Skip to main content
New user request Sign in Visit humanforce.com

Configure single sign-on (SSO) for Humanforce Analytics

Follow this guide to enable, configure, and manage single sign-on (SSO) for your organisation in Humanforce Analytics.

Before you start

  • You need Admin Settings permission to view or change SSO configuration. Other users can't access this page.
  • You need your identity provider (IdP) SSO details on hand, either as a metadata XML file, or as four individual values: Display Name, Entity ID, Single Sign-On URL, and x509 Certificate.
  • There's only one Save Settings button for this page — setting up SSO for the first time and updating it later both use the same steps.

Part 1: Turn SSO on or off

  1. Go to Settings > SSO.
  2. Select the Enable SSO checkbox.

Selecting the checkbox expands the page to show the SSO configuration options described in Part 2 and Part 3.

To turn SSO off, clear the Enable SSO checkbox instead. Turning SSO off doesn't take effect until you save — see Part 4.

Screenshot 2026-07-22 at 1.53.17 PM.png

Part 2: Choose a login method

Once SSO is enabled, choose how your users sign in:

  • Allow OTP and SSO for all users – Users can sign in with either a one-time password (OTP) or SSO.
  • Force SSO for users except Admins – All users must sign in with SSO. Admins keep the option to sign in with a one-time password (OTP), so an admin can't be locked out if there's a problem with the SSO configuration.
Screenshot 2026-07-22 at 1.53.59 PM.png

Part 3: Add your identity provider (IdP) details

Provide your identity provider's SSO details using one of the following methods:

Option A: Paste your IdP metadata

  1. Paste your IdP's metadata XML into the metadata field.
  2. Click Parse Metadata.

The Display Name, Entity ID, Single Sign-On URL, and x509 Certificate fields are filled in automatically from the pasted metadata.

Screenshot 2026-07-22 at 1.55.25 PM.png

Option B: Enter the details manually

Complete each field yourself:

  • Display Name – A label to identify this identity provider.
  • Entity ID – Your identity provider's unique identifier (also called the issuer).
  • Single Sign-On URL – The URL Humanforce Analytics redirects users to when they sign in.
  • x509 Certificate – The public certificate used to verify that sign-in responses genuinely come from your identity provider.
Screenshot 2026-07-22 at 1.56.14 PM.png

Part 4: Save your changes

  1. Click Save SSO Settings.

Your SSO configuration is saved, and users can now sign in using the login method you selected.

Note: Any change you make on this page — including turning SSO off — must be saved by clicking Save Settings before you navigate away. Unsaved changes are lost.

Edit your SSO configuration

Because there's only one Save SSO Settings button, editing an existing configuration uses the same steps as setting it up:

  1. Go to Settings > SSO. The page loads with your current configuration already filled in.
  2. Make your changes to the login method or identity provider details.
  3. Click Save Settings.

Troubleshooting

  • I can't see or open the SSO tab. SSO configuration is only available to users with Admin Settings permission. Contact your platform administrator if you need access.
  • Save Settings doesn't seem to save my changes. Check that all required identity provider fields are complete: Display Name, Entity ID, Single Sign-On URL, and x509 Certificate. Missing or incomplete fields prevent the configuration from saving.
  • Parse Metadata doesn't fill in the fields. Check that you've pasted valid, complete IdP metadata XML. If your identity provider's metadata is malformed or incomplete, correct it in your IdP admin console, or enter the four fields manually instead.
  • My certificate is rejected as invalid. Check that you've pasted the complete x509 Certificate value, with no missing characters or extra line breaks.

Related articles