Configure SAML 2.0 for Claude

This guide provides instructions on configuring SAML 2.0 Single Sign-On (SSO) for the Claude app.

Contents

• Supported features
• Prerequisites
• Configuration steps
• Verify SP-initiated SSO
• Verify IdP-initiated SSO

---

Supported features

The Claude SAML integration currently supports the following features:

• SP-initiated SSO
• IdP-initiated SSO

Prerequisites

• Ensure that you have an Okta admin role with permission to manage apps.
• Ensure that you're an Owner or Primary Owner (for Team or Enterprise plans) or an Admin (for Console) in Claude.

Configuration steps

Initiate setup in Claude

1. Sign in to your Claude account as an Owner/Primary Owner or Admin.
2. Access your settings:
   • For Team/Enterprise plans, go to Organization settings (claude.ai/admin-settings/organization).
   • For Console, go to Identity and access settings (platform.claude.com/settings/identity).
3. In the Domains section, click Add or edit domains. Verify your company domain by adding the provided TXT record to your DNS provider, and wait until the green Verified badge appears.
4. In the Authentication section, click Setup SSO or Manage SSO. The WorkOS setup dialog opens.
5. Locate the page that displays your Single sign-on URL and Audience URI (SP Entity ID). Leave this page open.

Integrate the app in Okta

1. In the Admin Console, go to Applications > Applications.
2. Click Browse App Catalog.
3. Search for and select the Claude app.
4. Click Add Integration.
5. On the General Settings tab, enter an app label and click Done.
6. Go to the Sign On tab and click Edit.
7. In Sign-on methods, select SAML 2.0.
8. In Advanced Sign-on Settings, enter the values from the Claude/WorkOS page:
   • ACS URL: Paste the ACS URL provided by WorkOS.
   • SP Entity ID: Paste the SP Entity ID provided by WorkOS.
9. Click Save.
10. In the Metadata details section, select your preferred configuration type:
    • Dynamic configuration: Copy the Metadata URL.
    • Manual configuration: Copy the Sign on URL and Issuer, and then download the signing certificate.

Finalize setup in Claude

1. Return to the Claude/WorkOS dashboard.
2. In the Identity provider configuration section, click Edit configuration.
3. Provide your Okta configuration details:
   • If you selected Dynamic configuration, paste the Metadata URL that you copied earlier.
   • If you selected Manual configuration, enter the Identity provider Single Sign-On URL and Identity provider issuer, and then upload the signing certificate.
4. Click Save configuration.
5. In Okta, ensure that users are assigned to the Claude app on the Assignments tab.
6. Return to the Claude settings and click Test sign-in to verify the connection.
7. Once successful, select Require SSO for Claude, Require SSO for Console, or both, to enforce SSO.

Verify SP-initiated SSO

1. Go to https://claude.ai (for Team/Enterprise) or https://platform.claude.com (for Console).
2. Enter your email address and click Continue with SSO.
3. The browser redirects you to your org's Okta sign-in page.

Verify IdP-initiated SSO

1. Ensure the app is assigned to the user in Okta.
2. Verify that the user can see the Claude app integration on their Okta End-User Dashboard.
3. Click the Claude app integration to log the user into Claude using SAML.