# SSO with HelloID

## Introduction

Zivver supports Single Sign-On (SSO) via HelloID from Tools4Ever, allowing users to log in to Zivver with their workplace credentials. This manual describes how to set up SSO as a Zivver administrator.

SSO operates on the basis of Security Assertion Markup Language (SAML) v2.0. In this scenario, HelloID acts as the Identity Provider (IdP) and Zivver as the Service Provider (SP).

To configure HelloID as an IdP for Zivver, you need:

1. Zivver administrator rights.
2. Access to the HelloID admin portal.

## Configure SSO in HelloID

### Generate or import a certificate

A certificate is required for the SSO connection. If your organization does not yet have a certificate, follow these steps to import or generate one in HelloID. In this example, a self-signed certificate is generated:

1. Go to the HelloID Administrator Portal.
2. Select **Settings**.
3. Go to **Certificates**.
4. Import or generate a certificate in HelloID:
   - [Generate a new self-signed certificate](https://docs.helloid.com/en/portal-settings/certificates/generate-a-self-signed-certificate.html)
   - [Import an existing certificate](https://docs.helloid.com/en/portal-settings/certificates/import-a-certificate.html)

You now have a certificate. HelloID can securely communicate with Zivver.

### Install and configure the Zivver HelloID application

These steps describe how to add and configure the Zivver SSO application in HelloID.

01. Go to the HelloID Administrator Portal.
02. Navigate to **Applications**.
03. Click **Applications** again.
04. Open the **Application Catalog**.
05. Search for **Zivver**.

_Zivver should appear in the list of results. If it does not, contact Tools4Ever via their [support page](https://www.tools4ever.nl/support)._  
06. Select **Add** to add the Zivver app to the catalog.
07. Click **Next**.
08. In the **Single Sign-On** tab, change the **Issuer** to your organization’s portal name.
09. In the **X509 Certificate** dropdown menu, select the certificate you imported or generated earlier, or select an existing one.
10. Click **Next**.
11. In the **Self Service** tab, choose whether to automatically create a Self Service product.

_This makes the application available to users on request._  
12. Click **Next**.
13. In the **Finish** tab, click **Save** to add the application to HelloID.

_The application is now configured in HelloID._

### Application metadata

Metadata is required for the connection between HelloID and Zivver. Follow these steps to retrieve it.

1. Select the **Zivver** application in the HelloID catalog.
2. In the application overview, click **Edit** to view its properties.
3. In the top-right corner, right-click **Download metadata**.
4. Select the option to copy the URL.
5. Save this URL.

_You will need it later._

### Configure attribute mapping

1. Select the **Zivver** application in the HelloID catalog.
2. In the application overview, click **Edit** to view the properties.
3. In the **Configuration** tab, click **Configure Mapping Set**.
4. Click **Proceed**.
5. Next to **SAML User**, click **Change mappings**.
6. Choose one of the following options:
   - [Mapping with HelloID ZivverAccountKey](https://docs.zivver.com/en/admin/sso/helloid.html#mapping-attributes-with-helloid): for organizations that _do not_ use Microsoft Active Directory as the source for user data in HelloID.
   - [Mapping with Active Directory ZivverAccountKey](https://docs.zivver.com/en/admin/sso/helloid.html#mapping-attributes-with-active-directory): for organizations that use Microsoft Active Directory as the source for user data in HelloID.

#### Mapping attributes with HelloID

You do not need to modify the mapping. By default, the email address in HelloID is used, and the HelloID UserGUID serves as the ZivverAccountKey.

| User | HelloID Claim Set |
| --- | --- |
| _f(x)_ {{user.contactEmail}} | NameID |
| _f(x)_ {{user.userGUID}} | ZivverAccountKey |

#### Mapping attributes with Active Directory

If your Zivver accounts are created based on data from Microsoft Active Directory, HelloID must provide the same information (i.e., username and ZivverAccountKey) when creating and logging in to accounts. If this configuration is incorrect, HelloID cannot decrypt user mailboxes, and users will be prompted to enter a password.

1. Verify that an Active Directory configuration is set up for your HelloID organization.

_[Create or manage an Active Directory configuration](https://docs.helloid.com/hc/en-us/articles/360002826634-How-to-Create-and-Manage-Active-Directory-Configurations)_  
2. Ensure that the “objectGUID” attribute from Active Directory is mapped to a HelloID attribute.

_[Edit a mapping set](https://docs.helloid.com/hc/en-us/articles/360002737553)_  
3. Enter this information in the **Mapping for SAML User** panel ( [reference screenshots](https://docs.helloid.com/hc/en-us/articles/360010376039-Zivver-SAML-Single-Sign-on-Configuration#mapping-with-active-directory-zivveraccountkey)):

| User | HelloID Claim Set |
| --- | --- |
| _f(x)_ {{user.contactEmail}} | NameID |
| _f(x)_ {{user.attributes.ADObjectGUID}} | ZivverAccountKey |

4. Click the **f(x)** icon next to **{{user.attributes.ADObjectGUID}}**.
5. Select **Encode to Base64**.
6. Save the changes.
7. Close the configuration panel.

The email address sent from AD to HelloID is mapped by default to {{user.contactEmail}}. If this is different for your organization, replace {{user.contactEmail}} with the attribute containing the user’s email address from AD.

## Configure SSO in Zivver

This section describes how to import the HelloID metadata into Zivver. The metadata URL was retrieved in [Application metadata](https://docs.zivver.com/en/admin/sso/helloid.html#application-metadata).

1. Log in to the [Zivver WebApp](https://app.zivver.com/).
2. Click **Organization Settings**.
3. Expand **User administration**.
4. Click **Single Sign-on**.
5. Select **Automatically** recommended.
6. Paste the **URL** copied from the previous section.
7. Click Save.
8. Click Enable Single sign-on in the top-right corner.

_Zivver is now configured for Single Sign-On._

## Zivver 2FA exemption (optional)

By default, Zivver accounts are protected with two-factor authentication (2FA). 2FA is also required when logging in via SSO. However, you can disable 2FA in Zivver for users who log in via SSO through HelloID. You need to know which Authentication Method is passed from HelloID to Zivver to configure this exemption. In SAML, this is called the Authentication Context.

HelloID always returns the following Authentication Context in the SAML response:

- `urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport`

Exempting the above Authentication Method ensures that users are never prompted for 2FA when logging in to Zivver. This may pose a security risk because users can log in to Zivver without 2FA. Zivver strongly recommends enforcing 2FA within HelloID if you use this option. See [2FA Management](https://docs.helloid.com/hc/en-us/articles/360011148579-2FA-Management) in the HelloID documentation.

Follow these steps to configure the 2FA exemption for HelloID in Zivver:

1. Log in to the [Zivver WebApp](https://app.zivver.com/).
2. Click **Organization Settings**.
3. Expand **User administration**.
4. Click **Single Sign-on**.
5. Scroll down to the **Zivver 2FA exemptions** card.
6. In the **Authentication methods to be exempted** field, enter:
   - `urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport`
7. Click Save.

_You have now successfully set a 2FA exemption for HelloID. When users log in via SSO, Zivver will not request 2FA._

## Log in to the WebApp with SSO

1. Go to the [Zivver WebApp](https://app.zivver.com/).
2. Enter your email address.
3. Depending on your role in Zivver:
   - Users are redirected directly to the organization’s login screen.
   - Administrators can choose between logging in with their Zivver password or workplace credentials.
4. Log in with your organization’s credentials.

_Depending on whether a 2FA exemption applies, you may be prompted for an additional login method. If a 2FA exemption is in place, this step is skipped._  
5. Enter your additional login factor.

_You are now logged in to the Zivver WebApp._

## Log in to Outlook with SSO

In the Zivver Office Plugin for Outlook, you can log in via SSO using these steps:

1. Click the **Zivver** tab.
2. Click **Manage accounts**.
3. Click the link **Add an account**.
4. Enter the email address you want to use for login.
5. Click Next.

_You will be redirected to your organization’s login screen._  
6. Log in with your organization’s credentials.

_Depending on whether a 2FA exemption applies, you may be prompted for an additional login method. If a 2FA exemption is in place, this step is skipped._  
7. Enter your additional login factor.

_You are now logged in to Outlook._

Updated on 2026-06-15