See our overview of Security in Hive.

Note: ADFS does not currently support automatic deprovisioning with SCIM. When users are deprovisioned in your IDP, don't forget to deactivate the user in Hive.

ADFS SSO (and all SAML SSO) is part of the Enterprise Security add-on. To add it to your plan, an Admin can turn on the Enterprise Security card in Apps.

1. Open your ADFS Management console

2. Select the "Add Relying Party Trust..." action
​

3. Leave the default selected "Claims aware" option, click "Start"
​
4. On the "Select Data Source" screen, select "Enter data about the relying party manually" and click "Next"
​

5. On the "Specify Display Name" screen, add a friendly display name. Most people will add their company name with something denoting that it is for Hive. Click "Next"
​

6. On the "Configure Certificate" screen, leave fields empty and click "Next"
​
7. On the "Configure URL" screen, select the "Enable support for the SAML 2.0 Web SSO protocol". For the relying party URL, copy your ACS URL from Hive: Open Workspace settings. Under Advanced, select Security, then select Authentication. Under Your ACS URL, select Copy URL. Paste it here. The URL should look something like "https://app.hive.com/sso/saml/9W72AGwBUhYeKSpiS" where "9W72AGwBUhYeKSpiS" is unique to your Hive workspace. Click "Next".

8. On the "Configure Identifiers" screen, add an identifier with the value of "https://hive.com". Click "Next". If you selected Use unique Service Provider Entity ID in Hive, use the value under Service Provider Issuer (Entity ID) on the Authentication page instead.

9. On the "Choose Access Control Policy" screen, leave the "Permit Everyone" policy and click "Next".

10. Once at the "Ready to Add Trust" screen, click "Next". On the final screen, leave the "Configure claims issuance policy for this application" checkbox checked. Click "Close".

11. If the "Edit Claim Issuance Policy" did not appear, right click on your new Trust in the "Relying Party Trusts" list and click on "Edit Claim Issuance Policy"

12. Select "Add Rule..."
​

13. Leave the default "Claim rule template" of "Send LDAP Attributes as Claims" selected and click "Next".

14. Name the claim rule "Hive Attributes" or something similar. You will use this to send LDAP attributes to Hive on user provisioning and login.

15. Select "Active Directory" as the "Attribute store"

16. Add 2 field mappings. One with the "Outgoing Claim Type" of "firstName" and another "lastName". You should select whatever LDAP attributes best represent the user's first and last name. Most people use "Given-Name" for "firstName" and "Surname" for "lastName". These mappings are optional, but we recommend them. Hive uses them to name new users.

17. Click "Finish" to save the attribute mappings.

18. You'll need to add one more rule from the "Claim Issuance Policy" screen. Click "Add rule" again.

19. Select the "Transform an Incoming Claim" option on the "Claim rule template" dropdown. Click "Next".
​

20. Incoming claim type should be "UPN". Select "Name ID" as the outgoing claim type, and "Persistent Identifier" as the Outgoing name ID format. Click "Finish". Hive uses the Name ID value as the user's email address, so the value must match the email address in Hive.

If your AD FS uses a different internal email (UPN) domain than the email addresses used externally (for example, internally you use "eric@corp.example.com" but the public-facing email uses "eric@example.com"), then you will want to use the "Replace incoming e-mail suffix claims with a new e-mail suffix".

See the example below:

If you do not properly configure this, you may have a mismatch or duplicate users being created in Hive because the email address stored in Hive does not match the one passed by ADFS in the SAML flow.

21. Click "Apply" on the claims issuance window and close it out.

1. Log into your Hive workspace and open Workspace settings.

2. Under Advanced, select Security, then select Authentication. Note: Only System Admins can edit these fields. If your workspace has no System Admins, Admins can edit them.

3. For the "SAML SSO URL", enter your ADFS URL. This is usually something like "https://adfs.acmecorp.com/adfs/ls".

4. For the "Identifier format", you'll want to use the value "urn:oasis:names:tc:SAML:2.0:nameid-format:persistent" to ensure a persistent id is used.

5. Lastly, copy your ADFS service certificate from ADFS and paste it into the "Certificate" field. If you're not sure where to find this certificate, see the section below titled "Exporting your ADFS service certificate".

6. Hive saves each field when you click out of it. The top of the Authentication page looks like this:

7. At this point, your ADFS configuration is complete. To test it, open the ACS URL from the Authentication page in your browser. Hive sends you to ADFS to sign in. The first time a person with a Hive account signs in with SSO, Hive sends them an email to verify the link to ADFS. If a person does not have a Hive account yet, Hive creates the account, adds the person to your workspace, and sends them the same verification email.

To export the certificate: