Enable SAML SSO to let your clients access your Hubflo portal using their company credentials instead of managing separate passwords.
Note: SSO is only available on the Unlimited plan. Contact [email protected] to request access.
Before you start
Confirm you have:
Admin access to your Identity Provider (Okta, Microsoft Entra ID, Auth0, Google Workspace, etc.)
Owner permissions in your Hubflo organization
An active Unlimited plan
Step 1: Get Your Hubflo Configuration Details
Navigate to Settings > Authentication > Custom authentication
Select Add SAML 2.0 connection
Save these two values, you'll enter them in your IdP:
SP Entity ID / Audience
Assertion Consumer Service (ACS) URL
Tip: Download the metadata file if your IdP supports automatic import.
Step 2: Create the SAML Application in Your IdP
Log in to your Identity Provider
Create a new SAML 2.0 application
Give it a recognizable name like "Hubflo Client Portal"
Step 3: Configure Connection Settings
Enter the Hubflo values from Step 1:
Paste the ACS URL into your IdP's ACS URL field
Paste the Entity ID into the Audience/Entity ID field
If your IdP supports metadata import, upload the file instead of manual entry.
Step 4: Set Up User Attributes
Configure these settings in your IdP to ensure Hubflo receives the correct user information:
Response Signing:
Sign both the response and assertion
Name ID Configuration:
Format:
EmailAddressValue: Map to your user's email field
Required Attributes:
Your IdP must send these three attributes with exact naming:
Attribute Name | Maps To | Example |
User's email address | user.email | |
first_name | User's first name | user.firstName |
last_name | User's last name | user.lastName |
Important: Attribute names are case-sensitive and must match exactly as shown.
Step 5: Connect Your IdP to Hubflo
Copy these values from your IdP:
SSO URL (sometimes called "Sign-on URL" or "SAML 2.0 Endpoint")
X.509 certificate (the public signing certificate)
Return to Hubflo and enter:
Connection name: What your clients will see on the login button (e.g., "Continue with Acme SSO")
SAML 2.0 endpoint: Paste the SSO URL
Public certificate: Paste the X.509 certificate
Save your configuration
Step 6: Test Your SSO Connection
Open your client portal in a private/incognito browser window
Look for the SSO button with your connection name
Click it and sign in using your IdP credentials
Verify you can access the portal successfully
Note: If authentication fails, double-check that attribute names match exactly and that both response and assertion are signed.
Once SSO is working:
Share the portal URL with your clients
Let them know they can use the SSO login option
Consider disabling password-based login if you want to enforce SSO-only access
Need help? Contact [email protected] with your IdP name and any error messages you're seeing.