Single sign-on (SSO)

1. In Hourglass, open Settings › Security › Single sign-on and choose SAML 2.0.
2. Copy the ACS URL and Entity ID into a new SAML app in your identity provider.
3. Send the email address as the NameID, and map firstName and lastName.
4. Download the identity provider's metadata XML and upload it in Hourglass.
5. Select Test with my account. When it works, turn SSO on.

SSO is available on Professional and Enterprise.

Choose OpenID Connect instead of SAML, then enter your provider's discovery URL, client ID and client secret. Request the openid, email and profile scopes, and add the redirect URL Hourglass shows to your provider's allowed list.

After a successful test, turn on Require SSO. Password sign-in then stops for everyone except up to two break-glass admins you name, who keep a password and two-step verification so they can still get in if the identity provider is unavailable.

Most failed sign-ins come from one of three things:

• Clock skew: the identity provider's clock is more than 3 minutes off, so the assertion looks expired.
• Email mismatch: the NameID isn't the person's Hourglass email address.
• Expired certificate: the provider rotated its signing certificate; upload the new metadata.

The sign-in error page shows a reference code your admin can look up in the audit log.