Set up single sign-on and SCIM with Okta or Microsoft Entra ID

Before you start

1. An Enterprise plan for your Flowtlas organization.
2. The Flowtlas organization owner account. Only the owner can change single sign-on settings.
3. Administrator access to your Okta organization or Microsoft Entra tenant.
4. The email domains your colleagues sign in with, for example example.com.
5. The workspace and role that new colleagues should receive when they are provisioned.

Values Flowtlas gives your identity provider

In Flowtlas, open Settings, then Team, then Single sign-on. The first panel lists the values below for your organization. Copy them from there; each organization has its own URLs.

Okta: create the SAML app

1. In the Okta Admin Console, open Applications, choose Create App Integration and select SAML 2.0.
2. Name the app, for example Flowtlas, and continue to Configure SAML.
3. Enter the Flowtlas assertion consumer service URL as the Single sign-on URL and keep it as Recipient and Destination URL.
4. Enter the Flowtlas entity ID as Audience URI (SP Entity ID).
5. Set Name ID format to EmailAddress and Application username to Email.
6. Add attribute statements email (user.email), firstName (user.firstName) and lastName (user.lastName).
7. Finish the wizard, assign the people or groups who should use Flowtlas, and copy the identity provider metadata XML from the Sign On tab.

Okta: turn on SCIM provisioning

1. On the app’s General tab, edit App Settings and set Provisioning to SCIM.
2. In Flowtlas, choose Create token in the SCIM provisioning panel and copy the token. It is shown only once.
3. On the Provisioning tab, edit Integration: enter the Flowtlas SCIM base URL as SCIM connector base URL and userName as the unique identifier field.
4. Select Push New Users, Push Profile Updates and Push Groups, choose HTTP Header authentication and paste the token.
5. Test the connector configuration and save.
6. Under Provisioning, To App, enable Create Users, Update User Attributes and Deactivate Users. Use Push Groups for the groups Flowtlas should receive.

Microsoft Entra ID: create the enterprise application

1. In the Microsoft Entra admin center, open Enterprise applications, choose New application, then Create your own application, and select the option to integrate an application that is not in the gallery.
2. Open Single sign-on and choose SAML.
3. In Basic SAML Configuration, enter the Flowtlas entity ID as Identifier (Entity ID) and the assertion consumer service URL as Reply URL.
4. In Attributes & Claims, make sure the unique user identifier (Name ID) is the user’s email address, for example user.mail, with the email address format. Keep the email address, given name and surname claims.
5. In SAML Certificates, download the Federation Metadata XML.
6. Assign the users or groups who should use Flowtlas.
7. Optional: if you turn on token encryption, upload the Flowtlas encryption certificate from the single sign-on settings.

Microsoft Entra ID: turn on provisioning

1. In the same enterprise application, open Provisioning and set Provisioning Mode to Automatic.
2. Enter the Flowtlas SCIM base URL as Tenant URL and a new Flowtlas SCIM token as Secret Token, then test the connection and save.
3. In Mappings, check that userName is mapped to an attribute that holds the user’s email address, such as userPrincipalName or mail.
4. Set the scope to sync only assigned users and groups, turn provisioning status on and save.
5. Microsoft Entra ID provisions in cycles, so changes can take some time to reach Flowtlas.

Finish and test in Flowtlas

1. Paste the identity provider metadata XML into Flowtlas and choose Read metadata. Review the entity ID, sign-on URL and signing certificate that were filled in.
2. Add your email domains and choose the default workspace and role for provisioned colleagues.
3. Optional: turn on Create users on first sign-in if colleagues should get access without SCIM.
4. Turn on Enable single sign-on and save.
5. Sign out, enter a test colleague’s work email on the Flowtlas sign-in page and choose Sign in with SSO.
6. When sign-in works, consider Require single sign-on. Members then can no longer sign in with a password or Google, and members who are signed in are signed out. The owner keeps password sign-in as a fallback account.

Troubleshooting

Flowtlas shows the reason for a failed single sign-on attempt on its sign-in page. SCIM errors appear in your identity provider’s provisioning log. SCIM changes are also recorded in the Flowtlas audit log as SCIM provisioning.