We use cookies to make HubSpot's community a better place. Cookies help to provide a more personalized experience and relevant advertising for you, and web analytics for us. To learn more, and to see a full list of cookies we use, check out our Cookie Policy (baked goods not included).

Allow cookies

SAML authentication

Status: Delivered
Chad
Submitted by on ‎Jun 26, 2017 11:34 AM

Please add support for SAML authentication. Currently your account security seems to be subpar compared to the rest of the industry. From what I can tell there's no two-factor support, no ability to set minimum password requirements nor support to just force the use of Google login. With SAML support we can manage our entire login security stack (user account verification, two-factor decision, password requirements). With HubSpot containing high sensative information I can't believe this hasn't come up before.

 

At the very least just let us force users to have to use Google to login, then we can mandate some requirements through that.

See more ideas labeled with:
HubSpot updates
Jun 7, 2021

@Beefy80a we're definitely interested in making SSO available to more of our users. You're absolutely correct that it is not just a concern for larger enterprises, & we want to make options for using it easier to access & improve our SSO system as a whole. I don't have concrete news to share there just yet, but when I do I'll be sure to update this thread!

Apr 4, 2019

Hey @ssoadmin I haven't been able to reproduce this on my side just yet. If you're working with our support team, providing them with a Safari version number & that web archive would be helpful. I think I'm on the latest Safari version myself, but I did run into some trouble with a beta branch of Safari a while back because it was defaulting to not allowing third-party cookies to be set in my browser, which made logging into some tools fail.

Feb 21, 2019

@ssoadmin great to hear! Glad you're getting value out of the new features.

Feb 19, 2019

Hey all,

 

Wanted to drop into this thread to announce some good news you may have already seen in your HubSpot accounts: we've officially got the require SSO functionality delivered to all Enterprise HubSpot accounts, as well as officially supporting SSO for login on our mobile apps. If you want to know more about the functionality & how it works, check out this post on our product blog!

Jan 4, 2019

Hey @ssoadmin, that's actually the beta I mentioned above for requiring SSO. It does indeed require it for login.

 

The caveat there is that the mobile app is currently working to add SSO login support, so if you have mobile users who need to access the app after you require SSO, you can add them to the excluded users list (by clicking the link under the require SSO checkbox.) That'll allow them to bypass the requirement & log in with HubSpot credentials; we built this feature with contractors or partners who don't have credentials on your SSO provider in mind. Our mobile team is working quickly to get the SSO login flow into the mobile app, so that necessity will be temporary.

 

cc @vishnu

Nov 8, 2018

That's a fair point--we definitely want to allow folks to force SSO as quickly as we can. We currently have that feature in a limited beta. If anyone in this thread is interested in learning more about that beta, please reach out to me via private message & I'm happy to chat more about it & get more accounts involved!

Re: SAML authentication - changed to: Delivered
Oct 15, 2018

Just wanted to drop by and formally mark this one delivered! We're hard at work making improvements to SAML support (like the ability to force all logins to your account to happen via single sign-on), but it's available now to all Enterprise customers in HubSpot.

Sep 14, 2018

@tspringer there aren't imminent plans to bring this to the Professional level at this point. Currently it's a cross-hub feature, meaning that if you have one Enterprise product, you'll get access, no matter which of our tools you're using (Sales Enterprise, Service Enterprise, or Marketing Enterprise.)

Re: SAML authentication - changed to: In Beta
Sep 12, 2018

Hey everyone! Me again. Got some good news, which you might've seen at Inbound, or on our Product Updates: SAML 2.0 is available in HubSpot Enterprise! We're still refining the functionality, but currently, that means that all Enterprise customers can enable single sign-on as an additional login method available for the HubSpot account. There are additional features coming down the pipe very quickly, but we're glad to be able to offer the ability to support SSO for login right now.

 

If you already have a HubSpot Enterprise account, you should see the option to set up SSO in your Account Defaults settings menu. As long as your IDP supports creating a SAML 2.0 app with HTTP POST bindings, your SSO should easily integrate with HubSpot. Detailed setup guides will be coming for more providers soon, but right now we offer steps for both Okta & OneLogin. Hope you're as excited to see this functionality in HubSpot as we are!

Re: SAML authentication - changed to: In Planning
Aug 10, 2018

Hey everyone, just wanted to swing back through to say we're officially doing the planning for SAML 2.0 with HubSpot now. This thread will be updated as soon as we've got more info to share. Thanks for your feedback, & for pushing us to build the best possible product!

May 29, 2018

Hey folks! I work with the product team responsible for our login and account security efforts, so I wanted to jump into this thread and let you know that this is definitely a request that is on our radar. We get the request for SAML and more full-featured SSO support often enough that we recognize it's a big draw for our customers, especially those juggling multiple software solutions where those features are already in use in other parts of the organization. It's definitely something we'd like to solve for you.

 

Since this thread was created, we have added support for two-factor authentication via SMS and Google Authenticator on a per-user basis. If you haven't already activated that feature on your HubSpot account, it's worth doing; SAML is a diffent project, but one we'd like to tackle.

30 Replies
rad
HubSpot Product Team
HubSpot Product Team
‎Feb 21, 2019 10:10 AM

@ssoadmin great to hear! Glad you're getting value out of the new features.

ssoadmin
Member
‎Apr 3, 2019 4:00 PM

 

Is it possible that SSO is broken when the browser is Safari?  I've been going back and forth with Support about one user who can't log in, they want videos, screen shots, a browser webdev tool recording, etc..  I decided to recreate most of the screen shots using my own computer and Safari, knowing the user in question was using Safari, and what do you know, I get the same SSO failure as shown below.  However, flip back to Firefox, log out, clear cookies, start fresh, and it works fine.  Seems weird that it would be browser specific but now I can reproduce it.

Screen Shot 2019-04-03 at 3.46.25 PM.png

 

 

rad
HubSpot Product Team
HubSpot Product Team
‎Apr 4, 2019 5:29 PM

Hey @ssoadmin I haven't been able to reproduce this on my side just yet. If you're working with our support team, providing them with a Safari version number & that web archive would be helpful. I think I'm on the latest Safari version myself, but I did run into some trouble with a beta branch of Safari a while back because it was defaulting to not allowing third-party cookies to be set in my browser, which made logging into some tools fail.

ssoadmin
Member
‎Apr 8, 2019 10:13 AM

Yep, I have a ticket going.  I updated them with the Safari version (Mojave / MacOS latest).  Chrome & FF on the same computer work fine.

Beefy80a
Member
‎May 11, 2019 11:21 AM

Hi rad 

 

We have recently joined hubspot I have seen that SSO is available for Enterprise customers however we only have marketing pro and would not benefit from any of the other enterprise features, the additional cost of enterprise to simply have SSO is prohibitive to us. 

 

Are there plans to make this available to Pro users or as a possible add on to pro users. Sadly I was not involved in the procurement process and by the time I’ve got involved it’s purchased and I’m asked to sort users out and get domains configured. If not are hubspot considering to add a Microsoft account button like you have already for google?

 

In my opinion if a product can support SSO it should be available to all as we all know passwords are weak and by using SSO additional checks can be done along with actually dropping passwords altogether. In the past it was only enterprise businesses who implemented SSO due to the additional management but now with the likes of okta, azure ad, g suite more business small and large can protect themselves but that’s only achievable if the Service Providers allow us to use SSO in more than just their enterprise plans. 

BethanyPester
Member
‎Aug 28, 2020 9:05 AM

Good afternoon all,

 

This idea is great!

 

However as an administrator when logging onto other users to make changes to their profiles - add e-mail signatures, connect phone numbers, update views etc the system does not allow me to do this requiring verification number sent by e-mail. Obviously the system sends this to the user e-mail rather than my own. It would be even better if the admin user could be exempt from this and able to log in to any user? -  most of our users are salesmen and they do not want to have anything to do with the admin side of things!

 

Perhaps the admin could log into their own account and the in settings>users and teams>actions (the little grey dropdown) have a option to "access user's account" to edit their profile/system defaults and settings/ table views/ dashboard defaults/ signatures/ connect phone/email etc

lfrancis1
Participant
‎Dec 6, 2020 12:50 PM

Whould be good to see SSO and SAML incliuded across all packages. In 2020 this is a basic security feature that all SaaS providers should offer.

Beefy80a
Member
‎Apr 22, 2021 7:24 AM

@rad are Hubspot going to make SSO available to the professional plan?  In 2021 its not only Enterprises that use SSO smaller businesses are now using SSO as both Google and Microsoft Include SSO capable directories as part of their offering along with many other platforms now being available.  As a smaller business we cannot justify the cost of Enterprise to enable SSO (and before its said we do not need any of the other enterprise features) but enable SSO everywhere as the security benifits outweight the setup and maintenance required to run this.  Hubspot are also featured on https://sso.tax as the worst offender to offer SSO as a feature in comparison to cost.  As everyone is moving to a cloud first approach SSO should be available on at least a mid tier not just Enterprise tiers.

rad
HubSpot Product Team
HubSpot Product Team
‎Jun 7, 2021 5:57 PM

@Beefy80a we're definitely interested in making SSO available to more of our users. You're absolutely correct that it is not just a concern for larger enterprises, & we want to make options for using it easier to access & improve our SSO system as a whole. I don't have concrete news to share there just yet, but when I do I'll be sure to update this thread!

Beefy80a
Member
‎Jun 9, 2021 3:27 AM

@radGreat I look forward to hear what's coming up.