Skip to main content

SAML Single Sign-On

FlexIt supports SAML 2.0 single sign-on with one identity provider (IdP), such as Microsoft Entra ID, Okta, Shibboleth, OneLogin, or Duo. SAML is configured in FlexIt under Administration > Configuration > Authentication by selecting the SAML 2.0 type. Saving the configuration restarts the FlexIt server.

Two values identify FlexIt to your IdP. Decide on them before you start:

  • Entity ID - an identifier for the FlexIt application, typically https://yourdomain.com/data/flexit/sp, where yourdomain.com is your organization's domain. Enter the same value at your IdP and in FlexIt's Service Provider Issuer.
  • ACS (callback) URL - where your IdP sends users after they sign in: https://flexit_server_url/auth/callback, where flexit_server_url is the hostname of your FlexIt server.

SAML with metadata.xml​

If your IdP accepts service provider metadata, upload the XML below with the entityID and Location changed to your Entity ID and ACS URL:

<?xml version="1.0"?>
<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
                     xmlns:mdui="urn:oasis:names:tc:SAML:metadata:ui"
                     entityID="https://yourdomain.com/data/flexit/sp">
    <md:SPSSODescriptor AuthnRequestsSigned="false" WantAssertionsSigned="true" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
        <md:Extensions>
            <mdui:UIInfo>
                <mdui:DisplayName xml:lang="en">FlexIt Analytics</mdui:DisplayName>
                <mdui:Logo height="100" width="100">https://cloud.flexitanalytics.com/img/flexicon.png</mdui:Logo>
            </mdui:UIInfo>
        </md:Extensions>
        <md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</md:NameIDFormat>
        <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
                                        Location="https://flexit_server_url/auth/callback"
                                        index="0" />
    </md:SPSSODescriptor>
</md:EntityDescriptor>

The NameID becomes the FlexIt username, so it must stay the same for a user across logins. Use an emailAddress or persistent NameID format, never transient.

FlexIt does not sign requests or support encrypted assertions, and does not publish its own metadata URL.

FlexIt Configuration​

FieldDescription
Entry Point URLYour IdP's single sign-on (login) URL
Service Provider IssuerYour Entity ID. Must match the Entity ID registered for FlexIt at your IdP.
Audience URIThe audience your IdP puts in the assertion, usually also your Entity ID. Recommended; if blank, the audience is not checked.
X.509 CertificateYour IdP's signing certificate (Base64)
FlexIt Callback PathDefaults to /auth/callback. Behind a proxy or load balancer, enter the full https:// ACS URL registered at your IdP.
Signature RequirementWhich part of the SAML response your IdP signs: the assertion (default), the response, or both
Validate InResponseToReplay protection. Leave at ifPresent if users launch FlexIt from an IdP dashboard tile; always rejects those logins.
Log User ProfileWrite the attributes returned by the IdP to the server log, for troubleshooting attribute mappings. Leave off in production.
User Email / First Name / Last Name / Display Name AttributeNames of the attributes your IdP sends
Groups AttributeName of the attribute that holds the user's groups. Defaults to Groups.
Sync Provider Groups?How IdP groups set FlexIt roles; see Groups and Roles
Default GroupRole for users who are in none of the mapped groups
Group MappingFor each FlexIt role, the IdP group name(s) that grant it, comma-separated

The authentication settings also include Allow Public Access? and the Inactivity Timeout.

Groups and Roles​

Sync Provider Groups? controls whether IdP groups assign FlexIt roles:

  • none - (default) do not use groups from the IdP. Assign roles in FlexIt.
  • seed - assign roles from IdP groups only on a user's first login. Later changes to IdP groups do not affect FlexIt.
  • sync - assign roles from IdP groups on every login. This replaces all of the user's roles, including any assigned by hand in FlexIt.

Roles come from the Group Mapping entries, which default to FlexIt Admin, FlexIt Author, FlexIt Consumer, and so on for each FlexIt role. Default Group only applies with seed or sync.

Signing In​

  • Users are sent to your IdP to sign in; there is no local login page while SAML is enabled. FlexIt's sign-in URL is /auth.
  • Users can also launch FlexIt from an IdP dashboard tile (with Validate InResponseTo set to ifPresent).
  • The first time someone signs in, FlexIt creates their user, or links to an existing FlexIt user with the same username or email.
  • Signing out of FlexIt does not sign the user out of the IdP, so they may be signed straight back in.
  • If sign-in fails, FlexIt shows a Single sign-on failed page and logs the reason on the server.

SAML in Okta​

Set up SAML single sign-on in Okta.

In SAML terminology, what you will be doing here is configuring Okta (your SAML Identity Provider or “SAML IdP”), with the details of your application (the new SAML Service Provider or “SAML SP”).

  1. Log in to your Okta organization as a user with administrative privileges. If you don’t have an Okta organization, you can create a free Okta Developer Edition organization.

  2. Click on the Applications link in the menu

  3. Click on the Create App Integration button

  4. In the dialog that opens, select the “SAML 2.0” option and then click Next

    SAML 2.0

  5. In Step 1 “General Settings”, enter “FlexIt Analytics” in the “App name” field

    General settings

  6. Upload the FlexIt app logo, then click the Next button.

    FlexIt logo

  7. In Step 2 “Configure SAML,” section A “SAML Settings”:

    • “Single sign on URL” - your ACS URL, e.g. https://flexit.yourdomain.com/auth/callback
    • “Audience URI (SP Entity ID)” - your Entity ID
    • “Name ID format” - EmailAddress, with “Application username” set to Email

    Configure SAML

  8. In the “Attribute Statements” section, add three attribute statements. In the “Group Attribute Statements”, add one statement:

    1. Attribute Statements
      • “User.FirstName” set to “user.firstName”
      • “User.LastName” set to “user.lastName”
      • “User.email” set to “user.email”
    2. Group Attribute Statements
      • “Groups” set to “Starts with” text of “FlexIt”
    3. Click Next to continue

    Attribute Statements

  9. In Step 3 “Feedback”, select “I’m an Okta customer adding an internal app”, and “This is an internal app that we have created,” then click Finish.

    Finish

  10. The “Sign On” section of your newly created “FlexIt Analytics” application appears. Click on “View Setup Instructions”

View Setup Instructions

  1. Keep this page open in a separate tab or browser window. You will copy settings from it into the FlexIt configuration.

FlexIt SAML Configuration

  1. Log in to FlexIt as an Administrator, click on “Configuration” under Administration, then click “Authentication”

Authentication

  1. Select the “SAML 2.0” type from the drop-down and fill in:
  • Entry Point URL - Okta's “Identity Provider Single Sign-On URL”
  • X.509 Certificate - Okta's “X.509 Certificate”
  • Service Provider Issuer and Audience URI - your Entity ID from step 7

Authentication mapping

  1. Make sure the attribute fields match the names from step 8 (the defaults do), and set Sync Provider Groups?, Default Group, and Group Mapping. The Okta group filter “Starts with FlexIt” from step 8 matches the default Group Mapping names, such as FlexIt Admin.

To search for and add Okta users from FlexIt's user administration, also fill in the Okta API URL Base, API Token, and Application Id.

  1. Click Save to finish the configuration in FlexIt. Okta SAML 2.0 authentication is now enabled.