Skip to main content
Single Sign-On (SSO) authentication is supported only for web stations.
Users authenticate when they start a station. They can use their ABBYY FlexiCapture user name and password, or an external identity provider such as Azure Active Directory integrated with your corporate Active Directory.

​
Add an identity provider

Before you begin, create and set up an application in the identity provider. For more information, see Single Sign-On authentication.
1

Launch the console

Launch the Administration and Monitoring Console.
Only the ABBYY FlexiCapture administrator can configure Single Sign-On on the default tenant. On other tenants, tenant administrators can configure it.
2

Open Single Sign-On settings

Go to Settings → Single Sign-On.
3

Add a configuration

Click Add Configuration.
4

Specify the parameters

In the dialog box that opens, specify the required parameters:
  • Name – The identity provider’s name, shown on the Log in with… button.
  • Reference – The URL of the external identity provider’s server.
  • Upload Image File – The path to the button image (*.svg, *.jpg, or *.png).
  • Upload Certificate File – The path to the public certificate.
5

Save the configuration

Click OK. The new configuration is added to the list. To change it, click Edit.
You can specify multiple identity providers.
A Log in with [IdP Name] button then appears on the station’s login page. Users need appropriate permissions to use ABBYY FlexiCapture. For more information, see User roles and permissions.

​
Assign groups by SSO

You can create ABBYY FlexiCapture groups from the groups in your identity provider (IdP). Users are added automatically, and a group updates when its IdP group changes.
Only the tenant administrator can assign groups. For the default tenant, only the ABBYY FlexiCapture administrator can change this setting.
1

Enable group assignment

Go to Settings → Single Sign-On and select the Assign groups by SSO option.
2

Map the IdP group

When creating a new group, enter the GUID of the corresponding IdP group in the External ID field.
When users from that IdP group log in through SSO, they are added to the ABBYY FlexiCapture group automatically.

​
SSO-only authentication mode

Use SSO-only authentication mode in high-security environments, where all access must be controlled centrally to avoid errors when granting permissions.
SSO-only authentication can only be enabled for non-default tenants.
To enable SSO-only authentication, go to Settings → Single Sign-On and select the SSO-only authentication mode option. When this mode is enabled, only users authenticated through an external identity provider can access the system. Creating and importing users in the Administration and Monitoring Console is disabled.