SAML 2.0 SSO Setup

1. Introduction

Flowk supports SAML 2.0 integration with any compliant Identity Provider (IdP) such as Okta, Azure Active Directory (Entra ID), Google Workspace, or OneLogin. This allows your team to authenticate securely using their existing corporate credentials.

2. Flowk Metadata Setup

You will need to provide the following details to your Identity Provider to create the SAML application:

• Entity ID (Audience URI): https://flowk.kemonai.com/
• Assertion Consumer Service (ACS) URL: https://flowk.kemonai.com/api/auth/sso/callback
• Name ID Format: EmailAddress

3. Attribute Mapping

Ensure your IdP is configured to send the following attributes in the SAML assertion:

• NameID (Required): Must contain the user's primary email address.
• firstName (Optional): User's first name for dashboard personalization.
• lastName (Optional): User's last name.

4. Configuring Flowk

Once your IdP application is created, you must configure Flowk to recognize it:

1. Navigate to Manage > Enterprise SSO in the Flowk Dashboard sidebar.
2. Toggle Enable SAML Authentication.
3. Enter your SSO Domain (e.g., yourcompany.com). This determines when a user is routed to SSO during login.
4. Enter your SAML Issuer (Entity ID) provided by your IdP.
5. Enter the IDP Entrypoint (SSO URL) provided by your IdP.
6. Paste your Identity Provider Certificate (X.509). Be sure to include the BEGIN CERTIFICATE and END CERTIFICATE headers.

5. Testing and Enforcement

When users from your domain navigate to the Flowk login page, they will automatically be prompted to authenticate via your IdP. Just-in-Time (JIT) provisioning is supported; if a user does not exist in Flowk but successfully authenticates via your IdP, an account will automatically be created and assigned to your tenant.