Single sign-on with Entra IDPublic preview

A domain is the portion of an email address after the @ symbol (such as kavholm.com). You must configure SSO for Stripe for each of your business’s email domains. To verify domain ownership:

1. Navigate to User authentication in the Stripe Dashboard, and click + New domain to view your account’s unique verification code.
       stripe-verification=4242424242424242424242
   

2. Add the verification code as a TXT record to your Domain Name System (DNS) provider.
3. Return to the Stripe Dashboard, and click Save and verify. Depending on your DNS provider, it can take 24 hours or more to verify your domain.
4. After successful verification, don’t delete the TXT record from your DNS provider. If you delete it, you might lose access to the Dashboard because Stripe frequently checks the DNS records of your domain.

Create groups for Stripe roles and assign your team members (users) to these groups. Users can belong to only one group per Stripe account. For example, if you want a user to have an admin role, assign them to the administrator group. However, if you want a user to have multiple roles, such as view only and analyst, create a separate group specifically for those combined roles.

Stripe supports the following roles. Some of these roles are only available if your account uses the applicable Stripe product. For more information, see User roles supported by Stripe.

1. Log in to the Entra ID Dashboard.
2. In the left navigation pane, click Groups.
3. Click Add new group:
   • For Group type, select Security.
   • For Group name, enter the name of the group (for example, View only users in Stripe).
4. Click No members added, and add users to the group.

To configure Entra ID, create a new application to represent the relationship between Entra ID and the Stripe Dashboard:

1. In the left navigation pane, click Applications > Enterprise applications.
2. Click Create your own application, enter the name your application, select Integrate any other application you don’t find in the gallery, and click Create.
3. Under Getting Started, click 1. Assign users and groups.
4. Click Add user/group, and select the groups you previously created.
5. In your app’s left navigation page, click Overview > 2. Set up single sign on.
6. Select SAML to open the SAML-based Sign on page.
7. Click Basic SAML Configuration, enter the following values, and click Save.
   • Identifier: https://dashboard.stripe.com/saml/metadata
   • Reply URL: https://dashboard.stripe.com/login/saml/consume

You must assign attributes and claims to the groups you created.

1. On the SAML-based Sign on page, click Attributes and claims.
2. Click Add new claim. You must create a new claim for each Stripe account you’re configuring SSO for.
3. Click Claim conditions to create the mapping between the group and the role you want to the group for this Stripe account.
   1. Set the Name to Stripe-Role-{{STRIPE_ACCOUNT_ID}}. This identifies which Stripe account you authenticate your team member to (and is set to whichever Stripe account you’re signed in to while viewing this page, currently: )
   2. For Source, select Attribute.
   3. For User type, select Members.
   4. For Group, select the group you want.
   5. For Source, select Attribute.
   6. For Value, enter the Dashboard role you want to assign (for example, developer), and click Enter. This means you’ve assigned this role to any members in this group.
4. Assign Stripe roles you want to the groups you created. If you want a user to have multiple roles (such as view only and analyst), you must create a separate group that exists specifically for those combined roles.
   
5. Click Save.

On the SAML-based Sign on page, click SAML certificates to verify if the signing algorithm configuration is correct. Ensure the following values match:

• Signing Option: Sign SAML assertion
• Signing Algorithm: SHA-256

To configure Stripe with SSO:

Retrieve values from Entra ID

Retrieve the values for Login URL, Microsoft Entra Identifier, and PEM SAML Certificate from your app in Entra ID.

1. Open the Entra ID Dashboard.
2. In your app’s left navigation pane, click Single sign-on.
3. On the SAML-based Sign on page, navigate to Set up Stripe, and retrieve the following values for:
   • Login URL
   • Microsoft Entra Identifier
4. On the SAML-based Sign on page, click SAML Certificates.
5. Next to your certificate, click the overflow button (), and click PEM certificate download
6. Open the .pem file in a basic text editor. This is your Identity provider certificate.

Configure your Stripe account to connect to Entra ID

Enter the values you retrieved from your app in Entra ID in Stripe:

1. In the Stripe Dashboard, navigate to Settings > Team and security > User authentication.
2. Next to the domain name, click the overflow button () > Manage SSO settings.
3. Click Test your configuration > Next.
4. Provide info for your identity provider:
   • For Issuer ID, enter the value for Microsoft Entra Identifier in Entra ID.
   • For Identity provider URL, enter the value for Login URL in Entra ID.
   • For Identity provider certificate, enter the certificate value from the .pem file you downloaded in Entra ID (include the begin certificate and end certificate text).
5. Click Continue.
6. If you set up an Account ID-based custom issuer earlier, select the By Account ID advanced settings option. Otherwise, continue with the default selected option.
7. Click Test configuration to open a new window to test your configuration. Exit this window, and return to the original window.
8. If you pass the test, click Done.

If the test fails, refer to Troubleshoot SSO, and address the reported issues in your Stripe app in Okta.

1. Select SSO enforcement. You can choose between Off, Optional, or Mandatory. You can change enforcement type in the future.
2. Click Save settings > Done.

After you finish configuring SSO, you can inform your users to sign in with any of these methods:

Stripe’s sign in page

Users can navigate to the Stripe sign in page, enter their email, then select Use single sign-on (SSO).

If a user has access to multiple accounts, Stripe authenticates them with the default account connected to the user. If a user only has access to SAML merchants, or doesn’t have access to any merchants, Stripe redirects them to the IdP, regardless of the contents in the password field.

IdP-initiated login

To use IdP-initiated login, your IdP needs to support Service Provider-initiated login. Verify if this is possible using your IdP’s documentation.

SSO URL

Use the following login URL with your domain to directly sign in to your account with SSO. This URL includes the domain and account you want to use for SSO authentication. If you change the account token at the end of the URL, it authenticates you against a different account.

https://dashboard.stripe.com/login/saml_direct/domain/{{YOUR_DOMAIN}}/merchant/{{STRIPE_ACCOUNT_ID}}