Single sign-on with SAML Identity ProviderPublic preview

A domain is the portion of an email address after the @ symbol (such as kavholm.com). You must configure SSO for Stripe for each of your business’s email domains. To verify domain ownership:

1. Navigate to User authentication in the Stripe Dashboard, and click + New domain to view your account’s unique verification code.
       stripe-verification=4242424242424242424242
   

2. Add the verification code as a TXT record to your Domain Name System (DNS) provider.
3. Return to the Stripe Dashboard, and click Save and verify. Depending on your DNS provider, it can take 24 hours or more to verify your domain.
4. After successful verification, don’t delete the TXT record from your DNS provider. If you delete it, you might lose access to the Dashboard because Stripe frequently checks the DNS records of your domain.

To configure your identity provider, create an application (wording might vary by identity provider) to represent the relationship between your identity provider and Stripe.

Within this application, set the following values.

• Security settings: Configure your signature algorithm to RSA-SHA256, and your digest algorithm to SHA256. We enforce this for security reasons because SHA-256 is the industry-standard hashing algorithm.

• SSO URL: This value represents which URL your identity provider redirects your team back to after they authenticate. Set this to be https://dashboard.stripe.com/login/saml/consume.

• Audience URI or Entity ID: This value represents an ID for the Stripe Dashboard within your identity provider. Set this to be https://dashboard.stripe.com/saml/metadata.

• RelayState: This value represents where to redirect the team member after they successfully authenticate. The URL must be relative (for example, /payments) and only set in IdP-initiated login.

• Name ID: This value represents the team member that’s authenticating (that is, the subject of the SAML assertion), and it must be the team member’s email address.

<saml2:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress">{{ USER_EMAIL }}</saml2:NameID>

• Attribute statements for team roles: You can send multiple roles in the SAML assertion as either a semicolon-separated list in a single SAML attribute or as a multi-value SAML attribute.

<saml2:AttributeStatement>
  <saml2:Attribute Name="Stripe-Role-" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic">
    <saml2:AttributeValue>role_id_1; role_id_2</saml2:AttributeValue>
  </saml2:Attribute>
</saml2:AttributeStatement>

<saml2:AttributeStatement>
  <saml2:Attribute Name="Stripe-Role-" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic">
    <saml2:AttributeValue>role_id_1</saml2:AttributeValue>
    <saml2:AttributeValue>role_id_2</saml2:AttributeValue>
  </saml2:Attribute>
</saml2:AttributeStatement>

The Name attribute of the saml2:Attribute element identifies which Stripe account to authenticate your team member to.

The value of role_id represents the Dashboard role of the team member. The team member’s role per account must be included as an attribute statement in any assertion that you send to Stripe.

Include a saml2:Attribute element per Stripe account to authenticate a team member for multiple Stripe accounts.

Stripe supports the following roles. For more information, see User roles supported by Stripe.

To support multiple Stripe accounts, add a saml2:Attribute element per account.

<saml2:attributestatement>
  <saml2:attribute name="Stripe-role-account-token-1" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic">
    <saml2:attributevalue>view_only
    </saml2:attributevalue>
  </saml2:attribute>
  <saml2:attribute name="Stripe-role-account-token-2" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic">
    <saml2:attributevalue>view_only
    </saml2:attributevalue>
  </saml2:attribute>
</saml2:attributestatement>

The list of account tokens can be found in the Accounts section of your Profile.

Enter values from your identity provider

Next, you’ll need to configure your Stripe account to connect to your identity provider from the User authentication page.

To configure Stripe to connect to your identity provider you’ll need:

• Issuer ID: An identifier of your identity provider.
• Identity provider URL: The URL of your identity provider that your team members are redirected to, so they can authenticate.
• Identity provider certificate: The X.509 certificate that your identity provider uses to signs assertions.

Test your configuration

Before saving your settings, a test runs to validate your SSO integration. After you click the Test button, a window opens in your browser that redirects to your identity provider to sign in. After you sign in, the window automatically closes and test results display on the original page.

If the test succeeds, you can save the settings, and select an enforcement mode. If the test fails, modify your configuration to address the issues reported and test the integration again.

Select an enforcement mode for SSO

When using SSO, there are three separate enforcement modes that you can choose from. These affect which methods of authentication your team members can use.