FlexDeploy can be integrated with a single sign-on service using various options like OpenID Connect, SAML, OAuth etc. You can use an external service like Okta, Microsoft Azure AD, and many more, or use existing corporate single sign-on solution. Note that FlexDeploy does not provide single sign-on and multi-factor authentication services.
Integration mechanisms supported are OpenID Connect, SAML, OAuth. We have verified this using Okta and Microsoft Azure AD using OpenID Connect. For other OpenID Connect providers and other types of integrations, please reach out to us using the support portal.
A FlexDeploy user record will still be created when users from your single sign-on service login for the first time. See New User Process on the Realms page.
There are some limitations in the current version of this integration:
The REST API still requires logging in using local realm users, or API Tokens.
Once you enable single sign-on, you will not be able to configure or use LDAP Realms for authentication and authorization.
You can further secure this by enabling multi-factor authentication, where users are granted access only after successfully presenting two or more pieces of evidence to an authentication mechanism. This will not be discussed here as it will be done on your single sign-on provider.
Even after enabling single sign-on, you will be able to log in using local users if necessary. If you want to log in with local users, then navigate directly to https://FLEXDEPLOYHOST:FLEXDEPLOYPORT/flexdeploy/next/#/login.
You can enable SSO, MFA, or both as it depends on your Provider.
Enable Single Sign-On and/or Multi Factor Authentication
There is now a UI for configuring SSO realms. If you previously used an SSO Config file, it will be imported for you. See SSO Realm Group Mapping for more information.