Skip to main content

Enterprise Auth and Sessions

Hunch includes enterprise identity controls for teams that need SSO (Single Sign-On), provisioning, and stricter login policy.

SSO Connection Types​

Hunch supports:

  • OIDC (OpenID Connect)
  • SAML (Security Assertion Markup Language)

For each connection, configure:

  • Display name
  • Slug
  • Allowed email domains
  • Default workspace role for auto-provisioned users
  • Whether password login remains allowed
  • Whether users are auto-provisioned

OIDC​

OIDC connections support the standard identity endpoints:

  • Issuer
  • Client ID
  • Client secret
  • Authorization endpoint
  • Token endpoint
  • Userinfo endpoint
  • JWKS URI
  • Scopes

SAML​

SAML connections support:

  • Service provider metadata
  • Identity provider entity ID
  • SSO URL
  • Optional SLO URL
  • IdP signing certificate

Discovery-Based Sign-In Routing​

The login flow discovers the correct enterprise connection based on the email address the user enters. It then routes the user into the matching OIDC or SAML flow.

Session Policy​

Workspace owners can define stricter session policy, including:

  • Require SSO
  • Allow or block password login
  • Enforce a single active session
  • Require MFA for admin users
  • Access-token TTL
  • Idle timeout
  • Refresh-token TTL
  • Allowed email domains
  • IP allowlist enforcement

Active Sessions​

The settings area exposes active login sessions so operators can:

  • Inspect recent sessions
  • Revoke a single session
  • Revoke all other sessions

SCIM Provisioning​

Hunch supports SCIM (System for Cross-domain Identity Management) token issuance and user provisioning endpoints. Identity providers can:

  • List users
  • Create users
  • Update users
  • Deactivate users

SCIM tokens are created and revoked from Settings. Token values are only shown when first created. Copy them immediately.

Base path:

https://api.hunchbank.com/auth/scim/v2

Recommendations​

  • Use domain-restricted discovery so the correct SSO path is selected automatically.
  • Keep password login disabled when your identity provider is the source of truth.
  • Pair SSO with SCIM for cleaner deprovisioning.
  • Review active sessions regularly for privileged operators.

See also: