Configure ChatGPT for UserLock Single Sign-On (SSO)

Enable ChatGPT Single Sign-On (SSO) with UserLock to centralize authentication, enforce corporate access policies, and simplify access to your ChatGPT workspace.

Publié le 17 août 2026
Ressources utiles

Introduction

This guide explains how to integrate ChatGPT with UserLock Single Sign-On (SSO) using the SAML 2.0 protocol.

Once configured, ChatGPT logins are authenticated by UserLock against Active Directory. This provides users with a seamless sign-in experience and allows administrators to enforce UserLock access policies, including MFA, time, machine, and location restrictions, on SSO sessions.

🚩️ Before starting:

  • You need a ChatGPT Business, Enterprise, or Edu workspace with access to the OpenAI Global Admin Console.

  • You must be a Global Admin in OpenAI.

  • You need access to the DNS configuration of the email domain used by your ChatGPT users.

  • UserLock SSO must already be installed and configured.

  • The account used to test SSO must already be a member of, or have an invitation to, the ChatGPT workspace.

⚠️ Important

Do not make SSO required until the complete sign-in flow has been tested successfully.

Step 1. Verify your domain in OpenAI

OpenAI requires at least one verified domain before you can configure SSO.

  1. Open the OpenAI Identity page:

    https://admin.openai.com/identity

  2. Sign in with a Global Admin account.

  3. In the domain management section, click + Add Domain.

  4. Enter the email domain used by your ChatGPT users.

    For example:

    contoso.com

    Enter only the domain. Do not include @, https://, or an email address.

  5. OpenAI generates a DNS verification record. Copy the provided TXT record name and value.

  6. Add the TXT record to the DNS zone of your domain.

  7. Once the DNS record is available, return to the OpenAI Identity page and click Check or Verify, depending on the label displayed in your portal.

The domain should appear with the status Verified.

Note

DNS propagation can take up to 24 hours.

A domain can only be verified in one OpenAI Admin Portal. If the domain has already been verified for another OpenAI organization or workspace, contact OpenAI Support.

Subdomains must be verified separately from their parent domain.

Step 2. Create the SAML connection in OpenAI

  1. On the OpenAI Identity page, click Set up SSO.

  2. On the identity provider selection page, select Custom SAML.

  3. Enter a name for the identity provider.

    For example:

    UserLock SSO

  4. Click Continue.

  5. OpenAI displays the information required to create the SAML application.

Copy the following values:

  • Assertion consumer service (ACS) URL

  • Service provider entity ID

Keep this page open. You will enter these values in UserLock in the next step.

Note

The ACS URL and Service Provider Entity ID are unique to your OpenAI organization. Copy each value exactly as displayed.

OpenAI also displays a Service provider metadata URL. The UserLock OpenAI profile does not require this URL.

Step 3. Configure OpenAI in UserLock SSO

  1. In the UserLock console, go to ⚙️ Server settings ▸ Single Sign-On.

  2. In the application list, select OpenAI.

  3. Complete the application profile with the values from OpenAI:

Settings

Values

Email domain

The verified domain used by your ChatGPT users, without @ or a protocol. For example: contoso.com

Issuer

The Service provider entity ID provided by OpenAI

ACS URL

The Assertion consumer service (ACS) URL provided by OpenAI

  1. Save the profile.

Step 4. Configure UserLock as the identity provider in OpenAI

Return to the OpenAI SSO configuration wizard and continue to Set Identity Provider Metadata.

You can provide the UserLock identity provider information using dynamic or manual configuration.

Your UserLock SSO URL is displayed in:

UserLock console ▸ ⚙️ Server settings ▸ Single Sign-On

For example, if the displayed SSO URL is:

https://sso.contoso.com

then the <SSO_domain> used below is:

sso.contoso.com

Dynamic configuration

Dynamic configuration is the recommended method.

  1. Select Dynamic configuration.

  2. In Identity provider metadata URL, enter:

    https://<SSO_domain>/metadata

    Example:

    https://sso.contoso.com/metadata

  3. Click Continue.

OpenAI retrieves the UserLock identity provider endpoints and signing certificate from the metadata.

To do so, the OpenAI Dynamic configuration field requires the online metadata URL:

https://<SSO_domain>/metadata

Manual configuration

Use manual configuration if OpenAI cannot retrieve the UserLock metadata URL.

  1. Select Manual configuration.

  2. Complete the fields with the following values:

OpenAI field

Value

Identity provider Single Sign-On URL

https://<SSO_domain>/saml/sso

Identity provider issuer

https://<SSO_domain>

X.509 certificate

The UserLock SAML certificate

Example with sso.contoso.com:

OpenAI field

Example value

Identity provider Single Sign-On URL

https://sso.contoso.com/saml/sso

Identity provider issuer

https://sso.contoso.com

To retrieve the X.509 certificate:

  1. In the UserLock console, go to ⚙️ Server settings ▸ Single Sign-On.

  2. Click Download ▸ SAML certificate.

  3. Save the certificate file.

  4. Return to OpenAI and upload the file in X.509 certificate.

  5. Click Continue.

Step 5. Complete and test the SSO configuration

Configure the SAML attributes

  1. Continue to Configure SAML Attributes.

  2. Keep the default attribute configuration displayed by OpenAI.

  3. Click Continue.

Configure the application link

The Application Link step is used for identity-provider-initiated login.

UserLock does not use IdP-initiated login for this integration.

  1. Leave the application link unconfigured.

  2. Click Continue.

Test Single Sign-On

  1. Continue to Test Single Sign-On.

  2. In your incognito or private browser window, click Continue to sign-in.

  3. Authenticate through UserLock with a test account that:

    • Uses the verified email domain.

    • Exists in Active Directory.

    • Is already a member of, or has an invitation to, the ChatGPT workspace.

  4. Confirm that authentication succeeds and that the user reaches the ChatGPT workspace.

After a successful test, OpenAI displays the connection as Connection activated.

  1. From the activated connection page, click Test sign-in once more to confirm that the completed connection remains operational.

Step 6. Configure SSO enforcement

After the connection has been tested successfully, configure how OpenAI applies SSO.

  1. Open:

    https://admin.openai.com/identity

  2. Go to Access ▸ Single Sign-On (SSO).

  3. Click Manage SSO.

  4. Configure the following settings:

Setting

Recommended configuration

ChatGPT SSO settings

Keep Optional while testing. Change to Required only after SSO has been validated with the relevant users.

Admin portal SSO settings

Keep Optional so a Global Admin can retain a recovery method if the identity provider becomes unavailable.

When ChatGPT SSO settings is set to Required, users from the verified domain who belong to the workspace must authenticate through UserLock. Password and social sign-in methods are no longer available for that workspace.

Note

OpenAI shares domain verification and the underlying SAML connection between ChatGPT and the API Platform. SSO must still be enabled and enforced separately for each product. This guide covers ChatGPT.

Update the SAML certificate in OpenAI

When you renew the UserLock SAML certificate, OpenAI must trust the new certificate used to sign SAML responses.

See Renew the SAML certificate for the UserLock renewal procedure.

After renewal:

  1. In the UserLock console, go to ⚙️ Server settings ▸ Single Sign-On.

  2. Click Download ▸ SAML certificate and save the current certificate.

  3. Open:

    https://admin.openai.com/identity

  4. Click Manage SSO and open the active connection.

  5. If the connection uses Manual configuration, replace the existing X.509 certificate with the current UserLock SAML certificate.

  6. If the connection uses Dynamic configuration, confirm that its metadata URL is still:

    https://<SSO_domain>/metadata

  7. Click Test sign-in and confirm that authentication succeeds.

If OpenAI reports Invalid thumbprint, the certificate configured in OpenAI does not match the certificate used by UserLock to sign the SAML response. Upload the current UserLock SAML certificate.

If the existing OpenAI connection cannot be edited, reset and recreate it using the procedure below.

Reset the SSO connection

Reset the connection when you need to recreate the SAML configuration.

🚩️️ Resetting an OpenAI SSO connection generates a new ACS URL and Service Provider Entity ID. The existing values in UserLock will no longer work.

Before resetting the connection, set ChatGPT SSO settings to Optional.

  1. Open:

    https://admin.openai.com/identity

  2. Go to Access ▸ Single Sign-On (SSO).

  3. Click Manage SSO.

  4. Open the existing connection.

  5. Click Reset connection.

  6. Confirm the reset.

  7. Create the Custom SAML connection again.

  8. Copy the newly generated:

    • Assertion consumer service (ACS) URL

    • Service provider entity ID

  9. In the UserLock console, go to ⚙️ Server settings ▸ Single Sign-On and open the OpenAI profile.

  10. Replace the existing values:

UserLock setting

New OpenAI value

Issuer

New Service provider entity ID

ACS URL

New Assertion consumer service (ACS) URL

  1. Save the UserLock profile.

  2. Complete the OpenAI wizard and test the connection again before making SSO required.

Troubleshooting

The domain cannot be added or verified

Confirm that:

  • You are signed in as an OpenAI Global Admin.

  • The TXT record name and value match the values provided by OpenAI.

  • The TXT record is publicly available through a DNS lookup.

  • You have allowed up to 24 hours for DNS propagation.

  • The domain has not already been verified in another OpenAI Admin Portal.

If + Add Domain is unavailable, or OpenAI displays a message asking you to contact Support, contact OpenAI Support from:

https://help.openai.com

OpenAI cannot retrieve the UserLock metadata

Open the following URL from a browser outside your internal network:

https://<SSO_domain>/metadata

For example:

https://sso.contoso.com/metadata

The URL must be reachable over HTTPS and return the UserLock SAML metadata.

If it cannot be reached:

  • Check the external DNS record for the UserLock SSO domain.

  • Check the HTTPS binding and SSL certificate for the UserLock SSO service.

  • Confirm that network rules allow external access to the SSO service.

  • Use Manual configuration in OpenAI while correcting the metadata access issue.

Error: Invalid thumbprint

This error means that the X.509 certificate configured in OpenAI does not match the certificate used by UserLock to sign the SAML response.

  1. In UserLock, go to ⚙️ Server settings ▸ Single Sign-On.

  2. Click Download ▸ SAML certificate.

  3. Upload this current certificate to the OpenAI SSO connection.

  4. Test the connection again.

Handling SSO unavailability

If UserLock SSO becomes unavailable:

  1. Use the OpenAI administrator session that you kept open during configuration.

  2. Open:

    https://admin.openai.com/identity

  3. Go to Access ▸ Single Sign-On (SSO) ▸ Manage SSO.

  4. Change ChatGPT SSO settings from Required to Optional while the issue is investigated.

If no Global Admin can access the portal, contact OpenAI Support from:

https://help.openai.com

Étapes suivantes

Vous pouvez étendre la sécurité des sessions SaaS en appliquant les stratégies d’accès UserLock, en complément de l’authentification.