SAML in HP Insights

Understanding SAML 2.0 authentication and how it works across HP Insights

Overview

SAML (Security Assertion Markup Language) 2.0 is an open standard for exchanging authentication data between two parties: an Identity Provider (IdP) that authenticates the user, and a Service Provider (SP) that grants access to a service.

HP Insights uses SAML in two distinct contexts:

  • Print user authentication — Users authenticate to submit and release print jobs via Secure Print and Secure Print Direct. Configured under Account Settings → Settings → User Authentication Providers.
  • System user login to the web console — System users (administrators and other staff with HP Insights accounts) authenticate to sign in to the HP Insights web console. Both SAML and OpenID Connect are supported for this use case. Configured under Account Settings → Settings → Admin SSO for organizations using the modern Admin SSO experience, or under Account Settings → Single Sign-On Configuration for organizations using Legacy SSO.

Note: These are two separate configurations. Setting up SAML for print job authentication does not configure system user login to the web console, and vice versa. Both can be active at the same time.

How SAML works in HP Insights

When a user authenticates using SAML, the following sequence occurs:

  1. The user initiates sign-in — either in the HP Secure Print desktop app (print job authentication) or at the HP Insights web console login page (system user login).
  2. HP Insights, acting as the Service Provider, sends a SAML authentication request to the configured Identity Provider.
  3. The Identity Provider displays its login page. The user enters their organisational credentials.
  4. On successful authentication, the Identity Provider returns a signed XML assertion to HP Insights via HTTP POST binding.
  5. HP Insights validates the assertion signature using the Identity Provider's signing certificate and reads the user's email address from the assertion.
  6. HP Insights uses the email address from the assertion to identify the user. Access is granted.

The user's credentials never pass through HP Insights — authentication is handled entirely by the Identity Provider.

SAML determines who the user is. It does not manage what the user can do — authorization decisions, print policies, quotas, and device access continue to be managed within HP Insights.

Depending on your tenant configuration, users may be created automatically on first sign-in, or may need to already exist in HP Insights before authentication succeeds.

Both SAML and OpenID Connect (OIDC) delegate authentication to an external identity provider and provide a similar single sign-on experience for users, though the exact journey can vary depending on the IdP and its configuration. The choice depends on your existing infrastructure:

  • If your identity provider supports both protocols, OIDC is generally simpler to configure and maintain — certificates don't need manual rotation and metadata updates automatically.
  • If your organisation has an existing SAML infrastructure or compliance requirements that mandate SAML, use SAML.
  • Microsoft Entra ID and Okta both support SAML and OIDC. If your identity provider supports both protocols, OIDC is typically the simpler option to deploy and maintain.

Key concepts

Term Description
Identity Provider (IdP) The system that authenticates the user and issues SAML assertions. Examples: Microsoft Entra ID, Okta, ADFS.
Service Provider (SP) The system that grants access based on the SAML assertion. Pharos Cloud is the Service Provider.
SAML assertion A signed XML document issued by the Identity Provider containing the user's identity information, including their email address.
Entity ID A unique URL that identifies the Identity Provider. Also called the Issuer.
ACS URL Assertion Consumer Service URL. The HP Insights endpoint where the Identity Provider sends the SAML assertion after authentication.
Metadata An XML file or URL containing configuration details for a SAML participant — Entity ID, ACS URL, signing certificate, and endpoints. Both HP Insights and your Identity Provider publish metadata.
Signing certificate The X.509 certificate used to sign and validate SAML assertions. HP Insights uses the Identity Provider's certificate to validate incoming assertions. If the IdP rotates its certificate, Pharos Cloud must be updated.
SP-initiated SSO The flow where HP Insights initiates the authentication request. This is the only supported flow — IdP-initiated SSO is not supported.

Where to go next

Choose the configuration guide that matches your use case: