Setting up SAML SSO with Thales SafeNet Trusted Access

Payhawk supports SAML v2.0 single sign-on, so your team can log in with your existing Thales SafeNet Trusted Access (STA) credentials instead of a separate Payhawk password.

SAML does not support Identity Provider (IdP) initiated authentication. Your users must always start from the Payhawk login page. Two-factor authentication (2FA), where enabled, still applies, and SSO does not replace it.

Before you start

• You need Administrator access to the SafeNet Trusted Access console.

• You need Payhawk Administrator rights in Payhawk to coordinate the setup.

• Have your authentication domains ready (for example, yourcompany.com), the email domains your users sign in with.

• The email held in SafeNet Trusted Access for each user must exactly match that user's Payhawk account email. Mismatched emails cause failed logins or duplicate users.

Payhawk service provider (SP) settings

То configure the SAML application in SafeNet Trusted Access, use the following values. They are the same for every customer.

Creating and configuring the SAML application

1. Sign in to the SafeNet Trusted Access console as an Administrator.

2. Go to the Applications tab and select Add Application.

3. Search the application catalog for Payhawk. If it is not listed, select Add a custom application and choose the SAML (template or manual) option.

4. Name the application Payhawk. Optionally, add the Payhawk logo and a description so users recognize it on their My Applications portal.

5. In the application's SAML configuration, enter the Payhawk service provider values:

   • For SP Entity ID / Audience, enter: urn:amazon:cognito:sp:eu-central-1_mcW4Iwl7p

   • For Assertion Consumer Service (ACS) URL / Reply URL, enter: https://id.payhawk.com/saml2/idpresponse

   • Leave the Default Relay State blank.

   • For the NameID format, select email address (urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress) and set the value to the user's email.

6. Keep the flow as SP-initiated only. Do not enable IdP-initiated SSO, because Payhawk does not support it.

7. Sign the SAML assertion with the STA signing certificate. This is the default in SafeNet Trusted Access and needs to stay enabled.

Mapping the email attribute

Payhawk requires a single attribute named email.

1. In the application's Attributes section, add a mapping with the service provider attribute name email and the value set to the user's SafeNet Trusted Access email.

2. Make sure the attribute is included in the SAML assertion sent to Payhawk.

Assigning users

1. Assign the Payhawk application to the relevant users and groups in SafeNet Trusted Access.

2. Confirm each assigned user has a valid email that matches their Payhawk account.

Exporting the IdP metadata and sending it to Payhawk

1. Open the Payhawk application you created and locate the SAML metadata (IdP metadata) download.

2. Download the IdP metadata XML file. It contains the STA SSO endpoint, entity ID, and signing certificate that Payhawk needs.

3. Contact your Payhawk Implementation Manager and provide the IdP metadata XML file, your authentication domain(s), and confirmation of the email attribute mapping.

Payhawk completes the backend configuration and confirms when SSO is ready to test.

Testing the login

1. Go to the Payhawk login page.

2. Enter a corporate email address on an SSO-enabled domain.

3. Authenticate with SafeNet Trusted Access, and complete any STA push, OTP, or 2FA step.

4. On success, you return to Payhawk logged in.

Troubleshooting

• Redirected back to the login page or access denied - confirm the email attribute is sent and its value matches the Payhawk account email exactly.

• Application not assigned - the user is not assigned to the Payhawk app in SafeNet Trusted Access.

• IdP-initiated login fails - this is expected. Users must start from the Payhawk login page.