Set up single sign-on

What this achieves

Single sign-on hands authentication to the identity provider your company already runs, so people sign in with credentials they already have. This page covers entering the provider’s details and handing back the values it needs from Humavera.

Required role: Administrator.

Before you start

You need administrative access to your identity provider, because this is a two-sided configuration: Humavera needs values from it, and it needs values from Humavera. There is one single sign-on configuration per organization.

Read the planning page before you start if you have not already. The enforcement switch on this screen is the most consequential setting in the product.

Steps

Go to Integrations → SSO.
Select Set Up SSO.
Under Provider, enter the Provider Name and choose the Protocol — SAML 2.0 or OpenID Connect.
Fill in the protocol section. For SAML, use Import from IdP metadata; for OpenID Connect, use Discover endpoints. Both are described below.
Complete the Attribute Mapping so the provider’s claims land in the right Humavera fields.
Set the switches under Provisioning & Enforcement. Leave Enforce SSO off for now.
Select Save Configuration.
Copy the values from Service Provider Details into your identity provider.

SAML 2.0

Option	Description
IdP Entity ID	The identity provider’s own identifier.
IdP SSO URL	Where Humavera sends people to sign in.
IdP SLO URL	Where Humavera sends a single-logout request. Optional.
Metadata URL	The provider’s published metadata. Used to validate that your provider responds correctly, and to refresh the configuration later.
IdP Certificate	The provider’s X.509 signing certificate, in PEM form.
Name ID Format	The identifier format Humavera expects the provider to assert.

Use Import from IdP metadata rather than typing these. Paste the provider’s metadata XML, or fill in the Metadata URL and use Refresh from URL, and the entity ID, sign-on URL, and signing certificate are filled in for you. The screen says this is far less error-prone than entering each by hand, and it is right — a certificate transcribed by hand is the most common reason a first test fails.

Certificate rotation

Next IdP Certificate (rotation) stages the certificate your provider is about to move to. Both the current and the next certificate validate logins while it is set, so you can cut over with no downtime. Metadata import fills this in automatically when the provider publishes two signing certificates.

Stage the next certificate as soon as your provider announces a rollover. A signing certificate that expires without a staged replacement stops every sign-in at once.

Request signing

Sign AuthnRequest signs outgoing authentication requests with the service-provider private key, which some providers require. Include cert in metadata embeds the signing certificate in the published metadata so the provider can verify it.

Both need an SP Certificate and SP Private Key in PEM form. The screen states that the private key is encrypted at rest and never returned in plaintext — you will not be able to read it back, so keep your own copy.

OpenID Connect

Option	Description
Issuer URL	The provider’s issuer.
Authorization URL	Where people are sent to authenticate.
Token URL	Where Humavera exchanges the code for a token.
UserInfo URL	Where Humavera reads the signed-in person’s claims.
Client ID	The client identifier your provider issued for Humavera.
Client Secret	The matching secret.
Scopes (comma-separated)	The scopes requested. The screen shows the defaults.

Select Discover endpoints after entering the Issuer URL. It fetches the issuer’s published configuration and fills in the URLs below, which is quicker and more reliable than entering three URLs by hand.

What your identity provider needs from Humavera

The Service Provider Details card holds the values to copy into your provider’s configuration. Each has a copy action beside it.

Option	Description
SP Entity ID	Humavera’s identifier. Your provider may call this the Audience URI or SP Issuer.
ACS URL (Assertion Consumer Service)	Where the provider posts the SAML assertion.
SLO URL (Single Logout)	Where the provider sends a logout request. Optional, and only where the provider supports single logout.
Name ID Format	The identifier format Humavera expects.
Redirect URI	For OpenID Connect. Register this exactly as shown, character for character.

Example: HC Corp’s identity provider administrator takes the ACS URL and SP Entity ID from this card and creates the matching application on their side. A redirect URI that differs by a trailing slash fails authentication with an error that names neither side.

Provisioning

Option	Description
Auto-Provision Users	New user accounts are created automatically when someone authenticates through single sign-on for the first time.
Auto-Deprovision	Humavera accounts are deactivated when the account is deactivated in your identity provider.
Enforce SSO	All users must sign in through single sign-on. Password login is blocked.

Leave Enforce SSO off until you have tested. The interface warns that enforcing it disables password login for every user, and that there is no fallback once it is on.

Saving comes before testing

The screen states the order: save first, then run Test Connection and Activate from the Status card. Saving a configuration does not switch anything on for your users.

What happens next

The configuration is saved but not live. Complete the attribute and group mapping, then test the configuration and activate it — that page covers what activation and enforcement each do, and how to avoid locking your administrators out.