Hideez Enterprise Server: Passwordless Authentication and SSO for the Enterprise

Hideez Enterprise Server

What is Hideez Enterprise Server?

Hideez Enterprise Server (HES) is the core of Hideez Workforce Identity (v.4). It provides passwordless authentication, two-factor authentication and single sign-on for web applications, manages user accounts and profiles, stores the list of approved Windows workstations and records login and logout events.

You manage HES yourself through a web console, whichever deployment option you choose. Any web application that supports SAML 2.0 or OpenID Connect can be made passwordless without changing the application.

Deployment options

  • Multitenant cloud (Hideez Identity Cloud). A cloud service for managed service providers, system integrators and organizations that prefer cloud products. One workspace holds several tenants, and you manage them all from there. You start by registering a tenant at cloud.hideez.com. Up to 5 users are free in the cloud, and a subscription covers more users.
  • Private cloud. A separate, isolated cloud for one customer.
  • On-premises, single-tenant. For organizations with their own infrastructure. HES v4.x runs on Ubuntu or Windows Server and stores its data in Microsoft SQL Server or MySQL.
  • On-premises, multi-tenant. For data centers that host HES for several customers. It runs on Ubuntu Server LTS 22.04 or 24.04 with MySQL 8.4 LTS or later, and every tenant has its own database.

For high availability, HES can run as two application servers in primary and standby mode, with a dedicated MySQL server and a separate reverse proxy.

How your users sign in

Each user activates the account from an email invitation and sets up at least one sign-in method. They can add more later in their profile. Every configured method works the same way for all integrated applications and for the HES console.

  • Passkey on a smartphone or tablet.
  • Hideez Authenticator app: scan a QR code and confirm in the app.
  • FIDO security key: any FIDO2 hardware key, or Hideez Key 5, with a PIN.
  • Windows Hello (platform authentication): fingerprint, face or PIN, on that one PC.
  • Password and one-time code: any TOTP authenticator app, or Hideez Authenticator.

Applications and single sign-on

  • Modern applications connect through SAML 2.0, OpenID Connect (OIDC) or WS-Federation. Microsoft Entra ID and AD FS are supported too. The Hideez team has tested SAML integrations with Atlassian, CyberArk, GitHub, Google Workspace, Salesforce, Slack, Zendesk, Zoom, Zabbix and Nextcloud.
  • Legacy web applications get passwordless sign-in through the Hideez Browser Plugin (Chrome and Edge) or Hideez AuthShield. Their usernames and passwords stay on the Hideez server only.
  • Legacy Windows applications work with Hideez Key, which stores and enters the credentials.
  • Access control. User groups act as an access list for integrated applications, and the length of the SSO session is configurable.

Directories and users

  • Active Directory. Users are replicated from AD. On-premises HES talks to AD directly over LDAPS. With the cloud, a small Hideez Directory Proxy runs inside your network and connects out over HTTPS, so no inbound ports are opened.
  • Microsoft Entra ID. Users are synchronized through Microsoft Graph. You can also use Hideez as an external authentication method for Entra ID through OIDC.
  • Other ways to add users. Create them manually or import a CSV file. Custom attributes cover applications that need extra data.
  • Password reset. For AD and Entra ID users, passwords can be reset on a schedule or manually.

Windows workstations

HES keeps the list of workstations approved to use Hideez Desktop Client. Workstation profiles control proximity lock and unlock. If a workstation is unapproved or deleted, users can no longer sign in to it with Hideez Key 5 or Hideez Authenticator. Hideez FIDO Logon and Hideez FIDO AD Logon let users sign in to Windows with a FIDO2 key over USB or NFC, without Entra ID. Device login is Windows-only.

Administration, audit and integration

  • Web console with several administrators, hardware key profiles (including PIN rules for Hideez Key 5) and workstation approval.
  • Login and logout audit log, plus Syslog output in CEF format for any SIEM that accepts Syslog.
  • REST Management API with read and write API keys.
  • Email invitations through SendGrid or any SMTP server.

FAQ

What is Hideez Enterprise Server?

Hideez Enterprise Server (HES) is the core component of Hideez Workforce Identity (v.4). It provides passwordless and two-factor authentication, single sign-on for SAML and OIDC applications, user and profile management, approved workstation storage and login and logout auditing.

Which deployment options are available?

Hideez Enterprise Server runs as a multitenant cloud (Hideez Identity Cloud), a private cloud, an on-premises single-tenant server or an on-premises multi-tenant server for data centers. Up to 5 users are free in the cloud.

How do users sign in with Hideez Enterprise Server?

With a passkey, the Hideez Authenticator app (QR code), a FIDO security key, Windows Hello, or a password with a one-time code. Users set up at least one method when they activate their account and can add others in their profile.

Which applications can use it for single sign-on?

Any application that supports SAML 2.0 or OpenID Connect, plus WS-Federation, Microsoft Entra ID and AD FS. Legacy web applications can use the Hideez Browser Plugin or Hideez AuthShield, and legacy Windows applications work with Hideez Key.

Does it work with Active Directory and Microsoft Entra ID?

Yes. It replicates users from both. On-premises HES reaches Active Directory over LDAPS, and for the cloud a Hideez Directory Proxy inside your network connects outward over HTTPS. It can also reset AD and Entra ID passwords on a schedule or on request.