---
title: "A Secret Handshake: SAML-only Authentication"
description: ""
canonical_url: "https://cloudsmith.com/changelog/a-secret-handshake-saml_only-authentication"
last_updated: "2021-08-16T16:26:00.000Z"
---
# A Secret Handshake: SAML-only Authentication

_Good news!_ As part of our efforts to further secure access for users in your org, we're introducing the ability to enforce SAML-only Authentication. Plus, a bonus is that SAML is now fully self-service configurable:

With **SAML-only Authentication** configured, all members of your organization will no longer be able to use password-based or social-based authentication. In other words, they must use SAML when authenticating. This will ensure that they contact only _your_ Identity Provider for authentication. If the Identity Provider says no (i.e. because the user is removed, locked out, etc.), they'll not be able to log in anymore.

## How do you configure SAML-only Authentication?

- You need to be an Owner or Manager for your organization (see docs on [Organization Roles]()).
- Then you'll find it within the "SAML Authentication" section of your organization settings (screenshot).
- Ensure that the "Enforce SAML-only Authentication (for All Users)" checkbox is ticked.
- Click "Update". You'll now be enforcing SAML-only authentication in your organization.

You'll also be able to utilise the same page for self-service SAML configuration. Now you'll be able to enable, disable, enforce and configure SAML as and when required. You can specify either a metadata URL, where we fetch the SAML metadata from your Identity Provider automatically or provide us with the XML directly.

_What's next?_ For this area of the application, we'd like to implement SCIM for automated off-boarding.

**Note:** Single Sign-On via SAML (i.e. using an external Identity Provider to authenticate users) is an Ultra tier feature. You can find out more about Ultra features on our [pricing page](https://cloudsmith.com/product/pricing/), and if you'd like to [book a chat with us](https://help.cloudsmith.io/docs/contact-us), we're always happy to talk (no hard sales push).