Enabling single sign-on with a generic SAML identity provider for Hyperproof Gov

The first step in configuring a generic SAML SSO connection is to configure your identity provider (IdP) to allow connections from Hyperproof Gov. Consult your identity provider’s documentation for more information. Most IdPs require the following information to create a new connection or app.

The Assertion Consumer Service URL value is temporary and will be updated once SSO configuration is complete in Hyperproof Gov.

For the SP Entity ID, replace MY_HYPERPROOF_SUBDOMAIN with the subdomain assigned to your organization, such as luna.

Note that Hyperproof requires an email attribute in the SAML response. You may need to add this attribute (claim) explicitly in your identity provider’s configuration. The attribute should appear as follows:

<saml2:Attribute Name="email" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified">
    <saml2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema"
                                xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
                                xsi:type="xs:string">user@example.com</saml2:AttributeValue>
</saml2:Attribute>

When the Hyperproof Gov connection or app is configured in your IdP, collect the following items that will be needed later in the configuration process:

Once you’ve configured your identity provider to allow connections from Hyperproof Gov, you need to add the metadata to the SSO configuration of your Hyperproof Gov organization.

SAML provider options

When you configured SSO in your Hyperproof Gov organization, Hyperproof generated an Assertion Consumer Service URL specific to your organization. This URL needs to be updated in the connection or app you created in your IdP in Step One: Configuring your SAML identity provider for Hyperproof Gov.

You’ll be able to log in to Hyperproof Gov using your identity provider’s credentials after SSO is fully configured for your Hyperproof organization.

At this point, you’ll have the option to make SSO required. If it’s required, users without a company email address can still log in via Google, Office 365, or email/password. Refer to Requiring SSO for login for more information.