Skip to main content
SSO authentication is only supported for web stations. When starting up a station, users need to authenticate. Besides authenticating with their ABBYY FlexiCapture user name and password, users can also be authenticated through an external identity provider (for example, Azure Active Directory integrated with your corporate Active Directory). Here’s what happens when a user is authenticated through an external identity provider.
Diagram of the Single Sign-On flow in ABBYY FlexiCapture, showing the numbered steps from the user clicking the Log in with button through the SAML request and response exchanged with the identity provider, assertion verification by the FlexiCapture Application Server, and the user being granted access to the web station.
  1. The user clicks the Log in with [external server name] button.
  2. ABBYY FlexiCapture generates an AuthnRequest message, puts it into the SAMLRequest parameter of a URL GET request, and sends the request to the identity provider. Encrypted SAML SSO connections are not supported. The AuthnRequest looks similar to this:
  3. The identity provider authorizes the user.
  4. If the authentication is successful, the identity provider generates an assertion message, puts it into the SAMLResponse parameter of the request, and sends the request back to ABBYY FlexiCapture.
  5. The request containing the assertion message is sent to the ABBYY FlexiCapture Application Server to determine whether the specified user has the necessary permissions to log in to the specified station.
  6. The Application Server verifies the assertion message using a public certificate obtained from the identity provider and then authorizes the user.
  7. The Application Server performs the required operations and issues an internal authentication ticket.
  8. The user is granted access to the appropriate web station with the issued authentication ticket.
This feature has been tested using the following identity providers: Azure Active Directory, OneLogin, and Okta.
Multiple identity providers can be used simultaneously. For example, different identity providers can be used for different tenants. New authentication methods will be used side by side with the existing methods, including those used by default.
For more information about SAML authentication, see Authentication using SAML identity providers in ABBYY FlexiCapture 12.