diff --git a/docker-compose.yml b/docker-compose.yml
index 068ad4388e..ff38199eac 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -33,6 +33,15 @@ services:
     ports:
       - "6379:6379"
 
+  saml_idp:
+    image: fleetdm/docker-idp:latest
+    environment:
+      SIMPLESAMLPHP_SP_ENTITY_ID: 'https://localhost:8080'
+      SIMPLESAMLPHP_SP_ASSERTION_CONSUMER_SERVICE: 'https://localhost:8080/api/v1/fleet/sso/callback'
+    ports:
+      - "9080:8080"
+      - "9443:8443"
+
   # CAdvisor container allows monitoring other containers. Useful for
   # development.
   cadvisor:
diff --git a/docs/3-Contribution/2-Testing.md b/docs/3-Contribution/2-Testing.md
index 4587c5bacc..f9940fbb9d 100644
--- a/docs/3-Contribution/2-Testing.md
+++ b/docs/3-Contribution/2-Testing.md
@@ -3,6 +3,7 @@
 - [End-to-end tests](#end-to-end-tests)
 - [Email](#email)
 - [Database backup/restore](#database-backuprestore)
+- [Testing SSO](#testing-sso)
 
 ## Test suite
 
@@ -167,3 +168,36 @@ Restore:
 ```
 
 Note that a "restore" will replace the state of the development database with the state from the backup.
+
+## Testing SSO
+
+Fleet's `docker-compose` file includes a SAML identity provider (IdP) for testing SAML-based SSO locally.
+
+### Configuration
+
+Configure SSO on the Organization Settings page with the following:
+
+```
+Identity Provider Name: SimpleSAML
+Entity ID: https://localhost:8080
+Issuer URI: http://localhost:8080/simplesaml/saml2/idp/SSOService.php
+Metadata URL: http://localhost:9080/simplesaml/saml2/idp/metadata.php
+```
+
+The identity provider is configured with 2 users:
+
+```
+Username: user1
+Email: user1@example.com
+Password: user1pass
+```
+
+and
+
+```
+Username: user2
+Email: user2@example.com
+Password: user2pass
+```
+
+Use the Fleet UI to invite one of these users with the associated email. Be sure the "Enable Single Sign On" box is checked for that user. Now after accepting the invitation, you should be able to log in as that user by clicking "Sign On with SimpleSAML" on the login page.