Administration

Overview

Administration is done in the FlexIt web application as shown here:

User Management

Adding Users

New users can be added by clicking the New User button and entering their Email (or Username with LDAP authentication), Role, and Full Name. With FlexIt authentication, the user will be emailed a link to set their own password. If the user already exists, the role is added to them.

With FlexIt authentication, users can also request an account from the Login page by clicking Request Account. This sends an email to Admin users, who will also see a new user request message on the Users page. Click the ellipsis next to the user and select Approve or Reject. Once approved, the user is emailed a link to set their own password; use Resend Approval Email if they need it again.

Click the ellipsis next to a user and select View Groups & Roles to see their memberships.

Email Users

Send custom emails to all FlexIt users by clicking Send Email at the top of the Users page, or send to individual users from the ellipsis next to the user name.

Impersonate User

Administrators can impersonate individual users, which gives them the ability to see FlexIt exactly as that person sees it. This is helpful for ensuring everything works as expected when securing folders, reports, FlexIt features, and more. To start, click the ellipsis next to the user and select Impersonate <name>. When impersonating, the portal shows Impersonating <name> and you will not be able to edit or save any of that user's content. Click Stop Impersonating at the top-right to get back to your regular user profile.

Groups & Roles

Roles define what features of FlexIt users have access to. Groups define what data and content (folders, reports, dashboards, etc.) a set of users has access to. Both groups and roles can be used to secure content and data, but only roles can define application functionality (e.g. create new dashboard).

FlexIt has default groups and roles that cannot be modified or removed. By default, Shared Content gives the Authenticated group read access and the Author role write access.

• Admin - Full control over entire application
• Author - Ability to create, browse, and run reports
• Consumer - Ability to browse and run reports
• Authenticated - All authenticated users. Anyone that can log into FlexIt is in this group. Users cannot be individually assigned to this group.
• Public - Everyone, no authentication required. See note below.

What each role can do:

Feature	Admin	Author	Consumer
Browse and run content, favorites, save, export to Excel/CSV	✓	✓	✓
Create reports, dashboards, and data portals	✓	✓
Design dashboards; configure reports, fields, and filters; upload data; external data; natural language query	✓	✓
View SQL, New SQL Analysis, Direct SQL	✓
Administration	✓

Public Group - to use the Public group, you must enable the Allow Public Access? setting under Administration > Configuration > Authentication

Adding Groups

New groups can be added by clicking the New Group button at the top of the Groups & Roles page. Once the group is added, open it and click Add Users & Groups to add users and/or groups to it, or Remove from group to take them out. Custom groups can be renamed or deleted from the ellipsis menu. When you add groups to groups, you are nesting them, which gives child groups access to everything the parent group has access to.

Email Groups

Send custom emails to users in a group by clicking the ellipsis next to the group name and selecting Send Message.

Impersonate Group/Role

Administrators can impersonate a group/role, which gives them the ability to see FlexIt exactly as a person in that group/role sees it. This is helpful for ensuring everything works as expected when securing folders, reports, FlexIt features, and more. To impersonate a group, click on the ellipsis next to the group and select Impersonate <group name>.

Data Sources

Data sources are the connection details for the underlying databases and other sources used to pull data for reporting.

Click New Data Sources to add a connection, choose its type, and click Test before saving. Existing data sources can be cloned from the ellipsis menu. Supported types:

• Amazon Redshift
• DuckDB
• Google BigQuery
• MariaDB
• Microsoft SQL Server
• MySQL
• Oracle
• PostgreSQL
• Snowflake (basic or key pair authentication)
• API
• SSH/SFTP
• Oracle BI and PeopleSoft Query (licensed)

You can also click Upload Excel/CSV to create a data source from a spreadsheet.

Best practice: Encrypt sensitive information, such as passwords

Data Source Settings

Most types only need a host, port, database, and credentials. The types below have additional settings. Files referred to as being in the credentials folder go in [flexit_home]/config/credentials/ on the FlexIt server.

API

• Host - the API host name without the protocol, e.g. api.example.com. FlexIt always connects over https.
• API Key / API Secret Key - stored like passwords. Reference them in Additional Properties as {{api_key}} and {{api_secret_key}} (no spaces inside the braces).
• Additional Properties - JSON with optional headers to send with each request and a responseDataPath that points to the rows in the response. responseDataPath starts from the HTTP response, so the body is under data.

{
  "headers": {
    "Authorization": "Bearer {{api_key}}",
    "Accept": "application/json"
  },
  "responseDataPath": "data.results"
}

Without headers, FlexIt signs each request with the API key and secret using HMAC-SHA1 basic authentication. Without responseDataPath, rows are read from response in the response body. If the rows are arrays rather than objects, the first row is used as the column names.

SSH/SFTP

• Remote Path - the folder on the SFTP server, e.g. /uploads
• Private Key Filename - the name of a private key file in the credentials folder, used instead of a password
• Key Passphrase - the passphrase for an encrypted private key

Private key authentication applies to FlexFlow data movement jobs. Other connections, including Test, use the Password.

Snowflake

• Authentication Method
  • Basic - username and Password
  • Key Pair String - paste the key into Private Key
  • Key Pair File - enter the Private Key File name of a .pem or .p8 file in the credentials folder
• Key Pair Passphrase - for an encrypted .p8 key
• Warehouse and Role - optional; also passed to dbt jobs that use this data source
• Query Tag - optional; sets the Snowflake QUERY_TAG on queries FlexIt runs, so you can find them in query history
• Access Url - optional; a custom URL for connecting to Snowflake, e.g. a private link URL

Oracle

• Database - the service name. FlexIt connects to //host:port/database.
• Current Schema - optional; the schema dbt jobs use for this data source
• Service - optional; the service name used when exporting the data model to another BI tool from Semantic Layer
• Quoted Identifier - wraps table and column names in double quotes. Enable it if your names are lowercase or mixed case.
• Oracle Client Path - optional; the folder containing Oracle Instant Client. When set, FlexIt connects in thick mode using that client.

Microsoft SQL Server

• Domain - for Windows Authentication. Enter the domain along with a Windows Username and Password.
• Encrypt - check for Azure SQL connections

Google BigQuery

Credentials Location controls where the service account key comes from:

• Copy & Paste Credentials .JSON file - paste the contents of the service account .json file into Credentials JSON
• File on Server - enter the Credentials File Name of the .json file in the credentials folder. If it's blank, FlexIt uses the GOOGLE_APPLICATION_CREDENTIALS environment variable, then bigquery-credentials.json in the credentials folder.

DuckDB

• Database Path - the path to the .duckdb file on the FlexIt server. FlexIt opens it read-only. dbt jobs that use this data source get their path and database from it automatically.

Data Models

Data models are the presentation layer (a.k.a business view, metadata layer) the report and dashboard authors see when they create new content. Data models connect to underlying data sources and define metadata such as relationships between entities, user-friendly names (e.g. First Name instead of F_NAME), calculations, formatting, drill paths, and more. Create a new data model, or create one from dbt with Create from dbt.

Read the full guide: Data Models (Business Views)

Securing Content

Data Models and content (folders, reports, dashboards) can be secured at the user or group/role levels. To apply security, locate the item, click the ellipsis to the right, and select Security.

There is no need to assign the Admin role to data models or other content since it has access to everything.

Data Model Security

When a data model is first created, only the Admin role has permissions. Add users, groups and roles to the desired data model. Data model security overrides Content Security. For example, if you give permission for a group to access a specific report, that group must also have access to the data model otherwise they will be denied access.

Content Security

Add users, groups and roles to the desired folders, reports and dashboards. You can assign security at the Shared Content level (highest) down to individual content items (lowest).

If no security is applied to lower-level items, then security is inherited from higher-level items. In the example below, security for the Samples (Olympic Data) folder is inherited from Shared Content.

To apply security on the Samples (Olympic Data) folder, click the red Override button at the top-right and add desired users, groups and roles. Once added, click the Read-only checkbox if you want them to have read-only access. Read-only access prevents from creating, editing, or removing any content.

Configuration

The FlexIt configuration settings can be managed under the “Administration > Configuration” menu, as shown here:

Details for each of the configuration settings can be found below.

Content Database

The content database is where everything (reports, dashboards, users, groups, folders, etc.) is stored. By default, FlexIt comes with an enterprise-grade PostgreSQL deployment that is production-ready. If you do not use the default database, or would like to change to another database (SQL Server, MySQL, MariaDB, Oracle, or PostgreSQL), you can change the settings under “Configuration > Content Database,” as shown below. You must Test the connection before saving. When you point FlexIt to a different database, it automatically takes a full backup first and then restarts.

Authentication

By default, authentication is handled by storing secured credentials in the FlexIt Content Store database (FlexIt Analytics). You may also use LDAP (Lightweight Directory Access Protocol, including Active Directory), or SAML 2.0 single sign-on from providers like Okta, Entra ID, OneLogin, etc. Every type has Allow Public Access? and an inactivity timeout. Saving authentication changes restarts the server. Each method is shown below:

FlexIt Authentication

LDAP/Active Directory

SAML Single Sign On Provider

See also:

• Set up SAML based Single Sign-On

The SAML settings, group mapping, and setup steps for Okta are described in the SAML guide.

SMTP Email

Warning: To properly secure your email transmissions, configure your own SMTP server!

By default, FlexIt comes with a development SMTP server configuration so that you don’t have to configure anything to test FlexIt. For production purposes and to properly secure your email transmissions, you may want to use your own SMTP server. Configuration details are shown below:

Server Settings

Set the host name, app server port, web server port (only if using a separate web server), number of processor instances for load balancing, logging level, run artifact directory, or enable/disable HTTPS/SSL and the REST API.

Click View Servers at the top to manage the individual server processes, or Tail Logs to watch the server log. Changes to the host, web server port, or artifact directory take effect after a restart.

Run Artifact Directory is where files produced by pipeline and job runs are stored for download, in a subfolder per run. If it's blank, FlexIt uses [flexit_home]/webcontent/artifacts.

Server Deploys

On Docker installs, click Deploys at the top of Server Settings to redeploy the FlexIt container from the browser. The panel shows the current deploy status, Scheduled deploys, and Recent deploys with who requested each one, how long the drain took, and the outcome.

Click Deploy now to start a deploy. FlexIt then:

1. Pauses new scheduled runs.
2. Drains: waits for running Data Transforms and pipelines to finish, showing how many are still running.
3. Writes a .deploy_request marker file to the webcontent folder and shows Ready — waiting for host.

The marker file is the request to the host. scripts/auto_deploy_server.sh from the Docker repository, run by cron, finds the ready marker on its next tick and runs the deploy. When FlexIt restarts, it removes the marker, resumes schedules, and adds the deploy to Recent deploys. Without that cron job, nothing deploys and the request sits at Ready.

If jobs are still running after 30 minutes, the status changes to Drain timed out and no marker is written. Schedules stay paused until you click Cancel deploy. Cancelling at any point resumes schedules and removes the marker if it was written.

Click Schedule a deploy to deploy on a regular schedule, e.g. daily at 5 AM. By default, a scheduled deploy waits for any running job to finish before it starts. Scheduled deploys also appear in Orchestration as read-only; edit them here.

Backup and Restore

Back up the entire content database, or individual reports, folders, dashboards, models, etc. Backups are stored in physical .zip files on your server under the "[flexit_home]/deployments” directory.

Click New Backup, choose a Full or Select Content export, and whether to include data models, database connections, and data (up to 10,000 rows per table). To restore, click the ellipsis next to a backup and select Restore, then choose the content to restore, the folder to deploy it to, and whether to use existing data models and data sources.

Maps

Manage map styles or data points such as GeoJSON and latitude/longitude.

Styles

Map styles allow you to use map tiles from any server, such as Open Street Map, Carto, and Mapbox. Some services, such as Mapbox, will require an access_token in the tile server URL. By default, FlexIt comes with free Carto and Open Street Map styles.

Custom Maps

You can create any type of map that can be imagined using GeoJSON or Latitude/Longitude sources. FlexIt comes preloaded with country boundaries, country points (lat/lon), US state boundaries, and US zip code points (lat/lon). You can add your own maps from remote servers or add maps to the "[flexit_install]\webcontent\geo" directory. Configure maps as shown below.

Integrations

Enter details for integration with external third-party applications. Click Configure next to an integration to set it up.

dbt

Required to connect FlexIt to dbt Cloud. Not needed if you connect through a dbt Docs server or by uploading manifest.json — see Connecting to dbt.

• Service Token - a dbt Cloud service token. Requires Read-Only permissions; add Job Admin if you want to start dbt Cloud jobs from FlexIt.
• API URL - optional, defaults to https://cloud.getdbt.com/api/v2. Change this if your dbt Cloud account is hosted in a different region or on a single-tenant instance.

Git Repositories

Git repositories that the dbt Job step in Data Transformation can clone and run. Click Add to register a repository:

• Name - friendly name shown when selecting a repository
• Git URL - e.g., https://github.com/org/repo
• Default Branch - defaults to main
• Authentication
  • Deploy Key - an SSH key scoped to a single repository (recommended)
  • Personal Access Token - enter the PAT Username and PAT Token
  • Public (no auth) - for public repositories

When using a deploy key:

1. Choose Key Storage: Database (encrypted) stores the private key in the FlexIt content database; File System saves it to config/credentials/ under the Private Key Filename you enter.
2. Click Generate Key to create an Ed25519 key pair, or paste an existing private key.
3. Copy the Public Key and add it to the repository's deploy keys. For GitHub, Bitbucket, and GitLab URLs, FlexIt shows a direct link to the repository's deploy key settings.
4. Click Save. FlexIt tests the connection before saving; if the test fails you can still Save Anyway.

When using database storage, copy the private key before saving if you need it elsewhere. It is encrypted after saving and cannot be displayed again.

Repositories can also be added directly from the dbt Job step.

Artificial Intelligence

Enables AI features in FlexIt, such as text-to-SQL and AI Chat.

• API Key - your FlexIt AI service API key. Contact Flex Analytics to get a key.

Schedules

View all scheduled report deliveries and other scheduled tasks.

Samples

FlexIt comes packaged with three sample packages (Olympics, Project, and Sales) that come with reports & dashboards, a data model, and data. You can deploy the samples the same way you deploy a backup, using the Backup and Restore feature.

HTTPS

To enable https on the server, you must place both the Private Key and Certificate file on the server under the “[flexit_home]/config/certs” folder.

• Private Key: a PEM file with “key” in its name, e.g. “privatekey.pem”
• Certificate: a file with “cert” or “crt” in its name, e.g. “certificate.pem” or “certificate.crt”

A single PEM file containing both the key and certificate also works.

The private key and certificate must be in PEM format. If you have something like a p7b file, you can convert it to PEM using OpenSSL with the following command:

openssl pkcs7 -print_certs -in certificate.p7b -out certificate-combined.pem

To create the certificate, copy everything between the first instance of the below lines into a new file named “certificate.pem” or “certificate.cert”.

-----BEGIN CERTIFICATE-----
            ...
-----END CERTIFICATE-----

To create the private key, copy everything between the below lines into a new file named “privatekey.pem”.

-----BEGIN PRIVATE KEY-----
            ...
-----END PRIVATE KEY-----

Once the files are in place, you can enable https by going to the Server Settings page and checking “Enable HTTPS/SSL”. FlexIt won't save the setting if it can't find a certificate. To serve on the standard https port, also change the App Server Port (default 3030) to 443.

After saving, click Restart to restart the server, or restart it manually:

• On-Premise
• Docker (Linux)
• Docker (Windows)

PDF Download

To enable PDF download of reports, dashboards, and data portals, a chromium browser (e.g. Google Chrome) must be installed on the FlexIt server. FlexIt will look for the chromium binary executable in the following order:

1. Using the CHROMIUM_PATH environment variable
2. On Windows: C:\Program Files\Google\Chrome\Application\chrome.exe or C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
3. On Linux: /usr/bin/chromium-browser or /usr/bin/google-chrome

Encryption

To encrypt sensitive information, set the environment FLEXIT_ENCRYPTION_KEY variable on the FlexIt server to a string of exactly 32 characters. The server will not start if the key is a different length, and nothing is encrypted if it is not set. You can use a secure random key generator such as OpenSSL to generate the key.

For example, the following OpenSSL command will randomly generate a 32-character key:

openssl rand -hex 16

FlexIt encrypts data source passwords and keys, the content database password, the SMTP password, LDAP bind credentials, the dbt Cloud service token, and Git deploy keys and tokens.

Do not to lose this key because you cannot decrypt connection details without it. If you lose (or change) it, you will have to reset all of the connection details that have been encrypted.

REST API

Every component can be accessed via a fully documented REST API. To access the REST API from FlexIt, go to Server Settings, check "Enable REST API Explorer?", and then save. Then, you can click Try Now on the Server Settings page, or simply append /explorer to the FlexIt server hostname (e.g. http://flexitserver/explorer/).