IdP settings reference
Common settings
- Name
The name of this IdP. Shown on the login screen.
- Enabled
Disabled IdPs are not available for authentication, and are not shown on the login screen. (The Local IdP cannot be disabled, to prevent you from being locked out of HelloID.)
- Display On Login Page
Whether this IdP is shown on the user login screen.
- Enable JIT
Users logging into this IdP will have a new user account created in HelloID, if one does not already exist.
- Change Icon
Upload a new icon for this IdP. Shown on the login screen.
- Login URL
The external URL to which HelloID sends all authentication requests.
- Logout URL
The URL to which users will be routed when they log out of HelloID. Leave this blank to route them back to the HelloID login screen.
- Client Restrictions Action
Whether to hide or show this IdP on the login screen, based on the configured restriction(s). See Show/hide IdPs (client restrictions).
- Use IP Restriction
The IP ranges for which this IdP will either be hidden or shown.
Use WAN IP Addresses From Active Agents:
- Use Source Restriction
The browser types for which this IdP will either be hidden or shown.
SAML IdPs
- Require SAML Response Signature
Requires the response from the IdP to be signed with the selected certificate.
- Verify SAML Issue Time
Verifies that the SAML assertion was issued within an acceptable time period. If not, authentication fails.
- Verify SAML Request ID
Verifies that the Auth ID sent from HelloID is correctly sent back in the SAML response. If not, authentication fails.
- Use Response Certificate
Enable if you plan to use a different certificate to sign the IdP response. (optional, advanced use only)
- Use Response Decryption Certificate
Enable if you plan to use a different certificate to decrypt the IdP response. (optional, advanced use only)
- Mapping Set
The IdP mapping set to use for this IdP. See IdP mapping sets.
- Consumer URL (Read Only)
The HelloID URL to which SAML assertions will be sent.
- Issuer
The base URL of your HelloID instance (e.g.,
https://company.helloid.com)- Use IDP-Initiated Strategy
Enable if the IdP only allows starting the login flow from its side.
Custom IdP-Initiation URL: Enter the URL of the IdP's login screen. Users will be redirected to it when logging into HelloID.
- Binding
A "binding" is how a SAML requester and responder communicate. Two kinds of bindings are support: Redirect and POST. Your chosen IdP will most likely define which binding they support. The default setting, Redirect, sends SAML protocol messages as URL query parameters. POST sends SAML protocol messages as base64-encoded content through an HTTP-POST message.
- Request Certificate
The certificate that HelloID will use to encrypt the authentication request.
- Response Certificate
The certificate that the IdP will use to encrypt the response (optional, advanced use only).
- Response Decryption Certificate
The certificate that HelloID will use to decrypt the response (optional, advanced use only).
Active Directory (Agent) IdP
- Directory Configuration
The AD configuration to use with this IdP. AD configurations are created when you set up AD sync.
Azure AD OIDC IdP
- Client Identifier
The Application (client) ID value provided by Azure AD.
- Client Secret
The Application (client) Secret value provided by Azure AD.
- Additional Scopes
Additional scopes to request when authenticating with Azure AD.
- Domain Hint
Domain hint directives to send along with authentication requests.
- Retrieve On-Behalf-Of Token And Store To User Attributes
Store the on-behalf-of and on-behalf-of-refresh tokens as Custom user attributes. These tokens can then be passed into Applications, to directly access the Azure Graph API on behalf of the users, without requiring re-authentication.
Shortcut IdP
- Login URL
The URL which the user will be redirected to.
Misc.
- Use SSRPM
AD Agent IdP only. Enable if your organization is using SSRPM for Active Directory self-service password resets. When enabled, and a SSRPM URL is specified, users are redirected to your organization's SSRPM portal when they click the 'Forgot your password?' link on the HelloID login page.
SSRPM URL: The URL of your organization's user-facing SSRPM portal.
- Enable Text On Login Page
Display a custom message to users on the login screen. Only available for AD Agent IdP and Local IdP types.
Custom Text: The message to show on the login page. Supports Markdown syntax, including links.