Single sign-on and user provisioning

Connect your identity provider to let members sign in through single sign-on and keep their access to your Hyperline account aligned with your directory. You can connect:

• Google Workspace for authentication and Google directory synchronization
• SAML and SCIM for SAML authentication and SCIM user and group provisioning

A member with the Manage authentication permission configures a separate connection for each Hyperline account.

​

Before you start

You need:

• A Hyperline role that includes the Manage authentication permission. This permission also gates enabling or disabling multi-factor authentication. See Users & permissions
• Pop-ups allowed for Hyperline in your browser

For Google Workspace, you also need:

• A Google Workspace administrator account
• The Google Admin SDK Directory API enabled for users and groups

For SAML and SCIM, you also need administrator access to an identity provider that supports SAML 2.0 authentication and SCIM 2.0 user and group provisioning.

​

Understand the connection

Authentication and provisioning use different mechanisms depending on your identity provider:

​

Connect Google Workspace

​

Connect SAML and SCIM

​

Reconfigure single sign-on

Click Reconfigure to reopen the setup assistant for the existing connection. Use it to update single sign-on, finish domain verification, or complete SCIM configuration without deleting the connection. When you close the setup assistant, Hyperline refreshes the connection details and statuses automatically. For Google Workspace, use Configure in the directory synchronization line to authorize user and group synchronization. For SAML connections, configure SCIM in the setup assistant and your identity provider.

​

Manage directory synchronization

Once directory synchronization is connected, Hyperline displays:

• Last synchronization: the date, time, and result of the latest synchronization
• Synchronize now: fetches the latest users and groups from Google Workspace
• Provision users in Hyperline: controls whether synchronized users become members of this Hyperline account

Click Synchronize now, then confirm the action. Synchronization continues in the background and can take a few minutes. If it fails, hover over Failed to view the error returned by the identity provider.

​

Provision users in Hyperline

After Google directory synchronization or SCIM provisioning is configured, enable Provision users in Hyperline and click Save changes. Hyperline then applies user and group changes received from the identity provider. Provisioning follows these rules:

• A new directory or SCIM user creates a member in this Hyperline account.
• If the email address already belongs to a Hyperline user, Hyperline links that user instead of creating a duplicate.
• Profile and group changes update the provisioned member and their assigned role.
• Suspending or blocking a user in the identity provider removes their provisioned access. Restoring them reactivates the existing membership instead of creating a duplicate.
• Deleting a user in the identity provider removes every provisioned Hyperline membership linked to that identity, except account owner memberships.
• Account owners are never automatically removed or suspended by identity provider provisioning.

You can continue to invite and manage members manually. A user can have a manually managed membership in one Hyperline account and a provisioned membership in another. Identity provider changes only control memberships marked Provisioned; they do not remove manually managed access. Provisioned memberships display a Provisioned label in Settings > Team > Members. Their role and removal actions are disabled because their access is controlled through the identity provider. Update the identity provider or role provisioning rules instead.

​

Assign roles from identity provider groups

Configure role provisioning from Settings > Team > Roles. Each Google group can be mapped once. Use the actions menu on an existing mapping to edit its Hyperline role or delete the mapping. If a user belongs to several mapped groups, the first matching mapping determines their role. When no group matches, Hyperline assigns the Default role configured in Role provisioning. If no specific provisioning default is selected when provisioning is enabled, Hyperline uses the account’s standard default role. Adding, editing, or deleting a mapping, or changing the default role, reconciles existing provisioned memberships automatically.

​

Troubleshoot configuration

​

Single sign-on is connected, but directory synchronization is not

This is expected when only the authentication setup is complete. Click Configure in the directory synchronization line and authorize access with a Google Workspace administrator account.

​

Google groups are unavailable

Confirm that the Google Admin SDK Directory API is enabled and that the administrator granted access to both users and groups. Configure directory synchronization again if authorization is still required, then start a manual synchronization.

​

SCIM provisioning is not configured

Click Reconfigure and complete the SCIM configuration in the setup assistant and your identity provider. Confirm that the identity provider is configured to provision both users and groups to Hyperline.

​

Provisioned users do not appear

Confirm that the provisioning status is Configured, Provision users in Hyperline is enabled, and the relevant users are assigned to the Hyperline application in your identity provider. For SAML and SCIM connections, also review the provisioning status and logs in your identity provider.

​

Synchronization failed

Hover over Failed next to the latest synchronization to view the provider error. Resolve the reported Google Workspace configuration or authorization issue, then click Synchronize now.

​

Related

• Users & permissions
• Account settings