User Management

This feature is part of the Team & Enterprise plans.

The following features are available to organizations with SSO enabled. See Basic SSO and Managed SSO for details on each mode.

Session Timeout

This value sets the duration of the session for members of your organization.

After this time, members will be prompted to re-authenticate with your Identity Provider to access the organization’s resources.

The default value is 7 days.

Role Mapping

When enabled, Role Mapping allows you to dynamically assign roles to organization members based on data provided by your Identity Provider.

This section allows you to define a mapping from your IdP’s user profile data to the assigned role in Hugging Face.

• IdP Role Attribute Path

  A JSON path to an attribute in your user’s IdP profile data. It supports dot notation (e.g. user.role or groups). For SAML, this can be a URI (e.g. http://schemas.microsoft.com/ws/2008/06/identity/claims/role).

• Role Mapping

  A mapping from the IdP attribute value to the assigned role in the Hugging Face organization.

  Available roles are admin, write, contributor, and read. See roles documentation for more details.

You must map at least one admin role in your configuration.

If the attribute in the IdP response contains multiple values (e.g. a list of groups) that match several mappings, the user is assigned the most privileged matching role. The role hierarchy, from least to most privileged, is read < contributor < write < admin.

If there is no match, the role is determined as follows:

• If the user was invited to the organization with a specific role, that invitation role is used as a fallback.
• Otherwise, the user is assigned the default role for your organization. The default role can be customized in the Members section of the organization’s settings.

When inviting a user whose role will be controlled by SSO role mapping, the role selected in the invite modal only applies if the user does not yet have a role assigned in your SSO provider.

Role synchronization is performed on every login.

Resource Group Mapping

When enabled, Resource Group Mapping allows you to dynamically assign members to resource groups in your organization, based on data provided by your Identity Provider.

• IdP Attribute Path

  A JSON path to an attribute in your user’s IdP profile data. Similar to Role Mapping, this supports dot notation or URIs for SAML.

• Resource Group Mapping

  A mapping from the IdP attribute value to a resource group in your Hugging Face organization. You can assign a specific role (admin, write, contributor, read, inherit) for each resource group mapping.

Unlike Role Mapping, Resource Group Mapping is additive. If a user matches multiple mappings (e.g. they belong to multiple groups in your IdP that are mapped to different Resource Groups), they will be added to all matched Resource Groups.

If there is no match, the user will not be assigned to any resource group.

Resource groups targeted by a mapping can still be edited manually from the Hub UI or API, but those edits are overwritten at the user’s next SSO login: a role change is reverted to the mapped role, and a user who was manually removed is re-added. To change a mapped user’s access permanently, update your IdP data or the mapping configuration.

Matching email domains

This feature is only relevant for Basic SSO. With Managed SSO, user accounts are fully managed by the organization, so email domain matching does not apply.

When enabled, ‘Matching email domains’ only allows organization members to complete SSO if the email provided by your identity provider matches one of their emails on Hugging Face.

To add an email domain, fill out the ‘Matching email domains’ field, click enter on your keyboard, and save.

External Collaborators

External collaborators are users outside your organization who need access to some of its resources without going through Single Sign-On (SSO). That usually means they aren’t in your Identity Provider (IdP). They’re available on paid plans, and show up with an “External collaborator” badge in your organization’s member lists. They do count toward the number of paid seats in your organization.

You can add them by:

• Inviting them to the organization: on the Members page of your organization’s settings, check External Collaborator when you send the invite.
• Converting an existing member: on the Members page, open the member’s menu and select Convert to external collaborator. Use Convert to member to switch them back. If your organization uses SSO, they’ll need to sign in through it afterward to keep access. You can also do this via the API.
• Sharing a resource group or repository: if external invitations are enabled, resource group admins can invite outsiders straight into a Resource Group, including from Share with external collaborators on a repository’s settings page. Those users join with the no_access organization role and only get that Resource Group.

External collaborators still go through your organization’s access controls (Resource Groups).

With Managed SSO, internal members are provisioned through your identity provider (SCIM), so users invited to the organization can only be added as external collaborators.

Update on GitHub