Let your IT team know that you will be able to provide them with the following from within the application configuration screens:

• Entity ID (also called Identifier)
• Reply URL (also called the ACS URL - Assertion Consumer Service URL)
• Signing certificate
• Encryption certificate

Ask your IT team to provide:

• A metadata document or metadata URL for your identity provider (the metadata URL is recommended).
• Whether to enable Single Sign-Out (simultaneous logout from both Ideagen Hub and the identity provider when a user signs out).
• Whether to enable signing of SAML requests.
• Whether to require encrypted SAML assertions.
• The name of the attribute that contains the user's email address in your identity provider.
• The name of the attribute that holds a unique and unchanging user ID (such as a network GUID).

Note
In most cases, the email attribute mapping will simply be email to email. However, some identity providers (particularly Microsoft Entra ID) may use a full URL as the attribute name — your IT team will know which applies to your setup.

3. Configuring SSO

Once you have the information from your IT team, you can configure SSO in the app.

To configure SSO:

1. Log in to Ideagen Hub as a Tenant Administrator.
2. Open the Admin Console.

3. Select Security Centre.

4. Click Authentication to expand the menu.
5. Select Configure next to the External IDP Configuration option.
6. Click Add Identity Provider.
7. Select SAML or OIDC depending on what your IT team advised.
8. Click Next.
9. Fill in all mandatory fields (marked with a red asterisk).
   See the relevant section below for field-by-field guidance.
10. Click Apply configuration when complete.

Note
If an identity provider has already been configured for your tenant, you can either update the existing settings, add an additional provider or delete the existing one and start again.

3.1. Configuration details

3.1.1. SAML

On the SAML configuration screen, you will be able to see the Entity ID and Reply URL - share these with your IT team if they need them to configure your identity provider.

Next, complete the following fields.

Field	Description
Provider name	A friendly label to help you recognise this connection. For example, Company SSO or Okta Login. This name will appear as the button you can click to sign in using your Corporate ID on the Hub login screen.
Sign-out flow	Enable this if your IT team confirmed they want simultaneous sign-out from both Ideagen and the identity provider. See the known limitations table for what is supported by common identity providers.
Metadata document source	Either paste in the metadata URL (recommended) provided by your IT team, or upload the metadata XML file they provided.
SAML signing and encryption	Configure signing and encryption based on what your IT team advised. See the known limitations table for what is supported by common identity providers.
Attribute mapping - email	Map the email user pool attribute to the attribute name used by your identity provider. In many cases this is simply email. You can find more details on how to complete the attribute mapping in our articles for external identity providers: Google Workspace Microsoft Entra Okta and others - Ensure that your IdP is configured to send an email attribute.  Not all IdP's will do this by default.  The SAML attribute value should be the name of the of the attribute you send.  You should then find that your assertion statement contains a name with that attribute, e.g.:
Attribute mapping - preferred_username	This field appears for organisations provisioned on release 5.2 or later. Map this to any attribute that represents a unique identifier for the user in your organisation. This does not have to be an email address. Ask your IT team which attribute to use (for example, a network user GUID).

3.1.2. OIDC

On the OIDC configuration screen, you will be able to see the Redirect URI and a signing certificate - share these with your IT team if needed.

Next, complete the following fields.

5. Configuring users for SSO

Once SSO is configured, you need to update your users so they can use it. There are two ways to do this:

• Manually editing each user.
• Using the CSV import mechanism to update all users at once.

In both cases, you want to change the Authentication Type to External for each user:

We strongly recommend keeping at least one administrator account that does not use SSO. If there is ever a problem with your SSO configuration, you will still be able to log in and make changes.

6. Signing in with SSO

Once SSO is configured and users have been updated, the Hub login screen will show an SSO button alongside the standard email and password fields. Users set up for SSO can click this button to be directed to your organisation's sign in page.

Users who have not been switched to SSO can continue to log in using their email address and password as before.

InPrivate/Incognito browsing issues
Some users may experience difficulty logging in via SSO when using a private browsing window. This is because your identity provider may rely on session cookies from other corporate applications that are not available in private mode. If this happens, ask your IT team to add Ideagen Hub to any session bypass lists or exclusion policies.

7. Known limitations

The table below summarises the known limitations for common identity providers when using the SAML protocol. Your IT team may find this useful when deciding on configuration options.

Note
The table reflects known limitations at the time of writing. Your specific configuration may reveal additional considerations. Ideagen continues to investigate expanded support for features such as IdP-Initiated login.

Further reading

• Understanding user types
• Converting user authentication types
• Importing and exporting users
• Setting up Microsoft Entra for SAML-based Single Sign-On (SSO)
• Ideagen Hub 5.2 release notes