1"use strict";(globalThis.webpackChunkflexit_docs||=[]).push([[2396],{6975(e,t,n){n.r(t),n.d(t,{assets:()=>f,contentTitle:()=>A,default:()=>b,frontMatter:()=>g,metadata:()=>u,toc:()=>j});var i=n.cw(function(e,t){n.d(t,["A",0,"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAADoAAAA2CAMAAAChp3phAAAABGdBTUEAALGPC/xhBQAAAAFzUkdCAK7OHOkAAAAJcEhZcwAADsMAAA7DAcdvqGQAAACNUExURf///xCb2+/4/fj886/Wbsnjnr/k9QCU2ZTIPUCv46HPVZvLSajSYs/r+N3uwuv12hyevDCo4FC25bbZetDnqp/X8WC857zdhiCh3uTxzo/Q7q/d80GrlQmXz9/y+tfqtma4bvL454LCUYvFR3DD6n/J7Bme0l21eCWhsm+7ZHi+WoXJwTion06yrbfdsc3s3P8AAAFuSURBVEjH5ZXZdsIwDESz2yGBbGxhKVDovvz/5/WE0NixbMnmsZ3XcA/WSBp53j8TU+U/KL/IuawYQVk6JmNuj7KNTLbcBZWfHE6cUPnJDXdD2eL364G7on7QfzxlziirdX2xQ9lW0xdLtHtyy3E0varSPFntSx51OoB5TAGbKH3JTaMc+Cr6fB6Rk9C4Bgn421ImswJZoQ1gPyV0hq5fDdiXgZzjmxusAft2I1fU1k8Bun/HzRVaQKvOuLlCS8C+EuaKcuFU7QhzRblgMtiHbUDCctnUlv0C6DqwI1e8pNLVoDnnj3vAXizIWTcAR0NmoCr6FNvBzKCsGmIBllsRVg35pym3JswddCQOETRXCJbLEtxcoZK+u4q5g77hMFeEuTc1umFeKpAu4a/LXRvugihaixbaZLZB+/zb3oE2xrih0Cw0pyuBtsgxwVHpgHoXJzQata5yQLMTcRDMqBq6TwgajRTDg5Cqsg7XP6IfA8YzNuY3XccAAAAASUVORK5CYII="])}),s=n.cw(function(e,t){const i=n.p+"assets/images/flexit_config_auth-d29271b73a3834e7718add316eaf4658.png";n.d(t,["A",0,i])}),a=n.cw(function(e,t){const i=n.p+"assets/images/flexit_config_authmap-31998cdda7395a4c08ec57fb9dcb724a.png";n.d(t,["A",0,i])}),o=n.cw(function(e,t){const i=n.p+"assets/images/okta_flexit_finish-909a4989833bcb59957094a4d49839bb.png";n.d(t,["A",0,i])}),l=n.cw(function(e,t){const i=n.p+"assets/images/okta_flexit_generalattributes-779d62b4b705dcfd3189533440e27796.png";n.d(t,["A",0,i])}),r=n.cw(function(e,t){const i=n.p+"assets/images/okta_flexit_generalsettings-124f127bedd8d494775be4a2cc3c6438.png";n.d(t,["A",0,i])}),c=n.cw(function(e,t){const i=n.p+"assets/images/okta_flexit_ipmetadata-5dc416eb7f411359aacda5b6beb90961.png";n.d(t,["A",0,i])}),d=n.cw(function(e,t){const i=n.p+"assets/images/okta_flexit_new-a4c1947595e336f5eae616dba34d57c8.png";n.d(t,["A",0,i])}),h=n.cw(function(e,t){const i=n.p+"assets/images/okta_flexit_samlconfig-b106b3e6d31c788da872a8a9c0d593b8.png";n.d(t,["A",0,i])}),p=n.cw(function(e,t){const i=n.p+"assets/images/okta_flexit_samlsettingsgeneral-b6177c6091c36c2a540f808230ad1e8f.png";n.d(t,["A",0,i])});const u=JSON.parse('{"id":"saml","title":"Set up SAML single sign-on","description":"With your SAML provider (Microsoft Entra ID, Shibboleth, Okta, OneLogin, Duo), create an app for the FlexIt Analytics application. Then, upload the XML metadata (code shown below) with the following entries changed:","source":"@site/docs/saml.md","sourceDirName":".","slug":"/saml","permalink":"/docs/saml","draft":false,"unlisted":false,"editUrl":"https://github.com/flexanalytics/flexit-docs/edit/master/docs/saml.md","tags":[],"version":"current","frontMatter":{"id":"saml","title":"Set up SAML single sign-on","hide_title":true,"sidebar_label":"SAML Configuration"},"sidebar":"docs","previous":{"title":"Administration","permalink":"/docs/administration"},"next":{"title":"Visualization Guide","permalink":"/docs/viz/guide"}}');var x=n(4848),m=n(8453);const g={id:"saml",title:"Set up SAML single sign-on",hide_title:!0,sidebar_label:"SAML Configuration"},A="SAML with metadata.xml",f={},j=[];function S(e){const t={a:"a",blockquote:"blockquote",code:"code",em:"em",h1:"h1",header:"header",img:"img",li:"li",ol:"ol",p:"p",pre:"pre",strong:"strong",ul:"ul",...(0,m.R)(),...e.components};return(0,x.jsxs)(x.Fragment,{children:[(0,x.jsx)(t.header,{children:(0,x.jsx)(t.h1,{id:"saml-with-metadataxml",children:"SAML with metadata.xml"})}),"\n",(0,x.jsx)(t.p,{children:"With your SAML provider (Microsoft Entra ID, Shibboleth, Okta, OneLogin, Duo), create an app for the FlexIt Analytics application. Then, upload the XML metadata (code shown below) with the following entries changed:"}),"\n",(0,x.jsxs)(t.ul,{children:["\n",(0,x.jsxs)(t.li,{children:[(0,x.jsx)(t.strong,{children:"entityID"})," - you can use any identifier here, but it typically looks like ",(0,x.jsx)(t.code,{children:'entityID="https://yourdomain.com/data/flexit/sp"'}),", where ",(0,x.jsx)(t.em,{children:"yourdomain.com"})," is your organizations domain hostname."]}),"\n",(0,x.jsxs)(t.li,{children:[(0,x.jsx)(t.strong,{children:"Location"}),' - this setting is the FlexIt server installation "Callback URL". In the ',(0,x.jsx)(t.code,{children:'Location="https://flexit_server_url/auth/callback"'})," setting, replace ",(0,x.jsx)(t.em,{children:"flexit_server_url"})," with the hostname URI of the installed FlexIt Analytics server instance."]}),"\n"]}),"\n",(0,x.jsx)(t.pre,{children:(0,x.jsx)(t.code,{className:"language-xml",children:'<?xml version="1.0"?>\n<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"\n xmlns:mdui="urn:oasis:names:tc:SAML:metadata:ui"\n entityID="https://yourdomain.com/data/flexit/sp">\n <md:SPSSODescriptor AuthnRequestsSigned="false" WantAssertionsSigned="false" protocolSupp
1ortEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">\n <md:Extensions>\n <mdui:UIInfo>\n <mdui:DisplayName xml:lang="en">FlexIt Analytics</mdui:DisplayName>\n <mdui:Logo height="100" width="100">https://cloud.flexitanalytics.com/img/flexicon.png</mdui:Logo>\n </mdui:UIInfo>\n </md:Extensions>\n <md:NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</md:NameIDFormat>\n <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"\n Location="https://flexit_server_url/auth/callback"\n index="0" />\n </md:SPSSODescriptor>\n</md:EntityDescriptor>\n'})}),"\n",(0,x.jsx)(t.h1,{id:"saml-in-okta",children:"SAML in Okta"}),"\n",(0,x.jsx)(t.p,{children:"Set up SAML single sign-on in Okta."}),"\n",(0,x.jsx)(t.p,{children:"The first step in configuring an application to support SAML based Single Sign-On from Okta is to set up an application in Okta."}),"\n",(0,x.jsx)(t.p,{children:"In SAML terminology, what you will be doing here is configuring Okta (your SAML Identity Provider or \u201cSAML IdP\u201d), with the details of your application (the new SAML Service Provider or \u201cSAML SP\u201d)."}),"\n",(0,x.jsx)(t.p,{children:"Here is how to set up a SAML application in Okta:"}),"\n",(0,x.jsxs)(t.ol,{children:["\n",(0,x.jsxs)(t.li,{children:["\n",(0,x.jsxs)(t.p,{children:["Log in to your Okta organization as a user with administrative privileges. If you don\u2019t have an Okta organization, you can ",(0,x.jsx)(t.a,{href:"https://developer.okta.com/signup/",children:"create a free Okta Developer Edition organization"}),"."]}),"\n"]}),"\n",(0,x.jsxs)(t.li,{children:["\n",(0,x.jsx)(t.p,{children:"Click on the Applications link in the menu"}),"\n"]}),"\n",(0,x.jsxs)(t.li,{children:["\n",(0,x.jsx)(t.p,{children:"Click on the Create App Integration button"}),"\n"]}),"\n",(0,x.jsxs)(t.li,{children:["\n",(0,x.jsxs)(t.p,{children:["In the dialog that opens, select the \u201cSAML 2.0\u201d option and then click ",(0,x.jsx)(t.em,{children:"Next"})]}),"\n",(0,x.jsx)(t.p,{children:(0,x.jsx)(t.img,{alt:"SAML 2.0",src:d().A+"",width:"957",height:"561"})}),"\n"]}),"\n",(0,x.jsxs)(t.li,{children:["\n",(0,x.jsx)(t.p,{children:"In Step 1 \u201cGeneral Settings\u201d, enter \u201cFlexIt Analytics\u201d in the \u201cApp name\u201d field"}),"\n",(0,x.jsx)(t.p,{children:(0,x.jsx)(t.img,{alt:"General settings",src:r().A+"",width:"730",height:"558"})}),"\n"]}),"\n",(0,x.jsxs)(t.li,{children:["\n",(0,x.jsxs)(t.p,{children:["Upload the FlexIt app logo, then click the ",(0,x.jsx)(t.em,{children:"Next"})," button."]}),"\n",(0,x.jsx)(t.p,{children:(0,x.jsx)(t.img,{alt:"FlexIt logo",src:i().A+"",width:"58",height:"54"})}),"\n"]}),"\n",(0,x.jsxs)(t.li,{children:["\n",(0,x.jsxs)(t.p,{children:["In Step 2 \u201cConfigure SAML,\u201d section A \u201cSAML Settings\u201d, paste the URL below into the \u201cSingle sign on URL\u201d and \u201cAudience URI (SP Entity ID)\u201d fields. The FlexIt URL will be in the form of protocol://servername",":port","/auth/callback, for example: ",(0,x.jsx)(t.a,{href:"https://carbon1:3030/auth/callback",children:"https://carbon1:3030/auth/callback"})]}),"\n",(0,x.jsx)(t.p,{children:(0,x.jsx)(t.img,{alt:"Configure SAML",src:p().A+"",width:"725",height:"641"})}),"\n"]}),"\n",(0,x.jsxs)(t.li,{children:["\n",(0,x.jsx)(t.p,{children:"In the \u201cAttribute Statements\u201d section, add three attribute statements. In the \u201cGroup Attribute Statements\u201d, add one statement:"}),"\n",(0,x.jsxs)(t.ol,{children:["\n",(0,x.jsxs)(t.li,{children:["Attribute Statements","\n",(0,x.jsxs)(t.ul,{children:["\n",(0,x.jsx)(t.li,{children:"\u201cUser.FirstName\u201d set to \u201cuser.firstName\u201d"}),"\n",(0,x.jsx)(t.li,{children:"\u201cUser.LastName\u201d set to \u201cuser.lastName\u201d"}),"\n",(0,x.jsx)(t.li,{children:"\u201cUser.email\u201d set to \u201cuser.email\u201d"}),"\n"]}),"\n"]}),"\n",(0,x.jsxs)(t.li,{children:["Group Attribute Statements","\n",(0,x.jsxs)(t.ul,{children:["\n",(0,x.jsx)(t.li,{children:"\u201cGroups\u201d set to \u201cStarts with\u201d text of \u201cFlexIt\u201d"}),"\n"]}),"\n"]}),"\n",(0,x.jsx)(t.li,{children:"Click Next to continue"}),"\n"]}),"\n",(0,x.jsx)(t.p,{children:(0,x.jsx)(t.img,{alt:"Attribute Statements",src:l().A+"",width:"688",height:"621"})}),"\n"]}),"\n",(0,x.jsxs)(t.li,{children:["\n",(0,x.jsx)(t.p,{children:"In Step 3 \u201cFeedback\u201d, select \u201cI\u2019m an Okta customer adding an internal app\u201d, and \u201cThis is an internal app that we have created,\u201d then click Finish."}),"\n",(0,x.jsx)(t.p,{children:(0,x.jsx)(t.img,{alt:"Finish",src:o().A+"",width:"725",height:"378"})}),"\n"]}),"\n",(0,x.jsxs)(t.li,{children:["\n",(0,x.jsx)(t.p,{children:"The \u201cSign On\u201d section of your newly created \u201cFlexIt Analytics\u201d application appears. Click on \u201cView Setup Instru
1ctions\u201d"}),"\n"]}),"\n"]}),"\n",(0,x.jsx)(t.p,{children:(0,x.jsx)(t.img,{alt:"View Setup Instructions",src:c().A+"",width:"741",height:"737"})}),"\n",(0,x.jsxs)(t.ol,{start:"11",children:["\n",(0,x.jsx)(t.li,{children:"Keep this page open in a separate tab or browser window. You will return to this page later in this guide and copy the 3 settings into the FlexIt Configuration"}),"\n"]}),"\n",(0,x.jsx)(t.p,{children:(0,x.jsx)(t.img,{alt:"FlexIt SAML Configuration",src:h().A+"",width:"986",height:"853"})}),"\n",(0,x.jsxs)(t.ol,{start:"12",children:["\n",(0,x.jsx)(t.li,{children:"Log in to FlexIt as an Administrator, click on \u201cConfiguration\u201d under Administration, then click \u201cAuthentication\u201d"}),"\n"]}),"\n",(0,x.jsx)(t.p,{children:(0,x.jsx)(t.img,{alt:"Authentication",src:s().A+"",width:"1541",height:"849"})}),"\n",(0,x.jsxs)(t.ol,{start:"13",children:["\n",(0,x.jsx)(t.li,{children:"Select the \u201cSAML 2.0\u201d type from the drop-down and map the items from step 10 above into the FlexIt configuration"}),"\n"]}),"\n",(0,x.jsx)(t.p,{children:(0,x.jsx)(t.img,{alt:"Authentication mapping",src:a().A+"",width:"1862",height:"923"})}),"\n",(0,x.jsxs)(t.ol,{start:"14",children:["\n",(0,x.jsx)(t.li,{children:"In the FlexIt configuration, the \u201cUser Attribute Statements\u201d and \u201cGroup Attribute Statements\u201d should match the names used in step 7 above. Note the following options:"}),"\n"]}),"\n",(0,x.jsx)(t.p,{children:(0,x.jsx)(t.strong,{children:"Sync Provider Groups?"})}),"\n",(0,x.jsxs)(t.p,{children:[(0,x.jsx)(t.em,{children:"none"})," - (default) do not use groups from the SAML provider. Only use FlexIt groups."]}),"\n",(0,x.jsxs)(t.p,{children:[(0,x.jsx)(t.em,{children:"seed"})," - FlexIt will use the mapped user group from the SAML provider ",(0,x.jsx)(t.em,{children:"ONLY"})," on the first login. After the first time logging into FlexIt, any changes to the SAML provider groups will not persist to FlexIt."]}),"\n",(0,x.jsxs)(t.p,{children:[(0,x.jsx)(t.em,{children:"sync"})," - FlexIt will always use the Okta groups. If the groups change in the SAML provider, then the groups in FlexIt will also be updated with the new group mapping."]}),"\n",(0,x.jsxs)(t.blockquote,{children:["\n",(0,x.jsxs)(t.p,{children:[(0,x.jsx)(t.em,{children:"seed"})," and ",(0,x.jsx)(t.em,{children:"sync"})," rely on the ",(0,x.jsx)(t.strong,{children:"Group Mapping"})," entries that map a FlexIt group name to the SAML provider group name"]}),"\n"]}),"\n",(0,x.jsxs)(t.p,{children:[(0,x.jsx)(t.strong,{children:"Default Group"})," defaults to \u201cnone\u201d. If a user is assigned to the FlexIt Analytics application in Okta, but is not part of any Okta groups, you can automatically assign them to any group in FlexIt."]}),"\n",(0,x.jsxs)(t.ol,{start:"15",children:["\n",(0,x.jsxs)(t.li,{children:["Click ",(0,x.jsx)(t.strong,{children:"Save"})," to finish the configuration in FlexIt. Okta SAML 2.0 authentication is now enabled."]}),"\n"]})]})}function b(e={}){const{wrapper:t}={...(0,m.R)(),...e.components};return t?(0,x.jsx)(t,{...e,children:(0,x.jsx)(S,{...e})}):S(e)}}}]);
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.