{"templateId":"markdown","sharedDataIds":{"sidebar":"sidebar-docs/sidebars.yaml"},"props":{"metadata":{"markdoc":{"tagList":[]},"type":"markdown"},"seo":{"title":"Single Sign-On (SSO)"},"dynamicMarkdocComponents":[],"compilationErrors":[],"ast":{"$$mdtype":"Tag","name":"article","attributes":{},"children":[{"$$mdtype":"Tag","name":"Heading","attributes":{"level":1,"id":"single-sign-on-sso","__idx":0},"children":["Single Sign-On (SSO)"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Hunty supports Single Sign-On for corporate authentication, allowing a company's employees to log in to the platform using their existing identity provider instead of a separate Hunty username and password."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"supported-protocol","__idx":1},"children":["Supported Protocol"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["SSO is implemented via ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["OpenID Connect (OIDC)"]}," federation. This works with any OIDC-compliant identity provider (IdP), including:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Microsoft Entra ID (Azure AD)"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Okta"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Google Workspace"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Any other OIDC-compliant provider"]}]},{"$$mdtype":"Tag","name":"blockquote","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["SAML 2.0 is not a standard offering today. If a client's IdP only supports SAML, treat it as a case-by-case request rather than a standard \"yes.\""]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"how-it-works","__idx":2},"children":["How It Works"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Each client company has its own isolated workspace in Hunty. If a company operates in multiple countries, each country has its own account inside that same workspace."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["SSO is set up ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["once per company"]},", and automatically covers every country account under that workspace — no need to repeat the configuration per country. (A company that genuinely needs a different IdP per country can still get one — but this is the exception, not the default flow.)"]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"access-control-stays-on-the-clients-side","__idx":3},"children":["Access Control Stays on the Client's Side"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Connecting SSO does not change who can access what inside Hunty:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["The first time a user logs in via SSO, Hunty automatically creates their account (just-in-time provisioning)."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["That user has ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["no roles or permissions"]}," until the assigned KAM grants them inside the platform."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["The client remains fully in control of who is provisioned: removing a user's access to the Hunty app/group in their IdP prevents new logins; existing sessions/roles are still managed by the KAM."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Before going live"]},", get the list of expected users (and their intended roles) to the KAM so access is ready by the time the first employee logs in — otherwise users can authenticate but will see no permissions."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"information-we-need-from-the-client","__idx":4},"children":["Information We Need From the Client"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Identity Provider"},"children":["Identity Provider"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Information needed"},"children":["Information needed"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Microsoft Entra ID (Azure AD)"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Client ID (Application ID), Client Secret (value), Tenant ID (Directory ID)"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Okta"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Client ID, Client Secret, Okta domain (issuer URL)"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Google Workspace"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Client ID, Client Secret"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Other OIDC provider"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Client ID, Client Secret, Issuer / Discovery URL"]}]}]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Once we receive these, we configure the connection on our side and return a ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Redirect URI"]}," that the client must register in their IdP's admin console (e.g., under \"Redirect URIs\" in an Azure AD app registration) to activate the flow."]},{"$$mdtype":"Tag","name":"blockquote","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Security note:"]}," Client Secrets are sensitive credentials — prefer a secure channel (e.g., a password manager share link) over plain email when possible."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"setup-flow","__idx":5},"children":["Setup Flow"]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Client asks about SSO and confirms which IdP they use."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Hunty requests the credentials listed above for that IdP."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Hunty configures the connection and generates the Redirect URI."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Client registers the Redirect URI in their IdP admin console."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Both sides test the login flow with a pilot user."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["KAM assigns initial roles/permissions so users have access from their first login."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Go live."]}]}]},"headings":[{"value":"Single Sign-On (SSO)","id":"single-sign-on-sso","depth":1},{"value":"Supported Protocol","id":"supported-protocol","depth":2},{"value":"How It Works","id":"how-it-works","depth":2},{"value":"Access Control Stays on the Client's Side","id":"access-control-stays-on-the-clients-side","depth":3},{"value":"Information We Need From the Client","id":"information-we-need-from-the-client","depth":2},{"value":"Setup Flow","id":"setup-flow","depth":2}],"frontmatter":{"seo":{"title":"Single Sign-On (SSO)"}},"lastModified":"2026-08-24T19:51:55.000Z","pagePropGetterError":{"message":"","name":""}},"slug":"/docs/sso","userData":{"isAuthenticated":false,"teams":["anonymous"]},"isPublic":true}