum-mode=ENABLED&x-id=GetObject)

To enable Google Workspace Single Sign On for your environment, no action is needed on your end. Contact your Kumo point of contact, and it can be enabled within hours.

The remainder of this document describes the process to set up OIDC. For illustration, Okta is used as the OIDC provider, but these instructions work with any other OIDC-compliant auth provider.

## Okta Configuration

1. Go to your Applications and create a new Application with the following settings:
   * Sign-in method: OIDC - OpenID Connect
   * Application type: Single-Page Application

2. Under General Settings, make sure to select Grant types of Authorization Code and Implicit (Hybrid)

![Okta General Settings showing Grant types](file:images/SSOConfigurationGuideImage\(1\).png)

3. Next, add the following sign-in and sign-out URLs
   * Sign In: [https://auth.kumoai.cloud/login/callback](https://auth.kumoai.cloud/login/callback)
   * Sign Out: [https://auth.kumoai.cloud/logout](https://auth.kumoai.cloud/logout)

![Okta sign-in and sign-out URL configuration](https://fdr-prod-docs-files-public.s3.us-east-1.amazonaws.com/nvidia-sdgm.docs.buildwithfern.com/2282d7f3536c4ee0622e2d4b68539f95cd02dcbae4be0567ed2c4145129213ff/images/SSOConfigurationGuideImagecopy.png?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Content-Sha256=UNSIGNED-PAYLOAD&X-Amz-Credential=AKIA6KXJSKKNFOCF7G4B%2F20260920%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20260920T154542Z&X-Amz-Expires=604800&X-Amz-Signature=3260f2d06778e2cd07c9840087e20e8cecfb19ae9a9aa0e4bcd5ec6289072ad3&X-Amz-SignedHeaders=host&x-amz-checksum-mode=ENABLED&x-id=GetObject)

*`NOTE: Use auth.kumoai.cloud instead of kumoai.us.auth0.com as shown in the image above`*

4. Select your preferred Assignment policy

![Okta Assignment policy selection](https://fdr-prod-docs-files-public.s3.us-east-1.amazonaws.com/nvidia-sdgm.docs.buildwithfern.com/afb5002ed430f9bcdfcc815979f349ec6e32c3f607d5484bedcfc66ca1925ff6/images/13e856f-image.png?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Content-Sha256=UNSIGNED-PAYLOAD&X-Amz-Credential=AKIA6KXJSKKNFOCF7G4B%2F20260920%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20260920T154542Z&X-Amz-Expires=604800&X-Amz-Signature=134f376cc95da681852fe117c4aaa4d4d764861bea21dba4da947c45cc4e2e92&X-Amz-SignedHeaders=host&x-amz-checksum-mode=ENABLED&x-id=GetObject)

5. Click **Save** to create the app.
6. Copy the Client ID and your Okta base URL
   * Example Client ID: `0oa654ok0jBdIJrpT5d7`
   * Example Okta URL: `dev-22499602.okta.com`

![Okta Client ID and base URL](file:images/SSOConfigurationGuideImage\(1\)copy.png)

7. Send your Client ID and Okta Base URL to the Kumo team

You receive a notification from Kumo when your SSO onboarding is complete.