Single sign-on with Azure Active DirectoryPublic preview

A domain is the portion of an email address after the @ symbol (such as kavholm.com). You must configure SSO for Stripe for each of your business’s email domains. To verify domain ownership:

1. Navigate to User authentication in the Stripe Dashboard, and click + New domain to view your account’s unique verification code.
       stripe-verification=4242424242424242424242
   

2. Add the verification code as a TXT record to your Domain Name System (DNS) provider.
3. Return to the Stripe Dashboard, and click Save and verify. Depending on your DNS provider, it can take 24 hours or more to verify your domain.
4. After successful verification, don’t delete the TXT record from your DNS provider. If you delete it, you might lose access to the Dashboard because Stripe frequently checks the DNS records of your domain.

Create an application

• To configure Azure AD, create a new application to represent the relationship between Azure AD and the Stripe Dashboard. To do this, navigate to Azure Active Directory on the left panel, then select Enterprise Applications.

• Click New application. Choose Non-gallery application from the Add an application window. Enter a name, and press Add.

• When the app has been created, click on Single sign-on under the Manage section of the menu. Select SAML.

• On this form, edit the Basic SAML Configuration.

• Enter the following values, then click Save.

  Setting	Value
  Identifier	https://dashboard.stripe.com/saml/metadata
  Reply URL	https://dashboard.stripe.com/login/saml/consume

• Make sure that the signing algorithm configuration is correct. Edit the SAML Signing Certificate section and verify the following settings:

  • Signing Option: Sign SAML assertion
  • Signing Algorithm: SHA-256

Assign roles to your team

To authenticate a team member to Stripe, configure your identity provider with the role they’ll have in the Stripe Dashboard. This is achieved by providing an Attribute Statement with each assertion that Azure AD sends to Stripe.

1. Edit the User Attributes & Claims section.
2. Change the Name identifier value field, so that its Source attribute is user.mail.
3. Click the Add new claim button. For this new claim:
   • Set the Name to Stripe-Role-. This identifies which Stripe account you authenticate your team member to (and is set to whichever Stripe account you’re signed in to while viewing this page, currently: )
   • Set the Source attribute to your team member’s Dashboard role.
   • To assign multiple roles to a user during login, you can add a semicolon after each role. For example, you can set the attribute as analyst; developer;. In this case, the user obtains the analyst and the developer role when they sign in.

Configure Dashboard roles in your settings.

Stripe supports the following roles. For more information, see User roles supported by Stripe.

Multiple Stripe accounts support

Add a Claim per Stripe account.

Navigate to the list of account tokens in the Accounts section of your Profile.

Navigate back to your application (on the Enterprise Applications page), and select the Users & Groups menu item. Here, you can assign team members to your application. For each team member you want to authenticate to the Stripe Dashboard, you’ll need to assign them to the application either directly, or using a group.

Configure your Stripe account to connect to your identity provider from the User authentication page.

To configure Stripe to connect to your identity provider, you need:

• Issuer ID: An identifier of your identity provider.
• Identity provider URL: The URL of your identity provider that your team members are redirected to, so they can authenticate.
• Identity provider certificate: The X.509 certificate that your identity provider uses to signs assertions.

Find these values in your identity provider

In Azure Active Directory, you can find these values by navigating back to the application you created and selecting the Single sign-on tab.

Test your configuration

Before saving your settings, a test runs to validate your SSO integration. After you click the Test button, a window opens in your browser that redirects to your identity provider to sign in. After you sign in, the window automatically closes and test results display on the original page.

If the test succeeds, you can save the settings, and select an enforcement mode. If the test fails, modify your configuration to address the issues reported and test the integration again.

Select an enforcement mode for SSO

When using SSO, there are three separate enforcement modes that you can choose from. These affect which methods of authentication your team members can use.