---
title: "Set Up Single Sign-On (SSO) for Your Client Portal"
description: "Single Sign-On (SSO) allows your clients to access the Hubflo client portal using existing company credentials."
url: https://support.hubflo.com/en/articles/13534694-set-up-single-sign-on-sso-for-your-client-portal
collection: "Integrations"
updated: 2026-09-04
language: en
alternates: [fr]
---

# Set Up Single Sign-On (SSO) for Your Client Portal

Single Sign-On (SSO) allows your clients to access the Hubflo client portal using existing company credentials.

Set up SAML SSO to let your clients access your Hubflo portal using their company credentials instead of managing separate passwords.

> **Warning:** **Note:** SSO is only available on the Unlimited plan. Contact [support@hubflo.com](mailto:support@hubflo.com) to request access.

## Before you start

Confirm you have:

-   Admin access to your Identity Provider (Okta, Microsoft Entra ID, Auth0, Google Workspace, etc.)
    
-   Owner permissions in your Hubflo organization
    
-   An active Unlimited plan
    

## Step 1: Get Your Hubflo Configuration Details

1.  Navigate to **Settings > Authentication & SSO**
    
2.  Select **Add SAML 2.0 connection**
    
3.  Save these two values, you'll enter them in your IdP:
    
    -   SP Entity ID / Audience
        
    -   Assertion Consumer Service (ACS) URL
        

> **Success:** **Tip:** Download the metadata file from Hubflo if your IdP supports imports.

## Step 2: Create the SAML Application in Your IdP

1.  Log in to your Identity Provider
    
2.  Create a new SAML 2.0 application
    
3.  Give it a recognizable name like "Hubflo Client Portal"
    

## Step 3: Configure Connection Settings

If your IdP supports metadata import, upload the file now, or enter the Hubflo values from Step 1:

-   Paste the **ACS URL** into your IdP's ACS URL field
    
-   Paste the **Entity ID** into the Audience/Entity ID field
    

## Step 4: Set Up User Attributes

Configure these settings in your IdP to ensure Hubflo receives the correct user information:

**Response Signing:**

-   Sign both the response and assertion
    

**Name ID Configuration:**

-   **Format**: `EmailAddress`
    
-   **Value**: Map to your user's email field
    

**Required Attributes:**

Your IdP must send these three attributes with exact naming:

<table data-id="2c0757f3-1c6a-4a92-b37c-e198c667aae5" style="min-width: 75px;"><colgroup><col style="min-width: 25px;"><col style="min-width: 25px;"><col style="min-width: 25px;"></colgroup><tbody><tr><td colspan="1" rowspan="1" style="background-color: #e3e7fa80;"><p data-id="74a17c35-32ea-4509-b7f2-5c8eb4b37032"><strong>Attribute Name</strong></p></td><td colspan="1" rowspan="1" style="background-color: #e3e7fa80;"><p data-id="1d7e444a-7a31-4be8-b2c8-81c7e13d96f7"><strong>Maps To</strong></p></td><td colspan="1" rowspan="1" style="background-color: #e3e7fa80;"><p data-id="0740cfad-ab5e-4e88-b758-55b0ade5c821"><strong>Example</strong></p></td></tr><tr><td colspan="1" rowspan="1" style="background-color: #e8e8e880;"><p data-id="9d730b51-2cf1-4ca1-bb86-029702eaaa8e"><code>email</code></p></td><td colspan="1" rowspan="1"><p data-id="3d8fdc74-34bf-4d3c-bca8-a7f059e2da35">User's email address</p></td><td colspan="1" rowspan="1"><p data-id="7c3987e5-2121-4ab8-808a-b58fca5c805d"><code>user.email</code></p></td></tr><tr><td colspan="1" rowspan="1" style="background-color: #e8e8e880;"><p data-id="13140e6b-3137-4232-a96f-cb4a69847382"><code>first_name</code></p></td><td colspan="1" rowspan="1"><p data-id="1bd492b2-ebd9-4923-959e-cf1d6a6e8b83">User's first name</p></td><td colspan="1" rowspan="1"><p data-id="1559cdd4-c532-4297-8f18-0ff90a3ee056"><code>user.firstName</code></p></td></tr><tr><td colspan="1" rowspan="1" style="background-color: #e8e8e880;"><p data-id="892d1ac0-c1b6-4b5d-8677-b053d0bbf9d4"><code>last_name</code></p></td><td colspan="1" rowspan="1"><p data-id="e96940db-e1cd-45c0-a3eb-5b3941195de3">User's last name</p></td><td colspan="1" rowspan="1"><p data-id="0950a8c7-a164-4976-84bd-fdeb0d2c8f91"><code>user.lastName</code></p></td></tr></tbody></table>

**Important:** Attribute names are case-sensitive and must match exactly as shown.

## Step 5: Connect Your IdP to Hubflo

1.  Copy these values from your IdP:
    
    -   SSO URL (sometimes called "Sign-on URL" or "SAML 2.0 Endpoint")
        
    -   Public certificate
        
2.  Return to Hubflo and enter:
    
    -   **Connection name:** What your clients will see on the login button (e.g., "Continue with Acme SSO")
        
    -   **SAML 2.0 endpoint:** Paste the SSO URL
        
    -   **Public certificate:** Paste the public certificate
        
3.  Save your configuration
    

## Step 6: Test Your SSO Connection

1.  Open your client portal in a private/incognito browser window
    
2.  Look for the SSO button with your connection name
    
3.  Click it and sign in using your IdP credentials
    
4.  Verify you can access the portal successfully
    

> **Warning:** **Note:** If authentication fails, double-check that attribute names match exactly and that both response and assertion are signed.

Once SSO is working:

-   Share the portal URL with your clients
    
-   Let them know they can use the SSO login option
    
-   Consider disabling password-based login if you want to enforce SSO-only access
    

**Need help?** Contact [support@hubflo.com](mailto:support@hubflo.com) with your IdP name and any error messages you're seeing.