Articles in this section

Active Directory (ADFS) SSO

Follow

Objectives :

To help a customer configure ADFS to use for SSO Signin on Flow

Pre-requisites :

  • Customer must be on a Pro plan, which supports SSO
  • Customer must have access to their ADFS Server instance

Setup In ADFS :

Setup Relying Party Trust :

  • Log into your ADFS instance and launch ADFS Management (Start -> Administrative Tools -> ADFS Management)
  • Select Trust Relationships -> Relying Party Trusts
  • Click on Add Relying Party Trust from the actions sidebar and start the wizard

0.png

  • On the Select Datasource screen, click Enter data about relying party manually

1.png

  • Provide this information for each screen
    1. On Specify Display Name screen, enter a display name (Flow SSO), select ADFS Profile, and click Next
    2. Skip Configure Certificate screen and click Next
    3. On Configure URL screen, select the box labelled Enable Support for the SAML 2.0 WebSSO protocol
    4. https://api.getflow.com/auth/saml/callback?organization_id=<organization_id>
    5. On Configure Identifiers screen, enter Relying Party Trust Identifier
    6. https://api.getflow.com
    7. Note : Copy the URL EXACTLY as given, no trailing backslashes
  • Skip Configure Multi-factor Authentication (unless you want to configure this)
  • Skip Choose Issuance Authorization Rules
  • On Ready To Add Trust screen, review your settings and click Next
  • On the final screen, make sure Open the Edit Claim Rules dialog checkbox is selected and click Finish

2.png

 

Creating Claim Rules :

After you create the relying party trust, you can create the claim rules and make minor changes that are not set by the wizard

  • If the editor appears, Click Add Rule else, in Relying Party Trusts list, right-click the relying party object that you created, click Edit Claims Rules, and then click Add Rule

3.png

  • In the Claim rule template list, select the Send LDAP Attributes as Claims template, and click Next
  • Create the following rule
    1. LDAP Attribute -> E-Mail Addresses
    2. Outgoing Claim Type -> E-Mail Address
    3. Enter a descriptive rule name
    4. Attribute Store -> Active Directory
    5. Click Ok
  • Create another new rule by clicking Add Rule, this time select Transform An Incoming Claim as the template
    1. Enter a descriptive rule name
    2. Incoming Claim Type -> UPN
    3. Outgoing Claim Type -> Name ID
    4. Outgoing Name ID Format -> Email
    5. Pass through all claim values (leave as default)
    6. Click OK to create rule and then OK again to finish creating rules

Adjust Settings :

  • In Relying Party Trusts list, double-click the relying party object that you created (or select Actions -> Properties while you have the Relying Party Trust selected)
  • On the Endpoints tab, click on Add SAML
    1. Endpoint Type -> SAML Assertion Consumer
    2. Binding -> POST
    3. Trusted URL -> https://api.getflow.com/auth/saml/callback
    4. Click OK twice

 

Setup In Flow :

  • Log into your Flow account https://app.getflow.com
  • Click on Application Menu -> Administration -> Organization Settings

4.png

  • Click on SSO tab on top, and enter the following
    1. Authentication URL : your Saml 2.0 endpoint URL which you should have, but the default location is at https://<yourdomain>.com/adfs/ls/
    2. Certificate : paste the entire x.509 certificate located at ADFS → Service → Certificates → Token-Signing
    3. Click on Save Settings

5.png

Raise A Support Ticket :

  1. After you have completed the steps above, raise a support ticket and let us know that you would want to enable SSO on your account
  2. You can raise a support ticket by sending an email to help@getflow.com
  3. You can also raise a support ticket via Flow, by clicking on Application Menu -> Need Help? We’re here

6.png

Related articles