FlexDeploy application can be integrated with Single Sign-On service using various options like OpenID Connect, SAML, OAuth etc. You can use external service like Okta, Microsoft Azure AD and many more or use existing corporate Single Sign-On solution. Note that FlexDeploy does not provide Single Sign-On and Multi Factor Authentication services.

Integration mechanisms supported are OpenID Connect, SAML, OAuth. We have verified this using Okta and Microsoft Azure AD using OpenID Connect. For other OpenID Connect providers and other types of integration, please reach out to us using support portal.

There are some limitations exist in current version of this integration, see below.

Group mapping (aka Claim in OpenID Connect) is not yet supported. You will need to configure authorization for user using FlexDeploy UI.
REST API still require login using local realm users with Basic Authentication.
Configuration is done using configuration files, there is no UI available at this time.
Once you enable Single Sign-On, you will not be able to configure or use other Realms for authentication and authorization.

You can further secure this by enabling Multi Factor Authentication, where user is granted access only after successfully presenting two or more pieces of evidence to an authentication mechanism. This will not be discussed here as it will be done on your Single Sign-On provider.

Even after enabling Single Sign-On, you will be able to login using local users if necessary. If you want to login with local users than use https://FLEXDEPLOYHOST:FLEXDEPLOYPORT/flexdeploy/faces/login.jsf in browser.

You can either enable SSO or MFA or both.

Enable Single Sign-On and/or Multi Factor Authentication

Single Sign-On integration will be done by adding configuration file on FlexDeploy application server host. You should keep this file readable only by FlexDeploy process user. There is no restriction on where this file should be kept but it would be good idea to keep it with FlexDeploy installation files. If you change values in this file, you will need to restart FlexDeploy server to pick up those changes.

File can be named as per your wish, but we will use fdsso.config name during this documentation. Configure location of file on server startup arguments. Here is syntax for startup argument.

-Dflexagon.fd.sso.config=FULLY_QUALIFIED_PATH_TO_SSO_CONFIG_FILE

See example below for Tomcat where file is located at /home/oracle/fdsso.config.

Here are some examples of fdsso.config file for various providers.

Okta

Replace upper case text with appropriate values. You will need to define application in Okta console and update values in config file as shown below.

OKTACLIENTID - get this value from Okta application configuration.
OKTACLIENTSECRET - get this value from Okta application configuration.
OKTADOMAIN - get this value form your Okta domain details.
FLEXDEPLOYHOST - FlexDeploy application host
FLEXDEPLOYPORT - FlexDeploy application port

Example fdsso.config file for Okta

oidcConfig = org.pac4j.oidc.config.OidcConfiguration
oidcConfig.clientId = OKTACLIENTID
oidcConfig.secret = OKTACLIENTSECRET
oidcConfig.discoveryURI = https://OKTADOMAIN.okta.com/.well-known/openid-configuration

oktaClient = org.pac4j.oidc.client.OidcClient
oktaClient.configuration = $oidcConfig

clients.callbackUrl = https://FLEXDEPLOYHOST:FLEXDEPLOYPORT/flexdeploy/callback
clients.clients = $oktaClient

isAuthenticatedAdmin = org.pac4j.core.authorization.authorizer.IsAuthenticatedAuthorizer
excludedPathMatcher = org.pac4j.core.matching.matcher.PathMatcher
excludedPathMatcher.excludedPath = /faces/login.jsf
config.authorizers = admin:$isAuthenticatedAdmin
config.matchers = excludedPath:$excludedPathMatcher
ssoFilter = flexagon.fd.ui.security.FlexPac4jFilter
ssoFilter.config = $config
ssoFilter.clients = OidcClient
ssoFilter.matchers = nocache
ssoFilter.authorizers = admin

logout = io.buji.pac4j.filter.LogoutFilter
logout.config = $config
logout.localLogout = true
logout.centralLogout = true
logout.defaultUrl = https://FLEXDEPLOYHOST:FLEXDEPLOYPORT/flexdeploy

Here is what configuration looks like on Okta.

Azure Active Directory

Replace upper case text with appropriate values.

APPLICATION(CLIENT)ID
CLIENTSECRET
DIRECTORY(TENANT)ID
FLEXDEPLOYHOST
FLEXDEPLOYPORT

Example fdsso.config file for Azure Active Directory

oidcConfig = org.pac4j.oidc.config.AzureAdOidcConfiguration
oidcConfig.clientId = APPLICATION(CLIENT)ID
oidcConfig.secret = CLIENTSECRET
oidcConfig.discoveryURI = https://login.microsoftonline.com/DIRECTORY(TENANT)ID/.well-known/openid-configuration
oidcConfig.useNonce = true
oidcConfig.tenant = DIRECTORY(TENANT)ID

azureAdClient = org.pac4j.oidc.client.AzureAdClient
azureAdClient.configuration = $oidcConfig

clients.callbackUrl = https://FLEXDEPLOYHOST:FLEXDEPLOYPORT/flexdeploy/callback
clients.clients = $azureAdClient

isAuthenticatedAdmin = org.pac4j.core.authorization.authorizer.IsAuthenticatedAuthorizer
excludedPathMatcher = org.pac4j.core.matching.matcher.PathMatcher
excludedPathMatcher.excludedPath = /faces/login.jsf
config.authorizers = admin:$isAuthenticatedAdmin
config.matchers = excludedPath:$excludedPathMatcher
ssoFilter = flexagon.fd.ui.security.FlexPac4jFilter
ssoFilter.config = $config
ssoFilter.clients = AzureAdClient
ssoFilter.matchers = nocache
ssoFilter.authorizers = admin

logout = io.buji.pac4j.filter.LogoutFilter
logout.config = $config
logout.localLogout = true
logout.centralLogout = true
logout.defaultUrl = https://FLEXDEPLOYHOST:FLEXDEPLOYPORT/flexdeploy

Register application in Azure Active Directory.

Capture Application (client) ID and Directory (tenant) ID from App Registration.

Create and capture client secret.

Here is how URL values are configured on Azure App Registration.

Browser not supported