On this page
How single sign-on works
Single sign-on is available to teams on the Enterprise plan. The team owner connects one identity provider over OpenID Connect or SAML 2.0 from the SSO tab in team settings.
Members sign in with their work email through your identity provider. The first sign-in creates their HostRepute account and adds them to the team with the default role you choose: Manager, Developer, or Viewer. HostRepute two-factor authentication still applies after the identity provider signs someone in.
Each account is bound to the identity provider user that first signed it in, so a later change to an email address in the identity provider cannot move a sign-in onto a different HostRepute account.
Values for your identity provider
The SSO settings page shows the exact values to copy into your identity provider application.
| Value | Protocol | Where to use it |
|---|---|---|
| Redirect URI | OpenID Connect | Allowed redirect or callback URL for the OIDC application. |
| ACS URL | SAML 2.0 | Assertion Consumer Service (reply) URL for the SAML application. |
| Entity ID | SAML 2.0 | Service provider entity ID or audience URI. |
| Team login URL | Both | App tile or bookmark that starts sign-in for your team. |
OpenID Connect setup
Any identity provider that publishes an OpenID Connect discovery document works. For Microsoft Entra ID, use your tenant-specific issuer URL; the multi-tenant common issuer is not accepted.
- 1 Create a web application in your identity provider and add the HostRepute redirect URI.
- 2 Grant the openid, email, and profile scopes so the ID token includes the user email.
- 3 In HostRepute, choose OpenID Connect and enter the issuer URL, client ID, and client secret.
- 4 Save the connection. HostRepute loads the discovery document and checks that its issuer matches the one you entered.
SAML 2.0 setup
HostRepute starts every SAML sign-in, so identity provider initiated sign-in is not supported. Add the team login URL as the application tile in your identity provider dashboard instead.
- 1 Create a SAML application in your identity provider using the HostRepute ACS URL and entity ID.
- 2 Send the user email as the NameID (email format) or as an email attribute, and sign the response or the assertion.
- 3 In HostRepute, choose SAML 2.0 and enter the identity provider entity ID, SSO URL, and X.509 signing certificate.
- 4 Save the connection.
Verify your email domains
Only people whose email is on a verified domain can sign in through your identity provider. A domain can be verified by one HostRepute team at a time.
- 1 Add your company domain, for example acme.com, on the SSO settings page.
- 2 Publish the TXT record shown for it at _hostrepute-sso.acme.com. The value starts with hostrepute-sso-verification=.
- 3 Select Verify once the record has propagated.
Test and enable SSO
- 1 Select Test connection and sign in with your identity provider account.
- 2 Turn on SSO so members can use Sign in with SSO on the HostRepute login page or your team login URL.
- 3 Optionally set enforcement to Required once the test has passed and at least one domain is verified.
Requiring SSO
When SSO is required, people with an email on a verified domain can no longer sign in with a password, a passkey, or a social login, or register a new account. Existing sessions that were not established through your identity provider are signed out, and API and MCP authorizations those members granted earlier are revoked.
The team owner can always still sign in with a password, so a misconfigured identity provider cannot lock the team out.
Enforcement switches back to optional automatically when you change the identity provider settings or remove the last verified domain. Run a new connection test before requiring SSO again.