Single sign-on with OneLogin
Learn how to set up single sign-on in the Dashboard with OneLogin.
Stripe supports single sign-on (SSO), allowing you to manage your team’s access and roles through your identity provider (IdP). This means your team can access Stripe without needing separate passwords. When SSO is configured, users (team members) are automatically redirected to your IdP for authentication when they sign in to Stripe.
Your IdP verifies that the user has a valid role assignment to your Stripe accounts or organisation, and generates a SAML assertion that Stripe uses to assign the proper roles in the Stripe Dashboard. When your account requires SSO, you must update team roles through your IdP for security. Changes to a team member’s roles only appear in Stripe after they sign in to the Dashboard again using the updated SAML assertion.
Set up SSO
To integrate your Stripe account with your IdP, complete three steps:
- Prove ownership of the domains that your team uses to sign in to the Dashboard.
- Configure OneLogin to work with Stripe.
- Configure Stripe to work with OneLogin.
Prove domain ownership
A domain is the portion of an email address after the @ symbol (such as kavholm.com). You must configure SSO for each of your business’s email domains. To verify domain ownership:
- Go to Single sign-on (SSO) in the Stripe Dashboard, and click + Add domain to view your account’s unique verification code.
stripe-verification=4242424242424242424242 - Add the verification code as a TXT record to your Domain Name System (DNS) provider.
- Return to the Stripe Dashboard, and click Save and verify . Depending on your DNS provider, it can take 24 hours or more to verify your domain.
- After successful verification, don’t delete the TXT record from your DNS provider. If you delete it, you might lose access to the Dashboard because Stripe frequently checks the DNS records of your domain.
Multiple Stripe accounts support
If you’re configuring SSO for multiple Stripe accounts, we recommend creating an organisation to centrally configure SSO across all of your accounts.
Configure OneLogin
Caution
There isn’t an official Stripe SAML connector in OneLogin yet. The only available Stripe app is for password-based authentication. Don’t use the password-based authentication for SAML.
-
Create a new application to represent the relationship between OneLogin and the Stripe Dashboard. To do so, go to the Applications page and select Add App .
-
Find the SAML Test Connector (IdP w/ attr w/ sign response) app.
-
Select Save and go to the Configuration section. Then, enter the following values:
- Audience : https://dashboard. stripe. the relevant part of the product
- Recipient : https://dashboard. stripe. the relevant part of the product
- Consumer URL Validator : https://dashboard. stripe. the relevant part of the product
- Consumer URL : https://dashboard. stripe. the relevant part of the product
- Select SSO on the side panel, and set the Signature Algorithm to SHA-256 .
- Save your configuration changes by selecting Save .
Assign roles to your team
You can assign Stripe roles to your users through OneLogin using SAML assertions, or directly in the Stripe Dashboard. The steps below cover the OneLogin approach. To use the Stripe Dashboard instead, see Assign roles in the Stripe Dashboard.
To authenticate a team member to Stripe and assign them roles, configure OneLogin to send the roles in the SAML assertions.
- Go to the Parameters section and create a new Field
- Set the Field name to Stripe-Role- . This identifies which account you sign in to.
- Select Include in SAML assertion .
- In the next form, select the Dashboard role you want your users to have by default. Select Macro , and input the desired default role in the field below
Stripe supports the following roles. Some of these roles are only available if your account uses the applicable Stripe product. For more information, see User roles supported by Stripe.
| Role | Value |
|---|---|
| Administrator | admin |
| Analyst | analyst |
| Cardholder | cardholder |
| Connect Onboarding Analyst | connect_onboarding_analyst |
| Connect Risk Analyst | connect_risk_analyst |
| Data Migration Specialist | data_migration_specialist |
| Developer | developer |
| Dispute Analyst | dispute_analyst |
| Financial Connections Specialist | financial_connections_specialist |
| IAM Admin | iam_admin |
| Identity Analyst | identity_analyst |
| Identity View only | identity_view_only |
| Issuing Support Agent | issuing_support_agent |
| Opal View only | opal_view_only |
| Refund Analyst | refund_analyst |
| Sandbox Administrator | sandbox_admin |
| Sandbox User | sandbox_user |
| Super Administrator | super_admin |
| Support Associate | support_associate |
| Support Communications | support_communications |
| Support Specialist | support_specialist |
| Tax Analyst | tax_analyst |
| Terminal Specialist | terminal_specialist |
| Top-up Specialist | topup_specialist |
| Transfer Analyst | transfer_analyst |
| View only | view_only |
Support for multiple Stripe accounts
Repeat the previous step and add a parameter for each additional Stripe account. Select Add parameter, use the current account’s token for the Field name and choose the role you want your users to have by default.
You can find the list of account tokens in the Accounts section of your Personal details settings.
- Go to the Users tab. Here, you can assign team members to your application. You can also configure which roles a user obtains at sign-in.
- Select the User you want to edit. Then, go to Applications on the side panel.
- In the next modal that opens, you can configure the roles that a user obtains when they sign in. To use multiple roles, add a semicolon after each role. In the following example, the user obtains the analyst and the developer role when they sign in.
Assign roles in the Stripe Dashboard
You can manage Dashboard roles directly in Stripe instead of through your identity provider. Existing role assignments carry over when you switch. No users lose access.
- In the Stripe Dashboard, go to Settings > Team and security > Single sign-on (SSO) .
- Click Configure role assignment .
- Change the role assignment preference from Identity provider to Stripe Dashboard .
After switching, manage team roles from Settings > Team and security > Team.
If you use the related setting, you can also sync groups from your identity provider to Stripe and assign Dashboard roles to those groups. When group membership changes in your IdP, Stripe access updates automatically. See Set up group-based role assignment.
Configure Stripe
Enter values from your identity provider
Next, configure your Stripe account to connect to your identity provider from the Single sign-on (SSO) page.
To configure Stripe to connect to your identity provider, you need:
- Issuer ID : An identifier of your identity provider.
- Identity provider URL : The URL of your identity provider that your team members are redirected to, so they can authenticate.
- Identity provider certificate : The X.509 certificate that your identity provider signs assertions with.
Find these values in your identity provider
In OneLogin, you can find these values by navigating to the SSO tab of your application.
| Name of property in Stripe | Name of property in OneLogin |
|---|---|
| Issuer ID | Issuer URL |
| Identity provider URL | SAML 2.0 Endpoint (HTTP) |
| Identity provider certificate | X.509 certificate (click View Details) |
Test your configuration
Before saving your settings, a test runs to validate your SSO integration. After you click Test, a window opens in your browser that redirects to your identity provider to sign in. After you sign in, the window automatically closes and test results display on the original page.
If the test succeeds, you can save the settings and select an enforcement mode. If the test fails, modify your configuration to address the issues reported and test the integration again.
Select an enforcement mode for SSO
When using SSO, you can choose from three enforcement modes. These affect which methods of authentication your team members can use.
| Mode | SSO authentication allowed | Regular authentication allowed |
|---|---|---|
| Off | No | Yes |
| Optional | Yes | Yes |
| Required | Yes | No |
Authenticate with SSO
After you finish configuring SSO, inform your users that they can sign in with any of these methods:
Stripe sign-in page
Users can go to the Stripe sign-in page, enter their email, then select Sign in with SSO.
If a user has access to multiple accounts, Stripe authenticates them with the default account connected to the user. If a user only has access to SAML accounts, or doesn’t have access to any accounts, Stripe redirects them to the IdP, regardless of the contents in the password field.
IdP-initiated login
To use IdP-initiated login, your IdP needs to support service provider-initiated login. Verify whether this is possible in your IdP’s documentation.
SSO URL
Use the following login URL with your domain to directly sign in to your account with SSO. This URL includes the domain and account you want to use for SSO authentication. If you change the account token at the end of the URL, it authenticates you against a different account.
Support for multiple Stripe accounts
If you’re configuring SSO for multiple Stripe accounts, first create an organisation to centrally configure SSO across all of your accounts. You can change the account token at the end of the SSO URL to authenticate against another account. You can find the list of account tokens in the Accounts section of your Personal details settings.
Multiple IdP connections: If you have multiple Stripe businesses with multiple IdP settings (for example, different SAML endpoints or issuer IDs) but share the same domain, we recommend using login URLs.
Revoke team member access
You can revoke a team member’s access using either active or passive methods.
Actively revoke access with an assertion
Send Stripe an assertion from your identity provider to grant a team member access to specific Stripe accounts. This also lets you revoke a team member’s access. To revoke access for a team member, assign them a role of none for the Stripe account whose access you want to revoke. For example:
<saml2:Attribute Name="Stripe-Role-STRIPE-ACCOUNT-ID" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic">
<saml2:AttributeValue>none
</saml2:AttributeValue>
</saml2:Attribute>
Caution
You can’t revoke access for the owner of a Stripe account.
Passively revoke access with enforcement mode
When enforcement mode is set to Required, only team members who can authenticate with your identity provider can access your Stripe account. In Required mode, you can revoke a team member’s access to a Stripe account by preventing your identity provider from authenticating them. In the Stripe Dashboard, set SSO to Required in Single sign-on (SSO).