Skip to main content

SAML Single Sign-On

FlexIt supports SAML 2.0 single sign-on with one identity provider (IdP), such as Microsoft Entra ID, Okta, Shibboleth, OneLogin, or Duo. SAML is configured in FlexIt under Administration > Configuration > Authentication by selecting the SAML 2.0 type. Saving the configuration restarts the FlexIt server.

Two values identify FlexIt to your IdP. Decide on them before you start:

  • Entity ID - an identifier for the FlexIt application, typically https://yourdomain.com/data/flexit/sp, where yourdomain.com is your organization's domain. Enter the same value at your IdP and in FlexIt's Service Provider Issuer.
  • ACS (callback) URL - where your IdP sends users after they sign in: https://flexit_server_url/auth/callback, where flexit_server_url is the hostname of your FlexIt server.

SAML with metadata.xml​

If your IdP accepts service provider metadata, upload the XML below with the entityID and Location changed to your Entity ID and ACS URL:

<?xml version="1.0"?>
<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
                     xmlns:mdui="urn:oasis:names:tc:SAML:metadata:ui"
                     entityID="https://yourdomain.com/data/flexit/sp">
    <md:SPSSODescriptor AuthnRequestsSigned="false" WantAssertionsSigned="true" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
        <md:Extensions>
            <mdui:UIInfo>
                <mdui:DisplayName xml:lang="en">FlexIt Analytics</mdui:DisplayName>
                <mdui:Logo height="100" width="100">https://cloud.flexitanalytics.com/img/flexicon.png</mdui:Logo>
            </mdui:UIInfo>
        </md:Extensions>
        <md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</md:NameIDFormat>
        <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
                                        Location="https://flexit_server_url/auth/callback"
                                        index="0" />
    </md:SPSSODescriptor>
</md:EntityDescriptor>

The NameID becomes the FlexIt username, so it must stay the same for a user across logins. Use an emailAddress or persistent NameID format, never transient.

FlexIt does not sign requests or support encrypted assertions, and does not publish its own metadata URL.

FlexIt Configuration​

FieldDescription
Entry Point URLYour IdP's single sign-on (login) URL
Service Provider IssuerYour Entity ID. Must match the Entity ID registered for FlexIt at your IdP.
Audience URIThe audience your IdP puts in the assertion, usually also your Entity ID. Recommended; if blank, the audience is not checked.
X.509 CertificateYour IdP's signing certificate (Base64)
FlexIt Callback PathDefaults to /auth/callback. Behind a proxy or load balancer, enter the full https:// ACS URL registered at your IdP.
Signature RequirementWhich part of the SAML response your IdP signs: the assertion (default), the response, or both
Validate InResponseToReplay protection. Leave at ifPresent if users launch FlexIt from an IdP dashboard tile; always rejects those logins.
Allow Passwordless Sign-InLet your IdP choose the sign-in method instead of requiring a password, so passkeys (FIDO2), Windows Hello, and certificate-based sign-in work. Your IdP's MFA and Conditional Access policies still apply. Required for Entra passkey sign-in.
Log User ProfileWrite the attributes returned by the IdP to the server log, for troubleshooting attribute mappings. Leave off in production.
User Email / First Name / Last Name / Display Name AttributeNames of the attributes your IdP sends
Groups AttributeName of the attribute that holds the user's groups. Defaults to Groups.
Sync Provider Groups?How IdP groups set FlexIt roles; see Groups and Roles
Default GroupRole for users who are in none of the mapped groups
Group MappingFor each FlexIt role, the IdP group name(s) that grant it, comma-separated

The authentication settings also include Allow Public Access? and the Inactivity Timeout.

Groups and Roles​

Sync Provider Groups? controls whether IdP groups assign FlexIt roles:

  • none - (default) do not use groups from the IdP. Assign roles in FlexIt.
  • seed - assign roles from IdP groups only on a user's first login. Later changes to IdP groups do not affect FlexIt.
  • sync - assign roles from IdP groups on every login. This replaces all of the user's roles, including any assigned by hand in FlexIt.

Roles come from the Group Mapping entries, which default to FlexIt Admin, FlexIt Author, FlexIt Consumer, and so on for each FlexIt role. Default Group only applies with seed or sync.

Signing In​

  • Users are sent to your IdP to sign in; there is no local login page while SAML is enabled. FlexIt's sign-in URL is /auth.
  • Users can also launch FlexIt from an IdP dashboard tile (with Validate InResponseTo set to ifPresent).
  • The first time someone signs in, FlexIt creates their user, or links to an existing FlexIt user with the same username or email.
  • Signing out of FlexIt does not sign the user out of the IdP, so they may be signed straight back in.
  • If sign-in fails, FlexIt shows a Single sign-on failed page and logs the reason on the server.

SAML in Okta​

Set up SAML single sign-on in Okta.

In SAML terminology, what you will be doing here is configuring Okta (your SAML Identity Provider or “SAML IdP”), with the details of your application (the new SAML Service Provider or “SAML SP”).

  1. Log in to your Okta organization as a user with administrative privileges. If you don’t have an Okta organization, you can create a free Okta Developer Edition organization.

  2. Click on the Applications link in the menu

  3. Click on the Create App Integration button

  4. In the dialog that opens, select the “SAML 2.0” option and then click Next

    SAML 2.0

  5. In Step 1 “General Settings”, enter “FlexIt Analytics” in the “App name” field

    General settings

  6. Upload the FlexIt app logo, then click the Next button.

    FlexIt logo

  7. In Step 2 “Configure SAML,” section A “SAML Settings”:

    • “Single sign on URL” - your ACS URL, e.g. https://flexit.yourdomain.com/auth/callback
    • “Audience URI (SP Entity ID)” - your Entity ID
    • “Name ID format” - EmailAddress, with “Application username” set to Email

    Configure SAML

  8. In the “Attribute Statements” section, add three attribute statements. In the “Group Attribute Statements”, add one statement:

    1. Attribute Statements
      • “User.FirstName” set to “user.firstName”
      • “User.LastName” set to “user.lastName”
      • “User.email” set to “user.email”
    2. Group Attribute Statements
      • “Groups” set to “Starts with” text of “FlexIt”
    3. Click Next to continue

    Attribute Statements

  9. In Step 3 “Feedback”, select “I’m an Okta customer adding an internal app”, and “This is an internal app that we have created,” then click Finish.

    Finish

  10. The “Sign On” section of your newly created “FlexIt Analytics” application appears. Click on “View Setup Instructions”

View Setup Instructions

  1. Keep this page open in a separate tab or browser window. You will copy settings from it into the FlexIt configuration.

FlexIt SAML Configuration

  1. Log in to FlexIt as an Administrator, click on “Configuration” under Administration, then click “Authentication”

Authentication

  1. Select the “SAML 2.0” type from the drop-down and fill in:
  • Entry Point URL - Okta's “Identity Provider Single Sign-On URL”
  • X.509 Certificate - Okta's “X.509 Certificate”
  • Service Provider Issuer and Audience URI - your Entity ID from step 7

Authentication mapping

  1. Make sure the attribute fields match the names from step 8 (the defaults do), and set Sync Provider Groups?, Default Group, and Group Mapping. The Okta group filter “Starts with FlexIt” from step 8 matches the default Group Mapping names, such as FlexIt Admin.

To search for and add Okta users from FlexIt's user administration, also fill in the Okta API URL Base, API Token, and Application Id.

  1. Click Save to finish the configuration in FlexIt. Okta SAML 2.0 authentication is now enabled.

SAML with Entra ID​

Set up SAML single sign-on in Microsoft Entra ID (formerly Azure Active Directory).

In SAML terminology, you will be configuring Entra ID (your SAML Identity Provider or “SAML IdP”) with the details of FlexIt (the new SAML Service Provider or “SAML SP”).

  1. Sign in to the Microsoft Entra admin center as at least a Cloud Application Administrator.

  2. Browse to Entra ID > Enterprise apps > All applications and click New application.

  3. Click Create your own application, enter “FlexIt Analytics” as the name, select “Integrate any other application you don't find in the gallery (Non-gallery)”, then click Create.

    Create your own application

  4. In the new application, open Properties, upload the FlexIt app logo, and click Save.

  5. Open Single sign-on and select SAML.

  6. In section 1, Basic SAML Configuration, click Edit and enter:

    • “Identifier (Entity ID)” - your Entity ID, e.g. https://yourdomain.com/data/flexit/sp
    • “Reply URL (Assertion Consumer Service URL)” - your ACS URL, e.g. https://flexit.yourdomain.com/auth/callback
    • “Sign on URL” - optional; your FlexIt URL, e.g. https://flexit.yourdomain.com

    Click Save. You can instead click Upload metadata file and upload the metadata.xml above.

    Basic SAML Configuration

  7. In section 2, Attributes & Claims, click Edit. Entra sends these claims by default:

    • Unique User Identifier (Name ID) - user.userprincipalname, format Email address. This becomes the FlexIt username. Keep it, or change the source to user.mail if your users sign in with their email address.
    • http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress - user.mail
    • http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname - user.givenname
    • http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname - user.surname
    • http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name - user.userprincipalname

    Leave these as they are; you will enter the claim names in FlexIt in step 14.

  8. If FlexIt roles will come from Entra groups, click Add a group claim and:

    • Select Groups assigned to the application. This keeps the claim to the FlexIt groups only; with Security groups or All groups, users in more than 150 groups get no groups at all, because Entra sends a link to Microsoft Graph instead.
    • Leave Source attribute at Group ID and check Emit group name for cloud-only groups to send group names. Leave it unchecked to send group object IDs.
    • Expand Advanced options, check Customize the name of the group claim, enter Groups as the Name, and leave Namespace blank.

    Click Save.

    The group claim must be named exactly Groups. FlexIt only reads multiple groups from an attribute named Groups, so with Entra's default name (http://schemas.microsoft.com/ws/2008/06/identity/claims/groups) users get only their first group.

    Group Claims

  9. In section 3, SAML Certificates, download Certificate (Base64). Leave the signing option at the default, Sign SAML assertion.

    SAML Certificates

  10. Keep section 4, Set up FlexIt Analytics, open in a separate tab or browser window. You will copy the Login URL from it into the FlexIt configuration.

    Set up FlexIt Analytics

  11. Open Users and groups and click Add user/group. Assign the users or groups that should have access to FlexIt. With Groups assigned to the application in step 8, assign the groups you will map to FlexIt roles, such as FlexIt Admin and FlexIt Author. Assigning groups requires Entra ID P1 or P2; on the free tier, assign users individually.

  12. Log in to FlexIt as an Administrator, click on “Configuration” under Administration, then click “Authentication”

    Authentication

  13. Select the “SAML 2.0” type from the drop-down and fill in:

    • Entry Point URL - Entra's Login URL from step 10
    • X.509 Certificate - the contents of the Certificate (Base64) file from step 9
    • Service Provider Issuer and Audience URI - your Entity ID from step 6
    • Signature Requirement - leave at assertion, to match Entra's Sign SAML assertion

  14. Set the attribute fields to the claim names from step 7:

    • User Email Attribute - http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress
    • First Name Attribute - http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname
    • Last Name Attribute - http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname
    • Display Name Attribute - leave blank to use the first and last name
    • Groups Attribute - Groups

  15. Set Sync Provider Groups?, Default Group, and Group Mapping. Enter the Entra group names in Group Mapping, or the group object IDs if you left Emit group name for cloud-only groups unchecked in step 8. The default mappings, such as FlexIt Admin, match Entra groups with those names.

  16. To let users sign in with passkeys (FIDO2), Windows Hello, or certificate-based authentication, check Allow Passwordless Sign-In.

  17. Click Save to finish the configuration in FlexIt. Entra ID SAML 2.0 authentication is now enabled. Users can sign in from the FlexIt URL or from the FlexIt tile in My Apps.

If sign-in fails or users get the wrong roles, turn on Log User Profile, sign in, and check the server log for the attribute names and groups Entra sent. Turn it off again afterward.