Skip to main content

Configure XFA as the Identity Provider for Proton Pass and Proton VPN Beta

Unlike the other identity-provider guides, XFA is the identity provider here: Proton hands sign-in to XFA, which signs users in with a passkey and checks their device.

Note: This guide assumes that you have an account set up with XFA for your organization, that you're an admin for that organization in XFA, and that you're an administrator of a Proton for Business organization on a plan with single sign-on (Proton Pass Professional, Proton VPN Professional or Enterprise, or VPN and Pass Professional). If you do not have an XFA account, you can create one at https://dashboard.xfa.tech/signup.

Proton as identity provider is in beta and stays off until XFA turns it on for your organization. If you don't see Connect Proton under Identity provider, or the Proton tile on the Enforcement page, your organization doesn't have it yet: contact support@xfa.tech and we'll switch it on for you.

How it works

When a user signs in to Proton Pass or Proton VPN with Sign in with SSO, Proton redirects them to XFA. XFA authenticates the user with a passkey on a device they've enrolled with XFA (Built-in passkey), checks the device's security posture, and returns a signed SAML assertion to Proton. Proton trusts that assertion and lets the user in.

Because XFA owns the sign-in, the user never types a Proton password. Their first device is bootstrapped through an admin-provisioned recovery step (below). Afterwards, sign-in is a single passkey tap on a trusted device.

Single sign-on in Proton applies per verified domain. Proton Pass and Proton VPN share the organization's single sign-on configuration, and this guide covers those two.

Create a Proton connection in XFA Dashboard

After logging in to the XFA Dashboard, open Identity provider in the sidebar and click Connect Proton. (You can also go to the Enforcement page, click New and pick the Proton tile.) XFA creates the connection and opens its guided setup, four steps you work through between XFA and your Proton admin panel, in any order.

Under Basics, set:

  • a name for the connection and the policy whose device checks apply during sign-in;
  • Allowed email domains: the domain(s) you will add to single sign-on in Proton (for example example.com). XFA only ever authenticates and asserts emails in these domains or in your organization's email domains; anything outside is rejected. With no domains here or in the organization's email domains, no one can sign in (fail-closed), so set this before going live.

Step 1, Add XFA as the identity provider in Proton, shows the values Proton needs to trust XFA:

  • Metadata URL: XFA's SAML metadata for this connection. Proton imports it in one go.
  • Entity ID (Proton also calls this the Issuer), Sign-in URL, and a certificate you can download, for when Proton asks for text fields instead.

Keep this tab open; you'll return to it once Proton shows its own values.

One identity provider connection per organization

XFA supports one identity provider connection per organization. If you already connected Google Workspace or a generic SAML identity provider, remove that connection first; the Proton tile is disabled until then.

Before you go on, click Save and continue later to save the connection. Onboarding links and sign-ins use the saved Allowed email domains and policy, not what is still unsaved on the page.

Provision users for their first device

Because XFA now owns sign-in, a brand-new device has no passkey yet, and once single sign-on is on for a domain its members can only reach Proton through XFA. So the first device is bootstrapped by an admin, before you turn single sign-on on in Proton.

On the People page (under Identity), provision each user who will sign in through XFA with a secondary email: a personal or alternate address they can reach. You can then send them an onboarding link at that address, which lets them register their passkey without ever typing a password. The link is single-use and valid for 7 days.

To add users, click New user. If you'd rather not email a link, you can instead generate a one-time onboarding password for a user and hand it to them over a channel of your choosing.

People who already use Proton Pass or Proton VPN keep their data. From the moment single sign-on is on for their domain, they sign in with Sign in with SSO.

To send links later, select the users on the People page and click Send onboarding link. XFA queues the emails and sends them over the next few minutes; the People page then shows Link sent with the date.

XFA skips, and tells you why:

  • users who already enrolled,
  • users without a secondary email,
  • users who got a link less than 7 days ago. Click Resend anyway to send a new one; it replaces the earlier link.

Each user's onboarding state shows on the People page: Provisioned, Link sent, Enrolled, or Enrollment unknown when XFA couldn't check.

Configure single sign-on in Proton

In your Proton admin panel (the Proton Pass admin panel, or account.protonvpn.com for Proton VPN for Business), go to Single sign-on > SAML authentication > Configure SAML:

  1. Enter your company domain and click Add domain.
  2. Add the DNS TXT record Proton shows at your domain provider, then click Continue. Proton verifies the domain before it accepts the identity provider; a new DNS record can take a while to spread.
  3. Import the identity provider metadata by URL, with the Metadata URL from XFA, and click Continue. If Proton asks for Text fields instead, enter XFA's Entity ID as the entity ID, the Sign-in URL as the single sign-on URL, and upload or paste the XFA certificate.
  4. Proton now shows its Assertion Consumer Service (ACS) URL and Issuer ID. Click Done, then See details to review the configuration.

Proton's values are the same for every organization:

  • Issuer ID: https://sso.proton.me/sp
  • Assertion Consumer Service (ACS) URL: https://sso.proton.me/auth/saml

XFA sends the person's email address as the NameID, in the emailAddress format Proton asks for. Proton matches it to the member with that address.

An organization can configure up to five domains. Each one is configured separately in Proton and must point at the same identity provider; add each of them to Allowed email domains in XFA as well.

Complete the integration in XFA Dashboard

Back in the XFA Dashboard:

  • Step 2, Confirm Proton's values: XFA already filled in Proton's Issuer ID and ACS URL, since they never change. Compare them with what Proton shows under See details and click Mark as done. If a value was ever edited and differs, Use Proton's values puts it back.
  • Step 3, Turn single sign-on on for your people: check that your domain shows as verified in Proton, that every domain is in Allowed email domains, and that each person has an XFA identity (see Provision users for their first device). Click Mark as done once that's done.
  • Step 4, Check and test: click Check my entries, then test a sign-in with a member of your domain and tick I tested it and it worked.

Click Finish setup to save the connection.

Signed requests

Proton signs the sign-in requests it sends to XFA. By default XFA accepts them without checking the signature. To have XFA verify them, open the connection, turn on Require signed requests and paste Proton's signing certificate into Service provider signing certificate. The certificate is in Proton's SAML metadata at https://sso.proton.me/saml/metadata; Proton can rotate it, and sign-in stops working until you paste the new one.

How users sign in

  • First device: the user opens the onboarding link from their secondary email (or enters the onboarding password you gave them) and registers a passkey on their device. XFA checks the device's security as part of it, and that passkey is their sign-in to Proton from then on.
  • Every device after: in a Proton Pass or Proton VPN app, or at account.proton.me, the user clicks Sign in with SSO and enters their email. They tap their passkey, with no password and nothing else to type, and XFA confirms the new device on a device they've already enrolled before signing them in.
What about a second factor?

XFA replaces Proton's password sign-in entirely, so there's no separate second factor to lose: the passkey on a device you've explicitly trusted with XFA is the strong factor. This is XFA's Built-in passkey. Read more in the Built-in passkey documentation.