SSO Through SAML
You can enable SSO (Single Sign-On) with your identity management system through the SAML 2.0 protocol. Hasura is a SAML 2.0 compliant service provider.
Configuring the identity provider
Create a new service provider on your SAML identity provider with the following configuration:
- Configure the ACS URL, Entity ID, Audience and Recipient to be
- Set the NameID format to
- You can set the default Relay State to be
Once created, note the IdP metadata in XML format. Dynamic metadata through an IdP metadata URL is also supported.
Configuring Hasura Cloud as the service provider
Provide the following details to support to configure SAML SSO:
- Domain Name(s): Domain tied to the email address of the users using SSO. If the emails of the users are tied to more than one domain, provide all the domains.
- IdP Metadata: Metadata of your identity provider in XML format. If you want to configure the metadata through a dynamic URL, you can instead provide the IdP Metadata URL.
- Provider: The name of this identity provider.
- Request Signing: Specify if you want the SAML assertion request to signed or un-signed.
Caveats and limitations
- Only a SP initiated flow is supported i.e. you can’t have a Launch button in your IdP dashboard to launch the project dashboard.
- Session expiry time is currently not configurable.
- Single logout is currently not supported.
- Once SSO is enabled for an org, it is enforced for that org. This means, if an org is enabled for SSO, the emails from that org cannot use any other login mechanism such as Google, GitHub, or email.
- Currently, only SAML with HTTP POST binding is supported.