Single sign-on with SAML Identity ProviderPublic preview

A domain is the portion of an email address after the @ symbol (such as kavholm.com). You must configure SSO for Stripe for each of your business’s email domains. To verify domain ownership:

1. Navigate to User authentication in the Stripe Dashboard, and click + New domain to view your account’s unique verification code.
       stripe-verification=4242424242424242424242
   

2. Add the verification code as a TXT record to your Domain Name System (DNS) provider.
3. Return to the Stripe Dashboard, and click Save and verify. Depending on your DNS provider, it can take 24 hours or more to verify your domain.
4. After successful verification, don’t delete the TXT record from your DNS provider. If you delete it, you might lose access to the Dashboard because Stripe frequently checks the DNS records of your domain.

To configure your identity provider, create an application (wording might vary by identity provider) to represent the relationship between your identity provider and Stripe.

Within this application, set the following values.

• Security settings: Configure your signature algorithm to RSA-SHA256, and your digest algorithm to SHA256. We enforce this for security reasons because SHA-256 is the industry-standard hashing algorithm.

• SSO URL: This value represents which URL your identity provider redirects your team back to after they authenticate. Set this to be https://dashboard.stripe.com/login/saml/consume.

• Audience URI or Entity ID: This value represents an ID for the Stripe Dashboard within your identity provider. Set this to be https://dashboard.stripe.com/saml/metadata.

• RelayState: This value represents where to redirect the team member after they successfully authenticate. The URL must be relative (for example, /payments) and only set in IdP-initiated login.

• Name ID: This value represents the team member that’s authenticating (that is, the subject of the SAML assertion), and it must be the team member’s email address.

<saml2:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress">{{ USER_EMAIL }}</saml2:NameID>

• Attribute statements for team roles: You can send multiple roles in the SAML assertion as either a semicolon-separated list in a single SAML attribute or as a multi-value SAML attribute.

<saml2:AttributeStatement>
  <saml2:Attribute Name="Stripe-Role-" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic">
    <saml2:AttributeValue>role_id_1; role_id_2</saml2:AttributeValue>
  </saml2:Attribute>
</saml2:AttributeStatement>

<saml2:AttributeStatement>
  <saml2:Attribute Name="Stripe-Role-" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic">
    <saml2:AttributeValue>role_id_1</saml2:AttributeValue>
    <saml2:AttributeValue>role_id_2</saml2:AttributeValue>
  </saml2:Attribute>
</saml2:AttributeStatement>

The Name attribute of the saml2:Attribute element identifies which Stripe account to authenticate your team member to.

The value of role_id represents the Dashboard role of the team member. The team member’s role per account must be included as an attribute statement in any assertion that you send to Stripe.

Include a saml2:Attribute element per Stripe account to authenticate a team member for multiple Stripe accounts.

Stripe supports the following roles. Some of these roles are only available if your account uses the applicable Stripe product. For more information, see User roles supported by Stripe.

To support multiple Stripe accounts, add a saml2:Attribute element per account.

<saml2:attributestatement>
  <saml2:attribute name="Stripe-role-account-token-1" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic">
    <saml2:attributevalue>view_only
    </saml2:attributevalue>
  </saml2:attribute>
  <saml2:attribute name="Stripe-role-account-token-2" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic">
    <saml2:attributevalue>view_only
    </saml2:attributevalue>
  </saml2:attribute>
</saml2:attributestatement>

The list of account tokens can be found in the Accounts section of your Profile.

Enter values from your identity provider

Next, you’ll need to configure your Stripe account to connect to your identity provider from the User authentication page.

To configure Stripe to connect to your identity provider you’ll need:

• Issuer ID: An identifier of your identity provider.
• Identity provider URL: The URL of your identity provider that your team members are redirected to, so they can authenticate.
• Identity provider certificate: The X.509 certificate that your identity provider uses to signs assertions.

Test your configuration

Before saving your settings, a test runs to validate your SSO integration. After you click the Test button, a window opens in your browser that redirects to your identity provider to sign in. After you sign in, the window automatically closes and test results display on the original page.

If the test succeeds, you can save the settings, and select an enforcement mode. If the test fails, modify your configuration to address the issues reported and test the integration again.

Select an enforcement mode for SSO

When using SSO, there are three separate enforcement modes that you can choose from. These affect which methods of authentication your team members can use.

After you finish configuring SSO, you can inform your users to sign in with any of these methods:

Stripe’s sign in page

Users can navigate to the Stripe sign in page, enter their email, then select Use single sign-on (SSO).

If a user has access to multiple accounts, Stripe authenticates them with the default account connected to the user. If a user only has access to SAML merchants, or doesn’t have access to any merchants, Stripe redirects them to the IdP, regardless of the contents in the password field.

IdP-initiated login

To use IdP-initiated login, your IdP needs to support Service Provider-initiated login. Verify if this is possible using your IdP’s documentation.

SSO URL

Use the following login URL with your domain to directly sign in to your account with SSO. This URL includes the domain and account you want to use for SSO authentication. If you change the account token at the end of the URL, it authenticates you against a different account.

https://dashboard.stripe.com/login/saml_direct/domain/{{YOUR_DOMAIN}}/merchant/{{STRIPE_ACCOUNT_ID}}