Skip to main content

​
What is SSO in Hireflix?

Single Sign-On (SSO) lets your team members log in to Hireflix using your company’s identity provider (IdP) instead of a Hireflix password. This gives your IT team centralized control over who can access Hireflix and lets your users sign in with the same credentials they use for other company applications. SSO applies to your team members (recruiters, hiring managers, admins, and reviewers). Candidates do not use SSO; they receive direct interview links and complete interviews without logging in.

​
What Hireflix supports

SAML 2.0

Hireflix supports SAML 2.0 for SSO. OpenID Connect (OIDC) is not supported.

SP-initiated login

Users start login from Hireflix at admin.hireflix.com/en/login-sso. Launching from an IdP dashboard also works and redirects users through the same flow.

Email as identifier

Hireflix uses the emailAddress NameID format. The user’s email address is the unique identifier passed from your IdP.

Any IdP that supports SAML 2.0

Configure Hireflix as a generic SAML application in your IdP. Guides are provided for Okta, Azure AD, OneLogin, and Duo.

​
Before you start

Confirm you have owner or administrator access in Hireflix. SSO configuration and metadata are only available to authorized admins under My Account > Single Sign On.
Confirm your IdP supports SAML 2.0 and that you can configure a custom SAML application.
Create your team members in Hireflix first. Their email addresses in Hireflix must match the email addresses your IdP will send. Hireflix does not auto-create users on first login.

​
How login works

1

User starts login

The user opens Hireflix (or clicks the Hireflix tile in their IdP dashboard) and is redirected to the SSO login page.
2

IdP authenticates the user

Your identity provider verifies the user and returns a SAML assertion containing the user’s email address.
3

Hireflix matches the email

Hireflix looks up an existing team member with that email address and signs them in. If no matching user exists, login fails.

​
Enforcement

Once SSO is enabled, you can enforce SSO-only login for your account. When enforcement is on:
  • All team members must sign in through your IdP. Password login is disabled for them.
  • Enforcement is applied globally at the account level. It cannot be enabled per user.
  • The primary account owner keeps password-based access as an administrative recovery path in case the IdP connection ever breaks.

​
Sessions

Hireflix issues a JWT-based session token that stays valid for approximately seven days. Session duration and idle timeout are not currently configurable, and Hireflix does not inherit session timeout settings from your IdP.

​
User management with SSO

  • Provisioning is manual. Add team members in Hireflix before they try to sign in. Just-In-Time (JIT) provisioning is not supported.
  • No SCIM. Automated provisioning, synchronization, and deprovisioning through SCIM are not supported.
  • Roles are managed in Hireflix. Roles and permissions are assigned inside the Hireflix app. They cannot be driven by SAML attributes or IdP group mappings.
  • Email changes. If a user’s email changes in your IdP, update their Hireflix email to match so SSO login continues to work.

​
Current limitations

Keep the following in mind when planning your rollout:

​
Set up SSO with your identity provider

Follow the guide that matches your IdP:

Okta

Configure SAML SSO with Okta.

Azure AD

Configure SAML SSO with Microsoft Entra ID (Azure AD).

OneLogin

Configure SAML SSO with OneLogin.

Duo

Configure SAML SSO with Duo.
Using a different identity provider? Configure Hireflix as a generic SAML 2.0 application in your IdP using the metadata available at My Account > Single Sign On.