Skip to main content
Go to documentation:
⌘U
Weaviate Database

Develop AI applications using Weaviate's APIs and tools

Deploy

Deploy, configure, and maintain Weaviate Database

Query Agent

Run agentic search over your Weaviate Cloud collections

Weaviate Cloud

Manage and scale Weaviate in the cloud

Engram

Persistent memory for LLM agents and applications

Additional resources

Integrations
Weaviate Academy

Need help?

Weaviate LogoAsk AI Assistant⌘K
Support
Community Forum
Contributor guide

Single sign-on (SSO)

With single sign-on (SSO), members sign in through your identity provider instead of a Weaviate Cloud password. Weaviate Cloud supports SAML SSO. OIDC is not supported.

SSO is available to Managed organizations (organizations on a Weaviate-managed contract). Only organization Owners can see and change SSO. Admins, Editors, and Viewers do not see the setting. See User roles.

info

SSO controls how people sign in to the Weaviate Cloud console. It does not affect cluster API keys. For cluster access, see Authentication.

Before you start​

  • You are an Owner of a Managed organization (an organization on a Weaviate-managed contract).
  • You have admin access to your identity provider and can exchange SAML metadata with it.
  • You can add a DNS TXT record for each company email domain.
tip

Before you configure SSO, check that each Owner can sign in through the identity provider.

Set up SSO​

  1. Open the Weaviate Cloud console.
  2. On the Overview page, open Organization settings.
  3. Click the SSO Configuration tab.
  4. In the SAML Single Sign-On panel, click Configure SSO.
  5. If the console shows a warning, read it and confirm.
  6. The SSO setup page opens in a new browser tab. The setup link is valid for 24 hours.
  7. Follow the setup page to connect your identity provider and verify your email domains.
  8. Return to the console tab.
caution

  • Members are on different email domains: Some members use email domains that SSO will not cover. These members lose access to the organization when SSO is enforced. The dialog says they "could lose access once SSO is enforced". The console does not remove anyone from the organization.

  • MFA enforcement will be turned off: This warning shows if the organization enforces MFA. Completing SSO setup turns MFA enforcement off. See MFA enforcement and SSO.

How members sign in​

Members can sign in with SSO in two ways:

  • On the Weaviate Cloud sign-in page, the member enters their work email address. The page sends them to the identity provider. There is no password option.
  • The member opens the organization's SSO Sign-in URL and clicks Log in with SSO.

Invite links to the organization also lead to the SSO sign-in.

SSO sign-ins never ask for a Weaviate Cloud MFA code. See MFA enforcement and SSO.

caution

After a person's first SSO sign-in, their Weaviate Cloud account signs in with SSO only. Email and password sign-in and Google sign-in stop working for that account. This applies in every organization the person belongs to.

A person without a Weaviate Cloud account gets a new account at their first SSO sign-in. They join the organization as a Viewer. An Owner can change the role later. Existing members keep their role. See User roles.

Invite members​

While SSO is on, Owners and Admins can invite only email addresses on the SSO domains. If you enter another address, the Invite user dialog shows "This email can't be invited".

To invite a member, see Add a user.

Change SSO settings​

On the SSO Configuration tab, click Update SSO. The setup page opens again. There you can change the identity provider settings or the email domains.

Turn off SSO​

caution

You cannot turn off SSO in the console. To turn off SSO, contact Weaviate support.

After SSO is turned off, MFA enforcement stays off. See MFA enforcement and SSO.

If someone is locked out​

Some examples of a lockout:

  • An Owner cannot sign in because the identity provider is not working.
  • A member cannot sign in because their email address is not on an SSO domain.

There is no self-service way around SSO. Contact Weaviate support.

Further resources​

Support​

If you use Weaviate Cloud (Database cluster(s) or Weaviate product in the cloud) or have a self-hosted support package, open a ticket in the Support Portal or email Weaviate support directly. To add a support plan, contact Weaviate sales.

Use the Support Portal for direct help from the Weaviate team: open and track tickets, and we'll respond in line with your support plan. The Community Forum is open to everyone, and a great place to ask questions, get help with your cluster, and connect with other developers. For all the ways to get help, see the Support overview.

Weaviate Support Portal

Direct help from the Weaviate team for Weaviate Cloud. Open and track tickets in the Support Portal.

Weaviate Community Forum

Ask questions, share ideas, and connect with other developers on our Community forum.

Was this page helpful?