Single Sign-On (SSO) via SAML

HackerOne supports Single Sign-On (SSO) through Security Assertion Markup Language 2.0 (SAML 2.0) for these providers:

Contact HackerOne if you have another SAML provider.

Note: Your program must be launched and not in sandbox mode to set up SAML.

Set Up

To configure Single Sign-On via SAML:

  1. Go to Program Settings > General > Authentication.
  2. Click Setup SAML in the Single Sign-on with SAML section.

saml setup

  1. Click Enter Configuration on the SAML Configuration page.

Image?

  1. Enter information for these fields:
Field Details
Domain The domain for users that will be required to use SAML authentication. The domain must be verified before entering. If you don't have a verified domain, see Domain Verification to set up a verified domain. Note: Please use your own domain, not the HackerOne domain.
Single Sign On URL The URL from your SAML provider to initiate a single sign-on attempt, sometimes called the login URL.
X509 Certificate The certificate from your SAML provider to verify the single sign-on response.

setup SAML Configuration modal

  1. Click Save.
  2. Click Start Test in the Test it section of the SAML Configuration page.

Start Test button

  1. Click Run test in the SAML Settings Test modal that pops up.
  2. Click Start test now.

SAML start test

  1. Enter your login credentials to the test window. After your login attempt, the test will either succeed or fail and provide warning messages about your test login. If your test fails, run another test by going back to step 6 above.
  2. Click Verify Settings.

Verify Settings

  1. Click Verify in the Verify SAML Settings modal. Once you verify your settings, you won't be able to change your settings or run tests on the domain anymore.
  2. Click Enable SAML once you're ready to migrate all user accounts to SAML authentication.
  3. Click Enable in the Enable SAML modal that pops up.

Once you've successfully enabled SAML, all users that are part of the domain will be required to authenticate using SAML. The passwords associated with those accounts will be removed. Users will receive instructions on their first log in informing them of the change.

Additional Information

Here are some screenshots that provide additional details on Service Provider and Attribute mapping:

saml1

saml_2

Configure an Alternative Certificate

If you need to switch your identity provider or if your current SAML certificate is expiring, you can configure an alternative SAML certificate to avoid having to disable your SSO integration during the update.

Note: Only the admin of the program has the ability to configure the alternative certificate.

To configure an alternative certificate:

  1. Go to Program Settings > General > Authentication.
  2. Click configure next to X509 alternative certificate.

Authentication settings page with SAML configured

  1. Enter the alternative certificate in the Configure alternative certificate window.

configure alternative certificate modal

  1. Click Save.

After the alternative certificate has been configured, users will be able to authenticate through the new SAML certificate.

When the primary certificate isn't used anymore, you can promote the alternative certificate to the primary by clicking Promote alternative certificate to primary certificate. This will enable your primary certificate to be replaced with the alternative.

authentication settings page with alt certificate configured