Appearance
Connect another SAML provider
Available onEnterprise
Who can do thisWorkspace owners in Infyva, and an admin of your identity provider
Any identity provider that supports SAML 2.0 can sign your team in to Infyva. Use this page for providers without their own guide here, such as OneLogin, JumpCloud, PingOne, Keycloak or ADFS. The field names below are the common ones; your provider may word them a little differently.
Before you start
- Your workspace is on Enterprise. Single sign-on is not part of Starter, Pro or the Pro trial.
- You are a workspace owner in Infyva. Admins can open the page and choose the role new teammates get, but only owners can connect a provider, verify domains or turn SSO on.
- You can add a DNS TXT record for your company email domain, or you know who can.
- You can open Infyva's SSO page: in the sidebar click Settings, then Single sign-on (under Security). If the page shows Set up single sign-on with Coming soon, single sign-on is not switched on for your workspace yet. Email support@infyva.ai.
- Keep a second browser window, or a private window, for testing. Stay signed in to Infyva as an owner in the first one until SSO works.
Values to copy from Infyva
Open Settings > Single sign-on in Infyva and choose the SAML tab. Copy these with the Copy buttons.
| In Infyva | Paste into | Value |
|---|---|---|
| ACS URL (reply URL) | ACS URL / reply URL | https://sso.infyva.ai/api/oauth/saml |
| Entity ID (audience) | Entity ID / audience | https://sso.infyva.ai |
| Our metadata | Service provider metadata (if your provider can import it) | https://sso.infyva.ai/.well-known/sp-metadata |
If your provider can import service provider metadata, give it Our metadata and it fills in the ACS URL and Entity ID for you.
Step 1: Create the app in your provider
Create a new SAML 2.0 application (often called a custom, generic or non-gallery app) and set:
| Setting | Value |
|---|---|
| ACS URL, reply URL, single sign-on URL or recipient | Infyva's ACS URL (reply URL) |
| Entity ID, audience, SP entity ID or audience restriction | Infyva's Entity ID (audience) |
| Binding | HTTP POST |
| Name ID format | Email address (urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress) |
| Name ID value | The user's work email |
| Signing | Sign the assertion, the response or both, with SHA-256 |
| Assertion encryption | Off |
| Relay state, single logout URL | Leave empty |
| Login or start URL (if asked) | https://www.infyva.ai/auth/login |
Step 2: Map the attributes
Infyva needs an email address. It reads it from the first of these that is present: an attribute named email, an attribute named http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress, or a Name ID in the email address format.
| Attribute name (either form works) | Value | Required |
|---|---|---|
email or http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress | Work email | Yes |
firstName or http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname | First name | No |
lastName or http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname | Last name | No |
Group and role attributes are ignored.
Step 3: Assign people and export the metadata
- Assign the app to the people or groups who use Infyva. Include yourself.
- Copy the provider's IdP metadata URL, or download the IdP metadata XML. Infyva needs metadata that contains an
EntityDescriptor, the signing certificate and the single sign-on URL.
Step 4: Save the connection in Infyva
- On the SAML tab, drop the XML on Upload the metadata XML file, or paste the URL into Or the metadata URL. Files can be up to 512 KB.
- Click Save connection.
You see Identity provider connected. If you see That file doesn't look like SAML IdP metadata., you downloaded the wrong file: look for the identity provider metadata, not the service provider settings or the certificate alone.
Verify your email domain in Infyva
Only people whose email address is on a verified domain can sign in with SSO.
- In Infyva, on the Single sign-on page, go to 2 Verify your email domain.
- Type your domain, for example
northwindlabs.com, and click Add domain. - Copy the Name and Value with their Copy buttons and add them as a TXT record at your DNS provider.
- Click Check now. When the badge changes from Waiting for DNS to Verified, you are done.
DNS changes can take a few minutes, sometimes longer. Details and limits: Verify your domain.
Turn on SSO and test it
Infyva has no separate test button. You test by signing in.
- Go to 3 Turn it on. Switch on Allow sign-in with SSO.
- Under New teammates join as, choose Recruiter or Viewer. This is the role a person gets the first time they sign in with SSO.
- Click Save.
- In a private window, open the Infyva sign-in page.
- Type your work email in the email field, then click Sign in with SSO. Do not type a password.
- Sign in at your identity provider. You come back to Infyva and land in your workspace.
The Status panel on the right now shows On and the time of the Last SSO sign-in. The sign-in is also in your audit log.
Start sign-in from Infyva
Infyva supports sign-in that starts on the Infyva sign-in page. Sign-in that starts from a tile in your provider's app launcher, or from a provider's own Test button that signs in from the provider side, is not supported. Point the tile at https://www.infyva.ai/auth/login, or hide it.
Require SSO
Once one SSO sign-in has worked, you can make SSO the only way in for your verified domains.
- On the Single sign-on page, switch on Require SSO. The switch stays greyed out until the first successful SSO sign-in.
- Click Save.
From then on:
- People on your verified domains can no longer sign in with a password. They see Your workspace requires single sign-on. Use "Sign in with SSO" instead.
- Password sessions that were already open for those people end. Someone already signed in is asked to sign in again when their current session runs out.
- Workspace owners keep password sign-in, so an owner can still get in if your identity provider is down. Read Require SSO and the owner fallback before you turn this on.
To also protect links you send to hiring managers, see Require SSO on hiring-manager links.
Roll back
- To pause SSO, switch off Allow sign-in with SSO and click Save. Everyone signs in with passwords again.
- To remove it completely, click Turn off and remove SSO in the Status panel. People keep their Infyva accounts.
- If you click Replace and save a new connection, Infyva turns Require SSO off until someone signs in with SSO again. This stops a broken connection from locking your team out.
Troubleshooting
See Troubleshooting SSO for every Infyva sign-in message and what to do about it.
Limits in this release
- No SCIM. Infyva does not receive user or group updates from your provider. Accounts are created the first time someone signs in. When someone leaves, block them in your provider and choose Suspend account in Settings > Team and roles. Remove alone is not enough: a removed person who can still sign in at your provider joins again on their next SSO sign-in.
- No group or role mapping. Everyone who joins through SSO gets the role set in New teammates join as. Change roles afterwards in Team and roles.
- Sign-in starts from Infyva. Sign-in started from your provider's app tile is not supported.
- One identity provider per workspace. Saving a new one replaces the old one.
- Metadata is read once. If you give a metadata URL, Infyva reads it when you click Save connection. After a certificate change at your provider, save the connection again.
- Team members only. Candidates never sign in with SSO.