SSO authentication is only supported for web stations. When starting up a station, users need to authenticate. Besides authenticating with their ABBYY FlexiCapture user name and password, users can also be authenticated through an external identity provider (e.g. Azure Active Directory integrated with your corporate Active Directory).
Here's what happens when a user is authenticated through an external identity provider.
- The user clicks the Log in with [external server name] button.
- ABBYY FlexiCapture generates an AuthnRequest message, puts it into the SAMLRequest parameter of a URL GET request, and sends the request to the identity provider. Encrypted SAML SSO connections are not supported.
Sample request:
<samlp:AuthnRequest ID="id81c79c5cecf44dfbbecdc08ae6c6393f" IssueInstant="2019-07-17T10:59:19Z"
Version="2.0" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
xmlns="urn:oasis:names:tc:SAML:2.0:metadata">
<Issuer xmlns="urn:oasis:names:tc:SAML:2.0:assertion">
https://localhost/FlexiCapture12/Login/ten1/AccessToken/Saml</Issuer>
</samlp:AuthnRequest>
REQUEST HEADERS |
|
Host |
abbyy.onelogin.com |
Connection |
keep-alive |
Upgrade-Insecure-Requests |
1 |
User-Agent |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.142 Safari/537.36 |
Accept |
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*; q=0.8,application/signed-exchange;v=b3 |
Referer |
https://localhost/FlexiCapture12/Login/ten1/ |
Accept-Encoding |
gzip, deflate, br |
Accept-Language |
ru-RU,ru;q=0.9,en-US;q=0.8,en;q=0.7 |
Request Cookies |
|
RESPONSE DATA |
|
Status |
302 |
StatusText |
Found |
HttpVersion |
HTTP/1.1 |
RedirectURL |
https://abbyy.onelogin.com/login |
HeadersSize |
967 |
BodySize |
0 |
_transferSize |
967 |
_error |
undefined |
RESPONSE HEADERS |
|
Cache-Control |
no-cache |
Content-Type |
text/html; charset=utf-8 |
Date |
Wed, 17 Jul 2019 07:59:19 GMT |
Location |
https://abbyy.onelogin.com/login |
P3P |
CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE" |
Set-Cookie |
sub_session_onelogin.com=BAh7CDoWY29ubmVjdGluZ190b19hcHAiCzk1Mjk0MDo OcmV0dXJuX3RvIgG8aHR0cHM6Ly9hYmJ5eS5vbmVsb2dpbi5jb20vdHJ1c3Qvc 2FtbDIvaHR0cC1yZWRpcmVjdC9zc28vOTUyOTQwP3NhbWxfcmVxdWVzdF 9wYXJhbXNfdG9rZW49Zjk3ZmI2ODA0Mi5jZGU0MDRmMjg4YzY4YzM3MmFlNThj OTM5YWM3Y2U2NjZkYmM0YjAyLjBRQVRxUTA4VjR1V3NQT29GWTZ4dFFqRFQx WEF2S1B0VkhjMjBOcFBubkklM0Q6D3Nlc3Npb25faWQiKTRlYzYwMThlLTg0ZWUtNDE 5YS1iZmZmLWYwOTNiMWRhNDJlMA%3D%3D--da357cb50556cc5bec34d8c4ca372130785c6e6f; path=/; HttpOnly |
Status |
302 Found |
Strict-Transport-Security |
max-age=63072000 |
X-Content-Type-Options |
nosniff |
X-Frame-Options |
DENY |
X-Request-Id |
5D2ED557-C3D2939B-C3D9-0A090512-01BB-2C6A237-1F57 |
X-Xss-Protection |
1; mode=block |
Content-Length |
98 |
RESPONSE COOKIES |
|
Sub_session_ onelogin.com |
BAh7CDoWY29ubmVjdGluZ190b19hcHAiCzk1Mjk0MDoOcmV0dXJuX3RvIgG8aHR0c HM6Ly9hYmJ5eS5vbmVsb2dpbi5jb20vdHJ1c3Qvc2FtbDIvaHR0cC1yZWRpcmVjdC 9zc28vOTUyOTQwP3NhbWxfcmVxdWVzdF9wYXJhbXNfdG9rZW49Zjk3ZmI2ODA 0Mi5jZGU0MDRmMjg4YzY4YzM3MmFlNThjOTM5YWM3Y2U2NjZkYmM0YjAyLjBRQ VRxUTA4VjR1V3NQT29GWTZ4dFFqRFQxWEF2S1B0VkhjMjBOcFBubkklM0Q6D3 Nlc3Npb25faWQiKTRlYzYwMThlLTg0ZWUtNDE5YS1iZmZmLWYwOTNiMWRhNDJlMA% 3D%3D--da357cb50556cc5bec34d8c4ca372130785c6e6f |
- The identity provider authorizes the user.
- If the authentication is successful, the identity provider generates an assertion message, puts it into the SAMLResponse parameter of the request, and sends the request back to ABBYY FlexiCapture.
- The request containing the assertion message is sent to the ABBYY FlexiCapture Application Server in order to determine whether the specified user has the necessary permissions to log in to the specified station.
- The Application Server verifies the assertion message using a public certificate obtained from the identity provider and then authorizes the user.
- The Application Server performs the required operations and issues an internal authentication ticket.
- The user is granted access to the appropriate web station with the issued authentication ticket.
Note: This feature has been tested using the following identity providers: Azure Active Directory, OneLogin, and Okta.
Note: Multiple identity providers can be used simultaneously. For example, different identity providers can be used for different tenants. New authentication methods will be used side by side with the existing methods, including those used by default.
For more information about SAML authentication, see Authentication using SAML 2.0 identity providers in ABBYY FlexiCapture 12.