Skip to main content
You can set up SAML-based Single Sign-On for ABBYY FlexiCapture web stations using Azure Active Directory. First register an application in Azure Active Directory, and then configure ABBYY FlexiCapture with a script.

​
Register an application in Azure Active Directory

  1. Go to https://portal.azure.com/ and log in to your Microsoft Azure account.
  2. Go to the Azure Active Directory > Enterprise applications section.
  3. In the Add an application window, go to the Non-gallery application section and specify a name for the new application. If several tenants are used, create a separate application for each.
    Screenshot of the Add an application page in the Microsoft Azure portal, with the Non-gallery application option and the Name field for the new enterprise application highlighted.
  4. Go to the Users and groups section and add all required users. Give them the User role.
  5. Go to the Single sign-on subsection and select SAML.
    Screenshot of the Single sign-on method page in the Microsoft Azure portal, with the Single sign-on menu item and the SAML method highlighted.
  6. Edit the Basic SAML Configuration section. In the Identifier (Entity ID) and Reply URL (Assertion Consumer Service URL) fields, enter https://<app-server-dns-name>/FlexiCapture12/Login/AccessToken/Saml, and leave the rest of the fields blank.
    When setting up a tenant, specify the URLs in this format: https://<app-server-dns-name>/FlexiCapture12/Login/<TenantName>/AccessToken/Saml
    Screenshot of the Set up Single Sign-On with SAML page in the Microsoft Azure portal, highlighting the Basic SAML Configuration section, the Certificate Base64 download link, and the Login URL.
  7. In the SAML Signing Certificate section, download your public certificate in Base64 format by clicking the link next to Certificate (Base64).
  8. From the Login URL field in the Set up [application name] section, copy the URL for accessing the server of the external identity provider.

​
Configure ABBYY FlexiCapture

To set up the required parameters in ABBYY FlexiCapture, run a PowerShell script:
  1. Obtain the SetIdentityProvider.ps1 script.
  2. On the machine where ABBYY FlexiCapture is installed, open the Windows PowerShell console as an administrator.
  3. Run the script with the path to the script and the required parameters. For example:
Where:
  • /url — The path to the Application Server. Example: 'https://localhost'.
  • /certFilePath — The path to the public certificate. Example: 'C:\Temp\AzureAD_FC_integration.cer'.
  • /pictureFilePath — The path to the image used for the new button (.svg, .jpg, and .png formats are supported). Example: 'C:\Temp\index.svg'.
  • /tenant — The tenant for which the parameters are set. Example: 'TenantName'. Specify this only if multiple tenants are used.
  • /providerName — The external identity provider. Example: 'Azure AD'. The login button will then read Log in with Azure AD.
  • /Reference — The URL for accessing the external identity provider. Example: 'https://login.microsoftonline.com/123e4567-e89b-12d3-a456-426655440000/saml2'.
As a result, the Log in with Azure AD button appears on the web station’s login page.
For more technical details about the SAML authentication requests and responses that Azure Active Directory supports for Single Sign-On, see this article on Microsoft.com.