How Single Sign-On works in ABBYY FlexiCapture

SSO authentication is supported for web stations only. Users authenticate when they start a station. Users can also authenticate through an external identity provider, instead of an ABBYY FlexiCapture user name and password. One example is Azure Active Directory integrated with your corporate Active Directory.

Single Sign-On authentication flow

Diagram of the Single Sign-On flow in ABBYY FlexiCapture, showing the numbered steps from the user clicking the Log in with button through the SAML request and response exchanged with the identity provider, assertion verification by the FlexiCapture Application Server, and the user being granted access to the web station.

The user starts the sign-in

The user clicks the Log in with [external server name] button.

ABBYY FlexiCapture sends an AuthnRequest

ABBYY FlexiCapture generates an AuthnRequest message, puts it into the SAMLRequest parameter of a URL GET request, and sends the request to the identity provider. Encrypted SAML SSO connections are not supported.The AuthnRequest looks similar to this:

<samlp:AuthnRequest ID="id81c79c5cecf44dfbbecdc08ae6c6393f"
                    IssueInstant="2019-07-17T10:59:19Z"
                    Version="2.0"
                    xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
                    xmlns="urn:oasis:names:tc:SAML:2.0:metadata">
  <Issuer xmlns="urn:oasis:names:tc:SAML:2.0:assertion">https://localhost/FlexiCapture12/Login/ten1/AccessToken/Saml</Issuer>
</samlp:AuthnRequest>

The identity provider authorizes the user

Authorization happens entirely on the identity provider’s side.

The identity provider returns an assertion

On success, the identity provider generates an assertion message. It puts the message into the SAMLResponse parameter and sends the request back to ABBYY FlexiCapture.

The request reaches the Application Server

The request carrying the assertion message goes to the ABBYY FlexiCapture Application Server. The server then determines whether the user may log in to the specified station.

The Application Server verifies the assertion

Verification uses a public certificate obtained from the identity provider. The Application Server then authorizes the user.

The Application Server issues a ticket

It performs the required operations and issues an internal authentication ticket.

The user reaches the web station

The issued authentication ticket grants access to the appropriate web station.

Supported identity providers

This feature has been tested with Azure Active Directory, OneLogin, and Okta. You can use several identity providers at the same time, for example a different provider for each tenant. New authentication methods run alongside the existing ones, including the methods used by default. For more information about SAML authentication, see Authentication using SAML identity providers in ABBYY FlexiCapture 12.

​Single Sign-On authentication flow

​Supported identity providers

Single Sign-On authentication flow

Supported identity providers