Configure ChatGPT for UserLock Single Sign-On (SSO)

This guide explains how to integrate ChatGPT with UserLock Single Sign-On (SSO) using the SAML 2.0 protocol.

Once configured, ChatGPT logins are authenticated by UserLock against Active Directory, enabling administrators to enforce UserLock access policies (MFA, time, machine, or location restrictions) on ChatGPT sessions.

OpenAI requires at least one verified domain before you can configure SSO.

1. Open the OpenAI Identity page at https://admin.openai.com/identity and sign in with a Global Admin account.

2. In the domain management section, click + Add Domain.

3. Enter the email domain used by your ChatGPT users, for example contoso.com. Enter only the domain, without @, without a protocol, and without an email address.

4. Copy the TXT record name and value generated by OpenAI.

5. Add the TXT record to the DNS zone of your domain.

6. Once the DNS record is available, return to the OpenAI Identity page and click Check or Verify, depending on the label displayed in your portal.

The domain must appear with the status Verified before you continue.

1. On the OpenAI Identity page, click Set up SSO.

2. On the identity provider selection page, select Custom SAML.

3. Enter a name for the identity provider, for example UserLock SSO.

4. Click Continue.

5. Copy the two values displayed by OpenAI:

   • Assertion consumer service (ACS) URL

   • Service provider entity ID

Keep this page open. You will enter both values in UserLock in the next step.

1. In the UserLock console, go to ⚙️ Server settings ▸ Single Sign-On.

2. In the application list, select OpenAI.

3. Complete the application profile with the values from OpenAI:

   Settings	Values
   Email domain	The verified domain used by your ChatGPT users, without @ or a protocol. For example contoso.com
   Issuer	The Service provider entity ID provided by OpenAI
   ACS URL	The Assertion consumer service (ACS) URL provided by OpenAI

4. Save the profile.

Your UserLock SSO URL is displayed in ⚙️ Server settings ▸ Single Sign-On. In this guide, <SSO_address> is that URL without the protocol. For https://sso.contoso.com, the SSO address is sso.contoso.com.

Return to the OpenAI SSO configuration wizard and continue to Set Identity Provider Metadata. Use one of the two methods below.

1. Select Dynamic configuration.

2. In Identity provider metadata URL, enter https://<SSO_address>/metadata.

3. Click Continue.

OpenAI retrieves the UserLock identity provider endpoints and signing certificate from the metadata, so no certificate has to be uploaded manually.

Use manual configuration if OpenAI cannot retrieve the UserLock metadata URL.

1. Select Manual configuration.

2. Complete the fields with the following values:

   OpenAI field	Value
   Identity provider Single Sign-On URL	https://<SSO_address>/saml/sso
   Identity provider issuer	https://<SSO_address>
   X.509 certificate	The UserLock SAML certificate

3. In the UserLock console, go to ⚙️ Server settings ▸ Single Sign-On, click Download ▸ SAML certificate and save the file.

4. Return to OpenAI and upload the file in X.509 certificate.

5. Click Continue.

With a UserLock SSO URL of https://sso.contoso.com, the Single Sign-On URL is https://sso.contoso.com/saml/sso and the issuer is https://sso.contoso.com.

1. The OpenAI wizard then prompts for SAML attributes and an application link. Keep the default attribute configuration, leave the application link unconfigured, and continue to Test Single Sign-On.

2. Click Continue to sign-in in an incognito or private browser window.

3. Authenticate through UserLock with a test account that uses the verified email domain, exists in Active Directory, and is already a member of, or has an invitation to, the ChatGPT workspace.

4. Confirm that authentication succeeds and that the user reaches the ChatGPT workspace. OpenAI then displays the connection as Connection activated.

5. From the activated connection page, click Test sign-in once more to confirm that the completed connection remains operational.

Creating the SAML connection does not disable password sign-in. Configure enforcement only after the connection has been tested successfully.

1. Open https://admin.openai.com/identity.

2. Go to Access ▸ Single Sign-On (SSO).

3. Click Manage SSO.

4. Configure the following settings:

   Setting	Recommended configuration
   ChatGPT SSO settings	Keep Optional while testing. Change to Required only after SSO has been validated with the relevant users
   Admin portal SSO settings	Keep Optional so a Global Admin retains a recovery method if the identity provider becomes unavailable

When ChatGPT SSO settings is set to Required, users from the verified domain who belong to the workspace must authenticate through UserLock. Password and social sign-in methods are no longer available for that workspace.

When you renew the UserLock SAML certificate, handle OpenAI during the SaaS application update step of the Renew the SAML certificate procedure.

Connections created with Dynamic configuration retrieve the new certificate from the UserLock metadata, so no action is required. Confirm that the metadata URL is still https://<SSO_address>/metadata.

Connections created with Manual configuration must be updated:

1. In the UserLock console, go to ⚙️ Server settings ▸ Single Sign-On and click Download ▸ SAML certificate.

2. Open https://admin.openai.com/identity, click Manage SSO and open the active connection.

3. Replace the existing X.509 certificate.

4. Click Test sign-in and confirm that authentication succeeds.

Reset the connection when the existing SAML configuration cannot be edited and must be recreated.

1. Open https://admin.openai.com/identity.

2. Go to Access ▸ Single Sign-On (SSO) and click Manage SSO.

3. Open the existing connection, click Reset connection and confirm.

4. Create the Custom SAML connection again, then copy the newly generated Assertion consumer service (ACS) URL and Service provider entity ID.

5. In the UserLock console, go to ⚙️ Server settings ▸ Single Sign-On and open the OpenAI profile.

6. Replace the existing values:

   UserLock setting	New OpenAI value
   Issuer	New Service provider entity ID
   ACS URL	New Assertion consumer service (ACS) URL

7. Save the UserLock profile.

8. Complete the OpenAI wizard and test the connection again before making SSO required.

For common issues, see Troubleshooting SSO.

If the problem persists, contact IS Decisions Support.

Confirm that you are signed in as an OpenAI Global Admin, that the TXT record name and value match the values provided by OpenAI, that the record is publicly available through a DNS lookup, and that the domain has not already been verified in another OpenAI Admin Portal. Allow up to 24 hours for DNS propagation.

If + Add Domain is unavailable, or OpenAI displays a message asking you to contact Support, contact OpenAI Support at https://help.openai.com.

Open https://<SSO_address>/metadata from a browser outside your internal network. It must be reachable over HTTPS and return the UserLock SAML metadata. If it is not, check the external DNS record for the UserLock SSO address, the HTTPS binding and SSL certificate, and any network rule blocking external access. Use Manual configuration in OpenAI while the metadata access issue is corrected.

The X.509 certificate configured in OpenAI does not match the certificate used by UserLock to sign the SAML response. This occurs after a SAML certificate renewal on a connection created with Manual configuration: connections using Dynamic configuration retrieve the new certificate from the metadata and need no update.

1. In the UserLock console, go to ⚙️ Server settings ▸ Single Sign-On.

2. Click Download ▸ SAML certificate.

3. Upload this certificate to the OpenAI SSO connection.

4. Click Test sign-in and confirm that authentication succeeds.

Use a Global Admin account, which can still reach the Admin Console as long as Admin portal SSO settings remains Optional.

1. Open https://admin.openai.com/identity.

2. Go to Access ▸ Single Sign-On (SSO) ▸ Manage SSO.

3. Change ChatGPT SSO settings from Required to Optional while the issue is investigated.

If no Global Admin can access the portal, contact OpenAI Support at https://help.openai.com.

You can extend the security of SSO sessions by applying UserLock access policies in addition to authentication.

• Apply MFA on SaaS connections to require stronger authentication.

• Hour restrictions: define when users are allowed to connect.

• Geolocation rules: enforce access policies based on user location.

• Session limits: allow or deny SaaS logins entirely for specific users.