Configure single sign-on for the Employee Hub

Set up SAML single sign-on (SSO) so employees can access the flair Employee Hub with credentials from your identity provider. This guide covers Google, Salesforce, and Microsoft Entra ID.

Who can use this?

Salesforce Admins who manage the Employee Hub and administrators for the selected identity provider.

Before you begin

• Find your Employee Hub domain in HR Admin → Hub Settings.
• Confirm that you can configure enterprise applications in Google Admin, Salesforce, or Microsoft Entra ID.
• Use a unique entity ID for each SAML provider when your organization configures more than one provider.

Configure SAML SSO with Google

After you enable Google SAML, Salesforce can no longer send manual Employee Hub invitations. Google manages all sign-ins.

1. In the Google Admin console, select Apps.

   

2. Click SAML apps.

   

3. Select Add App → Add custom SAML app.

   

4. Enter the app details. Use Employee Hub as the name if you want that name to appear in your Google Admin SAML app list.

5. Enter the following service provider details:

   Field	Value
   ACS	https://YOUR_INSTANCE.hub.flair.hr/_auth/saml/callback
   Entity ID	hub
   Name ID format	UNSPECIFIED
   Name ID	Basic Information → Primary Email

   Replace YOUR_INSTANCE with the domain from your Employee Hub URL.

6. Click Continue.

7. Map the email attribute.

   

8. Download the Google metadata.

9. In the flair HR app in Salesforce, open the App Launcher (⋮⋮ grid icon).

10. Open Hub SAML Configurations.

11. Click New.

12. Enter a name, the Entity ID, the SSO URL, and the Certificate from Google.

    

13. Enable the configuration. Employees can now sign in at https://YOUR_INSTANCE.hub.flair.hr/.

Configure SAML SSO with Salesforce

Configure Salesforce as the SAML identity provider, connect it to the Employee Hub, and grant users access to the connected app.

Enable Salesforce as an identity provider

1. In Salesforce Setup, enter Identity Provider in Quick Find.

   

2. Open Identity Provider.

3. Click Enable Identity Provider.

   

4. Select an existing certificate or click Create a New Certificate.

   note

   Salesforce documents the identity-provider setup in Enable Salesforce as an identity provider.

   

Connect the Employee Hub to Salesforce

1. In Salesforce Setup, enter App Manager in Quick Find.

   

2. Open App Manager.

3. Click New Connected App.

   

4. Enter an app name, such as SAML With Hub. Salesforce fills the API Name automatically.

5. Enter a Contact Email.

   

6. Under Web App Settings, select Enable SAML.

7. Configure the connected app fields:

   Field	Value
   Start URL	Your Employee Hub URL, such as https://YOURDOMAIN.hub.flair.hr
   Entity ID	An identifier such as hub
   ACS URL	https://YOURDOMAIN.hub.flair.hr/_auth/saml/callback
   Enable Single Logout	Leave cleared; single logout is not supported
   Subject Type	Username
   Name ID Format	The option ending in unspecified
   Issuer	Keep the prefilled value
   IdP Certificate	Select a certificate or keep Default IdP Certificate

8. Keep the remaining fields unchanged.

9. Click Save. Salesforce displays a summary of the connected SAML app.

   

Add the Salesforce configuration to flair

1. In the flair HR app, open the App Launcher (⋮⋮ grid icon).

2. Open Hub SAML Configurations.

   

3. Click New.

4. Enter a name, such as Salesforce.

5. Select Enabled.

6. In Entity ID, enter the value from the connected app.

   

7. In Salesforce Setup, open Identity Provider.

8. Copy the URL next to Salesforce Identity.

9. Open the URL in a browser to display the XML file.

10. In the XML file, copy the last URL that ends in /HttpRedirect.

11. In the Hub SAML configuration, paste the URL into SSO URL.

    

    

12. On the Salesforce Identity Provider page, click the link next to Label.

13. Click Download Certificate.

14. Open the .crt file in a code editor.

15. Copy the certificate text.

16. In the Hub SAML configuration, paste the text into Certificate.

17. Click Save.

    

    

    

Grant users access to Salesforce SSO

1. In Salesforce Setup, open Permission Sets.

2. Click New.

   

3. Enter a Label, such as SAML for Hub. Salesforce fills the API Name automatically.

4. Optional: Enter a Description.

5. Click Save.

   

6. Under Apps, open Assigned Connected Apps.

   

7. Click Edit.

   

8. Add the SAML connected app to Enabled Connected Apps.

9. Click Save.

   

10. In Salesforce Setup, open Users.

11. Select the user who needs SAML access.

    

12. Under Permission Set Assignments, click Edit Assignments.

    

13. Add the SAML permission set to Enabled Permission Sets.

14. Click Save. The user can sign in to the Employee Hub with Salesforce credentials.

    

Configure SAML SSO with Microsoft Entra ID

Create an enterprise application in Microsoft Entra ID, add its SAML configuration to flair, and test employee access.

note

If your Salesforce org has multiple Employee Hubs, open the SAML SSO configuration record and set Hub to limit the login option to one Hub. Leave Hub empty to show it on every Hub.

Create the Microsoft Entra ID application

1. In the flair HR app, open HR Admin from the navigation bar or the App Launcher (⋮⋮ grid icon).

   

2. In the left menu, click Domain.

3. In Domain, enter your Employee Hub domain in the format YOURDOMAIN.hub.flair.hr.

4. Click Update Domain.

   

5. In Microsoft Azure, open Microsoft Entra ID.

   

6. In the left menu, select Enterprise Applications.

7. Click New Application.

   

8. Click Create Your Own Application.

9. Enter an app name, such as flair Hub.

10. Select Integrate any other application you didn't find in the gallery (Non-gallery).

11. Click Create.

    

Add the Microsoft Entra ID configuration to flair

1. In the Microsoft Entra ID application, select Single Sign-On.

2. Select SAML.

   

3. In Basic SAML Configuration, click Edit.

4. Click Add Identifier.

5. Enter a unique entity ID, such as hub.

6. Click Add Reply URL.

7. Enter https://YOURDOMAIN.hub.flair.hr/_auth/saml/callback with your Employee Hub domain.

8. Optional: Enter a Sign On URL to change the sign-in page URL.

9. Click Save.

   warning

   Each SAML provider must use a different entity ID. For multiple configurations, use values such as hub1 and hub2, and enter the matching value in Microsoft Entra ID and flair.

   

10. In the flair HR app, open the App Launcher (⋮⋮ grid icon).

11. Open Hub SAML Configurations.

12. Click New.

13. Enter a Name, such as Microsoft Entra ID.

14. Select Enabled.

15. In Entity ID, enter the identifier from Microsoft Entra ID.

    

16. In Microsoft Entra ID, copy the Login URL from Set up flair Hub.

17. In flair, paste the URL into SSO URL.

18. In Microsoft Entra ID, under SAML Certificates, download Certificate (Base64).

19. Paste the downloaded certificate content into Certificate in flair.

20. Click Save.

    

21. In the flair HR app, open Home. The Setup Assistant indicates that SAML login is active.

    

Add Microsoft Entra ID users and test SSO

1. In Microsoft Entra ID, open Users and Groups.

2. Click Add User/Group.

   

3. Select Users.

4. Select each user who needs SAML access.

5. Click Select.

   

6. In the SAML application, open Single Sign-On.

7. Under Test single sign-on with flair Hub, click Test.

8. Click Test Sign In.

   

9. On the Employee Hub login screen, click Sign in with Microsoft Entra ID.

10. Select the Microsoft account to use. The Employee Hub opens for the selected user.

    

Troubleshooting

The SSO option is missing and employees are asked for a password

Employees must use the custom Employee Hub domain after you configure SSO. The standard https://hub.flair.hr/ login page does not show your organization's SSO option.

1. In HR Admin, open Hub Settings.
2. Find Custom Domain.
3. Add /login to that domain. For example, the SSO login for test-for-SSO.hub.flair.hr is https://test-for-SSO.hub.flair.hr/login.
4. Give employees the custom login URL and ask them to bookmark it.

Related articles

• Configure the Employee Hub
• Manage permissions and access control
• Manage licenses