Single Sign-On
Starhive supports Single Sign-On via SAML.
SSO is available on the Essential plan or higher. If your workspace moves to a plan without SSO, signing in through your identity provider is turned off, but the configuration — including verified domains and SCIM provisioning — is kept and works again as soon as the workspace is on a plan that includes SSO. In the meantime, users sign in with their email and password; anyone who has only ever signed in through SSO can set a password with Forgot your password? on the sign-in page.
Values Starhive needs from you, and gives you
Go to Workspace settings → Single Sign-On to find:
- Entity ID — Starhive's identifier, needed when configuring your identity provider (IdP).
- Response URL (Assertion Consumer Service / ACS URL) — where your IdP sends its authentication responses.
- Attribute mappings — the user attributes your IdP must send. See Attributes your IdP must send.
Attributes your IdP must send
Starhive reads two attributes from the SAML response, and both are required:
| Attribute name | Value |
|---|---|
email | The user's primary email address. |
name | The user's name, as it should be shown in Starhive. |
The attribute names must be exactly email and name, with no namespace. Many identity
providers send attributes under a full claim name by default, such as
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/email instead of email. Starhive does not read
attributes named like that, so add email and name as separate attributes. Other attributes your
IdP sends are ignored, so you can leave its default ones in place.
If the email attribute is missing or has the wrong name, signing in through your IdP fails with an
error saying a valid email address is required.
Example: Microsoft Entra ID
In the Microsoft Entra admin center, open Enterprise applications, select your Starhive application, and go to Single sign-on → Attributes & Claims → Edit. Then add two claims with Add new claim:
| Name | Namespace | Source | Source attribute |
|---|---|---|---|
email | (empty) | Attribute | user.mail |
name | (empty) | Attribute | user.displayname |
Entra fills in the Namespace field for you. Clear it before saving, or the claim is sent under a full claim name and Starhive will not find it.
If some of your users have no email address in the mail field, use user.userprincipalname as
the source for email instead, provided your user principal names are the users' real email
addresses.
When you are done, the claims list shows rows named just email and name, without a
http://... prefix.
Setting up the configuration
From Workspace settings → Single Sign-On, click Configure:
- Enter an Organisation Name to identify this configuration.
- Enter the Metadata URL from your IdP.
- Optionally enable Automatically Add Users to This Workspace, so a first-time SSO login adds the user to the workspace automatically.
- Save.
Allow a few minutes for the configuration to propagate before testing sign-in.
If SCIM provisioning will be your source of truth for workspace membership, turn off "Automatically Add Users to This Workspace" — see SCIM Provisioning for why.