Skip to main content

SSO Configuration Guide

Configure Single Sign-On (SSO) for Smartflow using your bank's identity provider. Smartflow supports both SAML 2.0 and OpenID Connect (OIDC) protocols.

Prerequisites​

  • Smartflow instance deployed and accessible.
  • Admin access to your Identity Provider (IdP) — e.g., Azure AD, Okta, Ping Identity.
  • Admin access to Smartflow's Settings → Authentication page.
  • Network connectivity between Smartflow and your IdP (verify firewall rules).

SAML 2.0 Configuration​

Smartflow Service Provider (SP) Details​

Provide these values to your IdP administrator:

  • Entity ID (SP): https://{your-instance}.smartflow.io/auth/saml/metadata
  • ACS URL: https://{your-instance}.smartflow.io/auth/saml/callback
  • SLO URL: https://{your-instance}.smartflow.io/auth/saml/logout
  • NameID format: urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress
  • Signature algorithm: RSA-SHA256

IdP Configuration Parameters​

Collect these values from your IdP and enter in Smartflow:

  • IdP Entity ID - Your IdP's entity identifier.
  • SSO URL - IdP's Single Sign-On endpoint.
  • SLO URL - IdP's Single Logout endpoint, if used.
  • x509 certificate - IdP signing certificate in PEM format.

Attribute Mapping​

  • email maps to user email and is required.
  • given_name maps to first name and is required.
  • family_name maps to last name and is required.
  • groups maps to role assignment and is recommended.

OpenID Connect (OIDC) Configuration​

Smartflow OIDC Parameters​

  • Redirect URI: https://{your-instance}.smartflow.io/auth/oidc/callback
  • Post-logout redirect: https://{your-instance}.smartflow.io
  • Scopes: openid profile email

IdP Configuration Parameters​

  • Client ID - Application/client ID from your IdP.
  • Client secret - Application secret, stored encrypted.
  • Issuer URL - https://{your-idp}/.well-known/openid-configuration

Testing​

  1. Test login: Access Smartflow and verify redirect to your IdP login page.
  2. Test user attributes: After login, verify user name and email appear correctly in Smartflow.
  3. Test role mapping: Verify that IdP group membership maps to the correct Smartflow role.
  4. Test logout: Click logout in Smartflow and verify session is terminated at the IdP.
  5. Test session expiry: Wait for session timeout and verify re-authentication is required.

Troubleshooting​

  • Redirect loop after login - Check whether the ACS URL in the IdP matches the Smartflow service provider details.
  • Invalid signature error - Re-download the IdP certificate and update the Smartflow certificate configuration.
  • User created without role - Configure the groups claim in the IdP and Smartflow attribute mapping.
  • Login works but logout does not - Configure SLO at the IdP, or disable SLO in Smartflow.
  • User not found after login - Add the user's email domain to Smartflow's allowed domains.
info

If these steps don't resolve the issue, contact your Smartflow support contact with your IdP logs and the error shown.