The Single Sign-On (SSO) feature allows your users to authenticate once and gain access to your feedback hub seamlessly. With SSO integration, you can enable your users to log in to Supahub using their existing credentials from your authentication system. This developer documentation will guide you through the steps to integrate SSO with Supahub.

​

Prerequisites

Before you begin, make sure you have:

1. Administrative access to your Supahub account.
2. Growth plan and above.
3. Access to your Private Key from SSO settings.

​

How it works

Here is a summary of the authentication flow:

1. The user wants to authenticate and clicks on the “Login with YourWorkspaceName” button on your public hub’s navbar.
2. They are redirected to your website’s custom login page, with the redirectTo parameter appended to the URL: https://yourdomain.com/sso/supahub?redirectTo=https://workspace-name.supahub.com/changelog
3. Once the user is authenticated, your authentication system generates a JWT token.
4. The user is then redirected back to Supahub along with the generated token and the original redirectTo parameter passed along: https://workspace-name.supahub.com/api/auth/sso?jwt=payload&redirectTo=https://workspace-name.supahub.com/changelog
5. Supahub receives the token and logs the user into the system using the validated token.
6. Finally, Supahub automatically redirects the user back to the page on your public hub where they initially clicked on the “Login with YourWorkspaceName” button.

​

Steps to Integrate SSO with Supahub

npm install --save jsonwebtoken

var jwt = require("jsonwebtoken");
const SSO_KEY = "YOUR_PRIVATE_SSO_KEY";

function generateJWTToken(user) {
    var userData = {
        email: user.email, // Required
        name: user.name, // Required
        id: user.id, // Required
    };

    // The userData object can include any additional details you wish to provide about a user to Supahub. Ensure to follow the same format shown in the Supahub.identify method, as outlined at https://docs.supahub.com/identify/user

    return jwt.sign(userData, SSO_KEY, {
        algorithm: "HS256",
    });
}

​

Add User & Company Data

You can also pass the user and company data inside JWT token generation.

var jwt = require("jsonwebtoken");
const SSO_KEY = "YOUR_PRIVATE_SSO_KEY";

function generateJWTToken(user) {
  var userData = {
    email: user.email, // Required
    name: user.name, // Required

    id: "786", // Required: Unique id that you are using to identify your user

    avatar: "https://example.com/images/user-profile.jpg", // Optional

    customFields: {
      title: "Product Manager",
      location: "Paris",
    }, // Optional: Add any type of field, in the format ({key1: "value1", key2: "value2"})

    // Company Data
    companies: [
      {
        id: "786", // Required
        name: "Acme Inc.", // Required
        logo: "https://example.com/images/company-logo.jpg", // Optional
        monthlySpend: 300, // Optional, but recommended
        createdAt: "2023-05-19T15:35:49.915Z", // Optional
      },
    ],
  };

  return jwt.sign(userData, SSO_KEY, {
    algorithm: "HS256",
  });
}

​

Restricting end-users’ access

By combining private workspace settings with Single Sign-On (SSO), you can create a secure environment for your users. Follow the below steps: