> ## Documentation Index > Fetch the complete documentation index at: https://thehyperstack.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Other Identity Providers > Connect Google Workspace, OneLogin, JumpCloud, Ping or any SAML 2.0 or OpenID Connect provider. Hyperstack works with any identity provider that speaks SAML 2.0 or OpenID Connect (OIDC). This page lists what to give your provider and what to bring back. For Okta and Microsoft Entra ID, use their own guides: [Okta](https://thehyperstack.com/docs/tutorials/single-sign-on/okta.md) and [Microsoft Entra ID](https://thehyperstack.com/docs/tutorials/single-sign-on/microsoft-entra.md). > [!NOTE] > > Single sign-on is on the Enterprise plan. Read the [overview](https://thehyperstack.com/docs/tutorials/single-sign-on.md) first to see who can sign in. Go to **Settings → Single sign-on** and click **Other SAML provider** or **Other OIDC provider**. ## Our values Each organization has its own values. Copy them from step 2 of the Hyperstack page, not from this guide. They look like this: | Field in Hyperstack | Example | | - | - | | **ACS URL** | `https://studio.thehyperstack.com/sso/saml//acs` | | **Entity ID** | `https://studio.thehyperstack.com/sso/saml//metadata` | | **Initiate login URL** | `https://studio.thehyperstack.com/sso//start` | | **Metadata URL** | `https://studio.thehyperstack.com/sso/saml//metadata` | | **Redirect URI** (OIDC) | `https://studio.thehyperstack.com/sso/oidc//callback` | ## SAML ### What to set in your provider ![Step 2 for Other SAML provider: ACS URL, Entity ID, Initiate login URL, Metadata URL and Download our metadata (XML)](https://mintcdn.com/hyperstack/TA62Nx2wusH3dKmj/images/sso-generic-saml.webp?fit=max\&auto=format\&n=TA62Nx2wusH3dKmj\&q=85\&s=c68a4d5097ee5f16698c6a11b094302d) * **ACS URL** (also called Reply URL, Single sign-on URL or Recipient): our **ACS URL**. Hyperstack takes the answer by HTTP POST. * **Entity ID** (also called Audience or SP entity ID): our **Entity ID**. * **Start URL** or **Login URL**, if your provider asks: our **Initiate login URL**. * **The email**: send it as the NameID with the format **emailAddress**, or in an attribute named **email**. * **The name** (optional): attributes such as `firstName` and `lastName`, or `givenName` and `surname`, or `displayName`. * **Signing**: sign the assertion, the response or both, with SHA-256 or stronger. Hyperstack refuses SHA-1 signatures. * **Encryption**: turn off assertion encryption. Hyperstack doesn't read encrypted assertions yet. If your provider can read SAML metadata, click **Download our metadata (XML)** and upload the file to your provider. Hyperstack also reads these attribute names for the email: `mail`, `emailAddress`, `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress` and `urn:oid:0.9.2342.19200300.100.1.3`. ### What to bring back In step 3 of the Hyperstack page, use one of these three ways: * **Metadata URL**: the best way. We read it once a day, so a new certificate reaches us by itself within 24 hours. After your provider makes a new certificate active, click **Refresh certificates** on **Settings → Single sign-on** to add it at once. * **Upload a metadata file (XML) instead**: Hyperstack reads the fields from your provider's metadata file. * **Enter the details by hand instead**: fill in **Sign-in URL (IdP SSO URL)**, **Issuer (IdP entity ID)** and **Signing certificate** (a .cer, .crt or .pem file, or paste it). ![Step 3 with Sign-in URL (IdP SSO URL), Issuer (IdP entity ID) and Signing certificate](https://mintcdn.com/hyperstack/TA62Nx2wusH3dKmj/images/sso-saml-by-hand.webp?fit=max\&auto=format\&n=TA62Nx2wusH3dKmj\&q=85\&s=28ac24c46253e566f4f08edbc45ca5de) Without a metadata URL, you must add each new certificate yourself, and SSO turns off until a new test passes. See [Change the connection](https://thehyperstack.com/docs/tutorials/single-sign-on/domains-and-enforcement.md#change-the-connection). Hyperstack refuses a certificate that has already expired, and keeps up to 3 certificates. ### Google Workspace **1. Add a custom SAML app** In the Google Admin console, open **Apps → Web and mobile apps → Add app → Add custom SAML app**. Name it **Hyperstack** and click **Continue**. **2. Download the metadata** On **Google Identity Provider details**, click **Download Metadata** and click **Continue**. **3. Fill in the service provider details** Paste our **ACS URL** in **ACS URL** and our **Entity ID** in **Entity ID**. Set **Name ID format** to **EMAIL** and **Name ID** to **Basic Information → Primary email**. Click **Continue**, then **Finish**. **4. Turn on the app for your people** Open the app, then **User access**. Set it to **ON for everyone**, or for the groups or organizational units that use Hyperstack. **5. Upload the metadata in Hyperstack** In step 3, click **Upload a metadata file (XML) instead** and choose the file you downloaded. Then click **Save connection**. ## OIDC ![Step 2 for Other OIDC provider: Redirect URI and Initiate login URL](https://mintcdn.com/hyperstack/TA62Nx2wusH3dKmj/images/sso-generic-oidc.webp?fit=max\&auto=format\&n=TA62Nx2wusH3dKmj\&q=85\&s=3596e5d76f5140d117691ae893fa64b6) ### What to set in your provider * Add a **web** app (a confidential client with a client secret). * **Redirect URI**: our **Redirect URI**. * **Initiate login URL**, if your provider has an app tile: our **Initiate login URL**. * **Grant type**: authorization code. Hyperstack uses PKCE (S256). * **Scopes**: **openid**, **email** and **profile**. * **Client authentication**: `client_secret_basic` or `client_secret_post`. * **ID token signing**: RS256 or ES256. * **Email**: send `email` with `email_verified` set to true. ### What to bring back In step 3, fill in: * **Issuer URL**: the issuer of your provider. It ends before `/.well-known`. Hyperstack reads `/.well-known/openid-configuration`, and the issuer in it must be exactly the same. * **Client ID** * **Client secret** Click **Save connection**. Hyperstack never shows the secret again. To change it later, click **Replace secret**. ## Finish in Hyperstack **1. Verify your email domain** Add your domain, such as `acme.com`, and add the TXT record that Hyperstack shows to your DNS. See [Verify a domain](https://thehyperstack.com/docs/tutorials/single-sign-on/domains-and-enforcement.md#verify-a-domain). **2. Click Test sign-in** A new tab opens your provider. Sign in there. When the test passes, you see **Test passed** with the email, the name and the **Provider ID** that came back. If it fails, see [Test sign-in results](https://thehyperstack.com/docs/tutorials/single-sign-on/domains-and-enforcement.md#test-sign-in-results). **3. Click Turn on SSO** Your team can now sign in with SSO. Passwords keep working until you [enforce SSO](https://thehyperstack.com/docs/tutorials/single-sign-on/domains-and-enforcement.md#enforce-sso). ## Questions > [accordion] Does Hyperstack sign its requests? > > No. Hyperstack's SAML requests are not signed. Okta, Entra and most providers don't ask for this. > [accordion] Does single logout (SLO) work? > > No. Signing out of Hyperstack signs you out of Hyperstack only. > [accordion] We use Shibboleth with more than one identity provider > > Hyperstack connects to one identity provider per organization. Use the one that holds your staff accounts. > [accordion] Can I paste a certificate instead of a file? > > Yes. In **Enter the details by hand instead**, use **Or paste the certificate**. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.