User Authentication Providers
User Authentication Providers define how HP Insights verifies the identity of print users. The configured provider determines how users sign in and how their identity is established across
Each organization configures a single User Authentication Provider under Account Settings > Settings > User Authentication Providers. This provider applies to all print users and supported workflows in the organization.
For an overview of how identities are authenticated and managed in HP Insights, see How Identity and Authentication Work in HP Insights.
Where the Authentication Provider Applies
The configured authentication provider is the organization's source of user identity and applies across supported HP Insights services. Although the sign-in experience may differ depending on the workflow or client, all supported services use the same configured authentication provider.
This applies across both supported print workflows:
-
- Secure Print Direct
And across every client where users establish their identity:
- Print Scout (workstation)
- User Portal (browser)
- HP Secure Print mobile app (mobile)
Relationship to Administrator Single Sign-On (SSO)
User Authentication Providers are used to authenticate print users. Administrator authentication is configured separately through Admin SSO under Account Settings > Settings > Admin SSO.
Organizations can configure administrators to sign in using the same identity provider that is used for print users, but Admin SSO is managed independently of User Authentication Providers.
For more information, see Configure SSO for System User Login.
Available Authentication Providers
HP Insights supports the following authentication providers for print users:
OpenID Connect
OpenID Connect (OIDC) allows users to authenticate with an external identity provider such as Microsoft Entra ID, Google, Okta, or PingFederate using Single Sign-On (SSO).
Users register through the
Users also receive a system-generated passcode that can be used for
OpenID Connect is well suited to organizations that use a modern cloud identity provider and want to provide a seamless SSO experience.
See OpenID Connect (OIDC) and Configure OpenID Connect Authentication for more information.
SAML 2.0
SAML 2.0 allows users to authenticate with their organization's identity provider, such as Microsoft Entra ID or Okta, instead of using credentials managed by HP Insights.
HP Insights acts as the Service Provider and uses the email address provided in the SAML assertion as the user's print identity.
Authentication policies remain enforced by your identity provider. Any MFA requirements, Conditional Access policies, or other sign-in restrictions configured in your identity provider continue to be enforced when users authenticate through SAML.
Users register through the
See SAML in HP Insights and Configure SAML Authentication for Print Users for more information.
Legacy Authentication Providers
Note: As of July 2026, Internal and Active Directory authentication providers are no longer available for new HP Insights deployments.
Organizations already configured to use Internal or Active Directory authentication can continue using their existing configuration without changes.
For more information, see Legacy Authentication.
Claim Mapping
Claim Mapping controls how claims provided by an identity provider are mapped to the user attributes required by HP Insights.
The default mappings work for most identity providers. Claim Mapping is typically required only when an identity provider uses non-standard claim names. For example, an identity provider might send the user's email address in a claim named mail instead of email, or use upn as the primary identifier.
Claim Mapping is available for both OpenID Connect and SAML through the Advanced option. This option becomes available after a valid authentication provider configuration has been saved.
See Claim Mapping for details and examples.