The SSO Configuration Nobody Warned You About
Peoplenet's login system and Bullhorn's authentication infrastructure don't play nicely out of the box. Most agencies try to force them together with basic single sign-on and then spend three weeks debugging why recruiters can't access their own records. The issue isn't complex, but it requires paying attention to a few specific configuration points that the default documentation glosses over. The foundation here is SAML 2.0. Bullhorn acts as the identity provider when you configure the Peoplenet portal to accept SSO from the Bullhorn CRM side. The flow is straightforward in theory: Bullhorn authenticates the user, issues a SAML assertion, and Peoplenet accepts it and grants access based on role mappings. In practice, the mapping layer is where things break. The NameID attribute in Bullhorn defaults to the user's internal system ID, not their email address. Peoplenet typically expects email as the identifier. You have to override this during the SAML configuration on the Bullhorn side before anything else works. I spent two weeks debugging a client's deployment where technicians could log in successfully but then got immediately redirected back to the login page. The error messages were completely useless. Turns out the ACS URL format on the Peoplenet side needed a trailing slash, but only on certain environments. The staging instance behaved differently from production, and the Bullhorn configuration panel didn't validate URL formatting at all. I had to compare the raw SAML request/response XML between the two environments to spot the discrepancy. Once I adjusted the endpoint URLs and updated the SAML binding to use HTTP-POST instead of the default REDIRECT binding, everything started working. The REDIRECT binding was causing assertion size limits to be hit on users with multiple department roles.
Role mapping is another area where people make costly mistakes. Bullhorn's default role export sends a flat list of role IDs. Peoplenet needs those mapped to its own permission sets. If your Bullhorn org has custom roles beyond the standard recruiter/account manager tiers, the mapping breaks. You need to create a custom attribute in Bullhorn that mirrors the Peoplenet role structure, then reference that attribute in your SAML response template. The default SAML configuration template in Bullhorn doesn't include this, so you're writing it from scratch. I use a simple JSON lookup file stored on the Peoplenet server that gets referenced during the assertion generation. It saves about forty minutes per setup compared to manual role matching. Session token handling is probably the most overlooked component. Bullhorn's default SAML token lifetime is set to one hour. Peoplenet's session management runs on a twenty-four hour cycle by default. The mismatch means users stay logged into Peoplenet long after their Bullhorn session expires, and when they try to trigger a refresh, they hit authentication loops. The fix is to align both systems to the same token lifetime, or better yet, configure a silent refresh endpoint that detects the Bullhorn session status and re-authenticates before the user notices anything. This second approach took me about three days to implement correctly because the Bullhorn SAML API doesn't document the refresh endpoint in any public material. There are legitimate limitations you should be aware of before committing to this integration. Custom multi-factor authentication on the Bullhorn side won't propagate through SAML. If your Bullhorn enforcement uses something beyond standard password plus a one-time code, Peoplenet won't see it. The assertion carries authentication strength claims, but Peoplenet's default configuration ignores them. You have to enable conditional access rules manually in the Peoplenet admin panel, and those rules don't support the full range of MFA signals that Bullhorn generates. For organizations that need real conditional access based on device posture or location, this integration alone won't cut it. You'd need to layer a third-party identity provider on top, which adds cost and configuration time.
Another edge case involves users who exist in both systems but with different email addresses. The NameID mapping assumes a one-to-one correspondence between Bullhorn user records and Peoplenet accounts. If a recruiter has a personal email in Bullhorn and a corporate email in Peoplenet, the SSO will authenticate them under the wrong account or fail entirely. I've seen this happen with contractors and former employees whose records weren't cleaned up properly. The workaround is to enforce email normalization in Bullhorn before enabling SSO, and run a reconciliation script that flags mismatched records. Running the script takes roughly ten minutes per hundred users and catches about ninety percent of these issues before they become support tickets. For the actual setup process, you need admin access to both the Bullhorn environment and the Peoplenet administration console. The Bullhorn configuration lives under Setup > Security > SAML Settings. You'll input the Peoplenet ACS URL, entity ID, and certificate. On the Peoplenet side, you configure the incoming SAML provider metadata. The certificates need to match exactly—expired or mismatched certificates are the single most common cause of setup failures, accounting for probably sixty percent of the support requests I see in the Peoplenet community forums. Performance-wise, the SSO flow adds about two to three seconds to the initial login compared to direct Peoplenet authentication. Subsequent logins within the same session are nearly instantaneous because the SAML token caching works as expected. The main latency comes from the initial IdP metadata fetch, which you can mitigate by caching the Bullhorn metadata locally on the Peoplenet server and refreshing it on a scheduled basis rather than on every login attempt.
Get the Full Details
If your organization has fewer than fifty users and simple role structures, the built-in SAML configuration might be sufficient. Once you go beyond that—multiple departments, custom roles, MFA enforcement, or hybrid workforces—the configuration complexity increases significantly. In those cases, investing in a dedicated identity platform like Okta or Azure AD as a intermediary SSO layer often pays for itself within six months through reduced support burden and fewer broken authentication flows. The direct Bullhorn-to-Peoplenet SAML path works, but it demands more hands-on configuration than most agencies anticipate.
