Set Up Single Sign-On (SSO) for Your Client Portal

Set up SAML SSO to let your clients access your Hubflo portal using their company credentials instead of managing separate passwords.

Note: SSO is only available on the Unlimited plan. Contact [email protected] to request access.

Before you start

Confirm you have:

• Admin access to your Identity Provider (Okta, Microsoft Entra ID, Auth0, Google Workspace, etc.)

• Owner permissions in your Hubflo organization

• An active Unlimited plan

Step 1: Get Your Hubflo Configuration Details

1. Navigate to Settings > Authentication & SSO

2. Select Add SAML 2.0 connection

3. Save these two values, you'll enter them in your IdP:

   • SP Entity ID / Audience

   • Assertion Consumer Service (ACS) URL

Tip: Download the metadata file from Hubflo if your IdP supports imports.

Step 2: Create the SAML Application in Your IdP

1. Log in to your Identity Provider

2. Create a new SAML 2.0 application

3. Give it a recognizable name like "Hubflo Client Portal"

Step 3: Configure Connection Settings

If your IdP supports metadata import, upload the file now, or enter the Hubflo values from Step 1:

• Paste the ACS URL into your IdP's ACS URL field

• Paste the Entity ID into the Audience/Entity ID field

Step 4: Set Up User Attributes

Configure these settings in your IdP to ensure Hubflo receives the correct user information:

Response Signing:

• Sign both the response and assertion

Name ID Configuration:

• Format: EmailAddress

• Value: Map to your user's email field

Required Attributes:

Your IdP must send these three attributes with exact naming:

Important: Attribute names are case-sensitive and must match exactly as shown.

Step 5: Connect Your IdP to Hubflo

1. Copy these values from your IdP:

   • SSO URL (sometimes called "Sign-on URL" or "SAML 2.0 Endpoint")

   • Public certificate

2. Return to Hubflo and enter:

   • Connection name: What your clients will see on the login button (e.g., "Continue with Acme SSO")

   • SAML 2.0 endpoint: Paste the SSO URL

   • Public certificate: Paste the public certificate

3. Save your configuration

Step 6: Test Your SSO Connection

1. Open your client portal in a private/incognito browser window

2. Look for the SSO button with your connection name

3. Click it and sign in using your IdP credentials

4. Verify you can access the portal successfully

Note: If authentication fails, double-check that attribute names match exactly and that both response and assertion are signed.

Once SSO is working:

• Share the portal URL with your clients

• Let them know they can use the SSO login option

• Consider disabling password-based login if you want to enforce SSO-only access

Need help? Contact [email protected] with your IdP name and any error messages you're seeing.