Custom SAML2: Single Sign-On with Flexopus
Connect Flexopus to your own identity provider using the SAML2 standard and enable secure, centrally managed login for your employees—without additional passwords.
What is the custom SAML2 integration?
SAML2 (Security Assertion Markup Language 2.0) is a widely used open standard for the secure exchange of authentication information between an identity provider (IdP) and a service provider (SP). Flexopus acts as a service provider and supports any identity provider that complies with the SAML2 standard.
This integration allows you to set up Single Sign-On (SSO) for Flexopus: users log in once to their corporate identity provider and automatically gain access to Flexopus without separate credentials. Basic user attributes such as name, email address, and optional fields like department or cost center are transmitted via SAML2 assertions.
What is the purpose of the integration?
The custom SAML2 integration seamlessly connects Flexopus with your existing IT infrastructure. Once an employee has authenticated with your identity provider, they are automatically logged into Flexopus without needing to enter a password again.
Typical use cases include:
- Companies using their own or less common identity providers (e.g., Keycloak, Ping Identity, Okta, or a custom SAML2-compliant IdP) can still fully integrate Flexopus.
- Access control remains centralized at the identity provider: administrators define which users or groups are permitted to log in to Flexopus.
- New employees are automatically created in Flexopus upon their first login—no manual setup is required beforehand.
How easy is the integration?
Setup is performed via the Flexopus administration page under Settings > Authentication. There, you will find the required configuration parameters (Entity ID, ACS URL, metadata URL) to store in your identity provider. Afterward, upload your IdP's metadata to Flexopus or provide the metadata URL.
Multiple SSO providers can also be configured simultaneously—convenient for companies with multiple subsidiaries or IdPs.
A complete step-by-step guide for setup can be found in our Help Center.
What are the benefits of the integration?
- Compatibility with any SAML2-compliant identity provider, regardless of the manufacturer or system.
- Single Sign-On for your employees: one login for access to all connected systems—no extra password for Flexopus.
- Centralized access control: you manage who has access to Flexopus within your identity provider, based on users or groups.
- Automatic user creation upon first login: new employees do not need to be manually added to Flexopus.
- Synchronization of user attributes such as name, email, department, cost center, or job title directly via SAML2.
- Increased security through signed SAML2 assertions and optional encryption of transmitted data.
- Support for multi-factor authentication (MFA), managed directly via your identity provider.
- Password login in Flexopus can optionally be disabled to enforce SSO as the sole authentication method.
Categories
Developed By
Flexopus GmbHAdditional integrations
.svg)
Questions and answers
Does the integration work with our own identity provider if it is not on the list?
Yes. Flexopus implements the official SAML2 standard and is therefore fundamentally compatible with any SAML2-compliant identity provider, regardless of the vendor. Specific guides are also available for common providers such as Microsoft Entra ID, Google, Keycloak, Okta, Ping Identity, or Akamai.
Which user data is transmitted via SAML2?
Mandatory fields are first name, last name (or a combined name field), and the email address. Optionally, additional attributes such as job title, department, cost center, or group memberships can be transmitted. Only the data that you configure for transmission in your identity provider is sent.
What happens if a user is removed from the identity provider?
If a user is deactivated or removed in the identity provider, they can no longer log in to Flexopus via SSO. Access is thus automatically blocked. The user record in Flexopus remains until it is manually deleted there. For fully automated deactivation or deletion, we recommend the additional use of the SCIM interface.
Is it possible to use password login in parallel with SSO?
Yes, both login methods can be active simultaneously by default. However, administrators can specifically disable password login to enforce SSO as the only login option. A hidden backup login remains accessible for administrators.
What should be considered regarding the User Principal Name (UPN)?
The UPN is a unique, immutable identifier in SAML2. It should not be changed after the initial setup, as this can lead to duplicate user records or mapping errors. If a change is necessary, please contact Flexopus support.