SAML SSO

With the SAML SSO module, users can be automatically registered and logged into HumHub via a SAML 2.0 Identity Provider — Single Sign-On with no separate HumHub password.

SAML (Security Assertion Markup Language) is the open standard for exchanging authentication and authorisation between Identity Providers (IdPs) and Service Providers; in this setup HumHub is the Service Provider.

Overview:

• Single Sign-On against any SAML 2.0 Identity Provider — ADFS, Keycloak, Okta, Microsoft Entra ID (Azure AD), SimpleSAMLphp, and others
• Auto-detection of standard user claims (email, username, first/last name) — works out of the box for common IdP setups, no manual attribute mapping required
• One-click IdP metadata import via paste or file upload
• Single Logout (SLO) support
• Optional security hardening: signed AuthnRequest / Logout, encrypted NameID / Assertion, MFA enforcement at the IdP
• Optional dedicated SAML user provisioning — lock IdP-managed profile fields, auto-approve new users