How to set up single sign-on (SSO)

Set up SAML 2.0 single sign-on (SSO) so users can authenticate through your organisation's identity provider.

Before you start

• You need Organisation admin access in Flinq and administrator access to your identity provider.

• Your identity provider must expose a public HTTPS metadata URL.

• Keep a tested password-based recovery administrator until the setup is complete.

• Use a non-critical test user for the first sign-in.

Configure the identity provider

Start with the exact base URL shown for your Flinq workspace. The values below are templates; replace <workspace> with the workspace name shown in your Flinq URL.

• Entity ID: https://<workspace>.app.flinq.io/auth/saml2

• Assertion Consumer Service (ACS) URL: https://<workspace>.app.flinq.io/auth/oauth/callback/saml2

• Sign-on URL: https://<workspace>.app.flinq.io/auth/oauth/saml2

Replace <workspace> with the workspace shown in your Flinq URL. If your organisation uses an alias or custom domain, confirm the exact URLs with Flinq before continuing.

Configure the identity provider to send a unique email address and the user's name. Assign the test user to the application, then copy the provider's public metadata URL.

Enable SSO in Flinq

1. Go to Settings > Organisation Settings.

2. Under SSO (Single Sign-On), enable Use SSO (SAML2).

3. Enter the identity provider's Metadata URL.

4. Save the organisation settings.

Test access

1. Create the test user in the correct office and assign the required roles.

2. Open a private browser window and go to the workspace login page.

3. Select SSO via SAML2 and complete sign-in.

4. Confirm that the user reaches the correct office with the expected permissions.

5. Test the recovery administrator before expanding access.

Flinq can create a user record from a successful SSO response, but pre-creating users is recommended so office access and roles are ready before their first sign-in. SSO users are not required to set up Flinq two-factor authentication because authentication controls are handled by the identity provider.

Plan certificate rotation and recovery

Keep the provider's public metadata URL current when its signing certificate changes. Test the updated metadata with a non-critical user before the old certificate expires, and keep the password-based recovery administrator available throughout the change.