Skip to main content

Azure AD SAML Setup Guide

Prerequisites: Enterprise plan on Hober | Azure AD (Entra ID) Global Administrator or Application Administrator role

Before you begin​

Collect the SP metadata values for your tenant from the Hober Dashboard:

  1. Log in to the Hober Dashboard as an admin.
  2. Navigate to Settings → Security → SAML.
  3. Copy the ACS URL and SP Entity ID displayed on the page.

The values follow this pattern:

FieldValue
ACS URL (Reply URL)https://app.hober.io/v1/auth/saml/{tenantId}/acs
SP Entity ID (Identifier)https://app.hober.io/saml/{tenantId}

Step 1: Register an Enterprise Application in Azure Portal​

  1. Sign in to the Azure Portal (https://portal.azure.com).
  1. Search for and select Microsoft Entra ID (formerly Azure Active Directory) in the top search bar.
  1. In the left sidebar, click Enterprise applications.
  1. Click + New application.
  1. Click Create your own application.
  1. In the panel that opens:
    • Enter a name, e.g. Hober Dashboard.
    • Select Integrate any other application you don't find in the gallery (Non-gallery).
    • Click Create.

Step 2: Configure Reply URL (ACS URL) and Identifier (Entity ID)​

After the application is created, you land on the app's Overview page.

  1. Click Set up single sign on (or navigate to Single sign-on in the sidebar).
  1. Select SAML as the single sign-on method.
  1. On the Set up Single Sign-On with SAML page, click the Edit icon on the Basic SAML Configuration card.

  1. Fill in the fields:

    • Identifier (Entity ID): paste the SP Entity ID from the Hober Dashboard.

      https://app.hober.io/saml/{tenantId}

    • Reply URL (Assertion Consumer Service URL): paste the ACS URL from Hober.

      https://app.hober.io/v1/auth/saml/{tenantId}/acs

    • Sign on URL: leave blank (Hober uses SP-initiated flow; users start from Hober).

    • Relay State: leave blank.

    • Logout URL: leave blank (optional; Hober does not yet consume IdP-initiated SLO).

  2. Click Save.

Step 3: Configure attribute claims​

Azure AD sends a default set of claims. You need to ensure the claim names match what Hober expects. Click the Edit icon on the Attributes & Claims card.

The default Azure AD claims use the following URIs, which match Hober's default attribute_mapping:

Claim name (Azure AD)Value
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddressuser.mail
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameuser.displayname
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givennameuser.givenname
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surnameuser.surname
http://schemas.microsoft.com/ws/2008/06/identity/claims/groups(see Groups claim below)

Verify these claims are present. If the emailaddress claim is missing:

  1. Click + Add new claim.
  2. Set Name to http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress.
  3. Set Name format to URI reference.
  4. Set Source attribute to user.mail.
  5. Click Save.

Configure the groups claim (optional)​

To send group membership to Hober:

  1. Click + Add a group claim.
  2. Select Security groups (or All groups depending on your directory).
  3. Set Source attribute to Group ID or sAMAccountName depending on your needs.
  4. Expand Advanced options and enable Customize the name of the group claim.
  5. Set the claim name to: 
    http://schemas.microsoft.com/ws/2008/06/identity/claims/groups
  6. Click Save.

Step 4: Download the Azure AD Federation Metadata XML​

  1. Return to the Set up Single Sign-On with SAML page for the application.

  2. In the SAML Certificates card, find the Federation Metadata XML row.

  3. Click Download.

Save the XML file — you will upload it in the next step.

Step 5: Upload metadata in Hober Dashboard​

  1. Log in to the Hober Dashboard as an admin.
  2. Navigate to Settings → Security → SAML.
  1. Click Upload IdP Metadata.
  2. Select the FederationMetadata.xml file you downloaded from Azure.
  3. Click Save.

Hober validates the XML on upload. The IdP Entity ID shown after saving should match the entityID in the Azure AD Federation Metadata XML (typically https://sts.windows.net/{aadTenantId}/).

Step 6: Assign users or groups in Azure AD​

Before testing, assign users (or groups) to the Hober enterprise application:

  1. In the Azure Portal, go to the Hober enterprise application.
  2. Click Users and groups in the left sidebar.
  3. Click + Add user/group.
  4. Select the users or groups that should have access to Hober.
  5. Click Assign.

Step 7: Test SSO login​

  1. In a private/incognito browser window, navigate to:

    https://app.hober.io/v1/auth/saml/login?tenantSlug=<your-tenant-slug>

  2. You should be redirected to the Microsoft login page.

  3. Sign in with your Azure AD credentials (and complete MFA if required).

  4. You should be redirected back to the Hober Dashboard, logged in.

If the login fails, see the Troubleshooting guide.

Attribute mapping reference​

The table below shows the Azure AD claim URNs and how they map to Hober user fields. This matches Hober's default attribute_mapping and the Azure AD default claim schema.

Hober user fieldAzure AD claim URIAzure AD user attribute
emailhttp://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddressuser.mail
namehttp://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameuser.displayname
given_namehttp://schemas.xmlsoap.org/ws/2005/05/identity/claims/givennameuser.givenname
family_namehttp://schemas.xmlsoap.org/ws/2005/05/identity/claims/surnameuser.surname
groupshttp://schemas.microsoft.com/ws/2008/06/identity/claims/groupsSecurity groups (Group ID or sAMAccountName)

The email attribute is required. Ensure user.mail is populated for all users who need to log in to Hober. If user.mail is empty for some accounts, use user.userprincipalname as the source attribute instead and verify it contains a valid email address.