> ## Documentation Index
> Fetch the complete documentation index at: https://hireflixsl.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# SSO Overview

> How Single Sign-On works in Hireflix, what's supported, and what to know before you configure it.

## What is SSO in Hireflix?

Single Sign-On (SSO) lets your team members log in to Hireflix using your company's identity provider (IdP) instead of a Hireflix password. This gives your IT team centralized control over who can access Hireflix and lets your users sign in with the same credentials they use for other company applications.

SSO applies to your **team members** (recruiters, hiring managers, admins, and reviewers). Candidates do not use SSO; they receive direct interview links and complete interviews without logging in.

## What Hireflix supports

<CardGroup cols={2}>
  <Card title="SAML 2.0" icon="shield-check">
    Hireflix supports SAML 2.0 for SSO. OpenID Connect (OIDC) is not supported.
  </Card>

  <Card title="SP-initiated login" icon="arrow-right-to-bracket">
    Users start login from Hireflix at [admin.hireflix.com/en/login-sso](https://admin.hireflix.com/en/login-sso). Launching from an IdP dashboard also works and redirects users through the same flow.
  </Card>

  <Card title="Email as identifier" icon="envelope">
    Hireflix uses the `emailAddress` NameID format. The user's email address is the unique identifier passed from your IdP.
  </Card>

  <Card title="Any IdP that supports SAML 2.0" icon="plug">
    Configure Hireflix as a generic SAML application in your IdP. Guides are provided for Okta, Azure AD, OneLogin, and Duo.
  </Card>
</CardGroup>

## Before you start

<Check>
  Confirm you have owner or administrator access in Hireflix. SSO configuration and metadata are only available to authorized admins under [My Account > Single Sign On](https://admin.hireflix.com/en/my-account/sso).
</Check>

<Check>
  Confirm your IdP supports SAML 2.0 and that you can configure a custom SAML application.
</Check>

<Check>
  Create your team members in Hireflix first. Their email addresses in Hireflix must match the email addresses your IdP will send. Hireflix does not auto-create users on first login.
</Check>

## How login works

<Steps>
  <Step title="User starts login">
    The user opens Hireflix (or clicks the Hireflix tile in their IdP dashboard) and is redirected to the SSO login page.
  </Step>

  <Step title="IdP authenticates the user">
    Your identity provider verifies the user and returns a SAML assertion containing the user's email address.
  </Step>

  <Step title="Hireflix matches the email">
    Hireflix looks up an existing team member with that email address and signs them in. If no matching user exists, login fails.
  </Step>
</Steps>

## Enforcement

Once SSO is enabled, you can enforce SSO-only login for your account. When enforcement is on:

* All team members must sign in through your IdP. Password login is disabled for them.
* Enforcement is applied **globally at the account level**. It cannot be enabled per user.
* The primary account owner keeps password-based access as an administrative recovery path in case the IdP connection ever breaks.

## Sessions

Hireflix issues a JWT-based session token that stays valid for approximately **seven days**. Session duration and idle timeout are not currently configurable, and Hireflix does not inherit session timeout settings from your IdP.

## User management with SSO

* **Provisioning is manual.** Add team members in Hireflix before they try to sign in. Just-In-Time (JIT) provisioning is not supported.
* **No SCIM.** Automated provisioning, synchronization, and deprovisioning through SCIM are not supported.
* **Roles are managed in Hireflix.** Roles and permissions are assigned inside the Hireflix app. They cannot be driven by SAML attributes or IdP group mappings.
* **Email changes.** If a user's email changes in your IdP, update their Hireflix email to match so SSO login continues to work.

## Current limitations

Keep the following in mind when planning your rollout:

| Capability                                   | Status                                          |
| -------------------------------------------- | ----------------------------------------------- |
| SAML 2.0 SSO (SP-initiated)                  | Supported                                       |
| IdP-initiated launch from SSO dashboard      | Supported (redirects through SP-initiated flow) |
| OpenID Connect (OIDC)                        | Not supported                                   |
| Single Logout (SLO)                          | Not supported                                   |
| Deep linking via SAML RelayState             | Not supported                                   |
| Role or group mapping via SAML attributes    | Not supported                                   |
| Just-In-Time (JIT) provisioning              | Not supported                                   |
| SCIM provisioning / automated deprovisioning | Not supported                                   |
| Multiple IdPs per tenant                     | Not supported                                   |
| Configurable session timeout                 | Not supported                                   |
| Signed or encrypted SAML assertions required | Not required (SAML is transmitted over TLS)     |
| Dedicated mobile or desktop apps             | Not applicable (web only)                       |

## Set up SSO with your identity provider

Follow the guide that matches your IdP:

<CardGroup cols={2}>
  <Card title="Okta" icon="circle-check" href="/user/account-team/sso/okta">
    Configure SAML SSO with Okta.
  </Card>

  <Card title="Azure AD" icon="microsoft" href="/user/account-team/sso/azure-ad">
    Configure SAML SSO with Microsoft Entra ID (Azure AD).
  </Card>

  <Card title="OneLogin" icon="key" href="/user/account-team/sso/onelogin">
    Configure SAML SSO with OneLogin.
  </Card>

  <Card title="Duo" icon="shield" href="/user/account-team/sso/duo">
    Configure SAML SSO with Duo.
  </Card>
</CardGroup>

Using a different identity provider? Configure Hireflix as a generic SAML 2.0 application in your IdP using the metadata available at [My Account > Single Sign On](https://admin.hireflix.com/en/my-account/sso).