Set up single sign-on (SSO) with Okta, Microsoft Entra ID, Google Workspace and more

Single sign-on (SSO) lets your team sign in to RedirHub with your company’s identity provider instead of a separate RedirHub password. RedirHub supports SAML 2.0 and works with Okta, Microsoft Entra ID (formerly Azure AD), Google Workspace, OneLogin, JumpCloud, PingOne, Auth0, AD FS and any other SAML 2.0 identity provider. SSO is available on Pro as a $200/month add-on and on Enterprise by contract.

Supported identity providers#

Step 1: Get your RedirHub SAML details#

Once SSO is turned on for your workspace, RedirHub gives you two values to paste into your identity provider. Providers use different names for them:

• ACS URL: also called Single sign-on URL, Reply URL, Recipient or Assertion Consumer Service URL.
• Entity ID: also called Audience URI, Identifier, Audience or SP Entity ID.

Step 2: Create the RedirHub app in your identity provider#

The steps are the same in every provider:

1. Create a new SAML 2.0 application and name it RedirHub.
2. Paste the ACS URL and Entity ID from Step 1.
3. Set the Name ID format to Email address and send the user’s primary email.
4. Assign the people or groups who should be able to sign in to RedirHub.
5. Copy the app’s metadata URL, or download its metadata XML.

Here is where each setting lives in the most popular providers.

Okta#

1. In the Admin Console, go to Applications › Applications › Create App Integration and choose SAML 2.0.
2. Paste the ACS URL into Single sign-on URL and the Entity ID into Audience URI (SP Entity ID).
3. Set Name ID format to EmailAddress and Application username to Email.
4. Assign people or groups on the Assignments tab, then copy the Metadata URL from the Sign On tab.

Microsoft Entra ID (Azure AD)#

1. In the Microsoft Entra admin center, go to Enterprise applications › New application › Create your own application and choose the non-gallery option.
2. Open Single sign-on, choose SAML, and under Basic SAML Configuration paste the Entity ID into Identifier and the ACS URL into Reply URL.
3. Under Attributes & Claims, set Unique User Identifier to the user’s email (user.mail) with the Email address format.
4. Assign people or groups under Users and groups, then copy the App Federation Metadata Url from SAML Certificates.

Google Workspace#

1. In the Google Admin console, go to Apps › Web and mobile apps › Add app › Add custom SAML app.
2. On the Google Identity Provider details screen, click Download metadata.
3. Under Service provider details, paste the ACS URL and Entity ID, set Name ID format to EMAIL and Name ID to Basic Information › Primary email.
4. Under User access, turn the app on for everyone or for the organizational units or groups that need it.

OneLogin#

1. Go to Applications › Add App and pick SAML Custom Connector (Advanced).
2. On the Configuration tab, paste the Entity ID into Audience (EntityID) and the ACS URL into Recipient and ACS (Consumer) URL. Set SAML nameID format to Email.
3. Give access through roles, then download the metadata from More Actions › SAML Metadata.

JumpCloud#

1. Go to SSO Applications › Add New Application › Custom Application and choose to configure SSO with SAML.
2. Paste the Entity ID into SP Entity ID and the ACS URL into ACS URL. Set the SAMLSubject NameID to email.
3. Bind the user groups that need access, then click Export Metadata.

PingOne (Ping Identity)#

1. Go to Applications, add an application and choose SAML Application.
2. Enter the ACS URL and Entity ID manually, and map saml_subject to Email Address under Attribute Mappings.
3. Grant access to the right groups, turn the application on, and click Download Metadata on the Configuration tab.

Auth0#

1. Create a Regular Web Application, open its Addons tab and turn on SAML2 Web App.
2. Paste the ACS URL into Application Callback URL and set audience to the Entity ID in the settings.
3. Copy the Identity Provider Metadata link from the Usage tab.

AD FS (Active Directory Federation Services)#

1. In AD FS Management, go to Relying Party Trusts › Add Relying Party Trust, choose Claims aware and enter the data manually.
2. Enable the SAML 2.0 WebSSO protocol with the ACS URL, and add the Entity ID as the relying party trust identifier.
3. Add claim rules that send E-Mail-Addresses as E-Mail Address, then transform E-Mail Address into Name ID with the Email format.
4. Your metadata is at https://your-adfs-server/FederationMetadata/2007-06/FederationMetadata.xml.

Any other SAML 2.0 provider#

Create a custom SAML 2.0 application, paste the ACS URL and Entity ID, send the user’s email as the Name ID, and export the metadata. If your provider has no metadata file, note its SSO URL, issuer (IdP Entity ID) and X.509 signing certificate instead.

Step 3: Add your identity provider’s details to RedirHub#

Give RedirHub the metadata URL or metadata XML from Step 2. If you don’t have metadata, provide the SSO URL, issuer and signing certificate.

Step 4: Test sign-in#

Sign in with a person who is assigned to the RedirHub app in your identity provider. Their email in the identity provider must match the email of their RedirHub account. Once that works, roll SSO out to the rest of your team.

Good to know#

• Signing in with Google is a login option on every plan, not SAML single sign-on. See Secure your account.
• Signing certificates expire. When you renew yours, give RedirHub the new metadata before the old certificate expires, or SSO sign-in stops working.
• Each person’s role in RedirHub is still managed in your workspace. See Invite team members and choose their role.