Connecting your identity provider to Flockler (SSO)

What you have been asked to do

A colleague is enabling single sign-on for your organisation's Flockler account and has sent you a secure setup link. That link opens a guided portal where you connect Flockler to your identity provider.

You do not need a Flockler login. Everything happens in the portal and in your own identity provider's admin console.

What you need

• Admin access to your identity provider.
• Permission to create a new SAML or OIDC application.
• The list of people or groups who should be able to sign in to Flockler.

Supported providers: Okta, Microsoft Entra ID (Azure AD), OneLogin, Google Workspace, Salesforce, JumpCloud, Cloudflare, Auth0, and any other provider that supports SAML 2.0 or OpenID Connect (OIDC).

Step 1. Open the setup portal

Open the link your colleague sent. You will land on the setup portal with two options:

• SSO Connection Configuration — set up single sign-on. This is the one you need.
• Automated Directory Synchronization — optional SCIM provisioning to sync users, groups and access permissions automatically. Not required for SSO.

Select SSO Connection Configuration:

Step 2. Choose the protocol

Choose the protocol you want to set up a connection for:

• SAML 2.0 — the most widely supported option. Choose this if you are unsure.
• OpenID Connect (OIDC)

Step 3. Select your identity provider

Pick your provider from the list. The portal then shows instructions and screenshots tailored to that specific provider.

If your provider is not listed but supports SAML 2.0 or OIDC, choose the closest generic option and use the values the portal gives you. If you get stuck, contact team@flockler.com.

Step 4. Follow the guided steps

The left-hand sidebar tracks your progress and each step is ticked off as you complete it. The exact screens differ by provider, but the pattern is always the same:

Copy two values from the portal into your identity provider, then copy your provider's metadata back into the portal.

Using Okta as the example, the steps are:

1. Create SAML Integration

In your Okta admin console, go to Applications and select Create App Integration. Choose SAML 2.0 as the sign-in method, then select Next. Give the app a name, for example, Flockler.

2. Configure Audience URI and attribute mapping

The portal gives you two values to copy:

Copy each one from the portal and paste it into the corresponding field. Leave the other fields at their defaults unless the portal says otherwise.

3. Submit application feedback

Complete your provider's own final form and finish creating the application. In Okta this is the feedback step before Finish.

4. Add users to the SAML app

Assign the people or groups who should be able to sign in to Flockler. In Okta, open the app's Assignments tab and use Assign → Assign to People or Assign to Groups.

5. Upload identity provider metadata

Now send your provider's details back to the portal. You have two options:

• Automatically — paste your provider's IdP Metadata URL. In Okta, this is the Metadata URL on the app's Sign On tab.
• Manually — enter the Identity Provider Single Sign-On URL, the Identity Provider Issuer, and the X.509 Certificate.

The metadata URL is the quicker and more reliable route where available.

6. Advanced attribute mapping

Optional. Skip it unless your organisation needs custom attribute mapping.

7. Save and test

Save the configuration. The portal then offers a test sign-in to confirm the connection works end to end.

Select the option confirming you are ready, and complete the sign-in when redirected to your identity provider.

Step 5. Confirm it worked

A successful test means the connection is live. Let your colleague know, because they still need to finish two things in Flockler:

• Choose the default role and site access for people signing in via SSO.
• Optionally require SSO for everyone on the email domain.

Every sign-in attempt, successful or not, is recorded in the Sign-in log on Settings → SSO in Flockler, with the time, email address, outcome and IP address. Your colleague can check there, or send you a screenshot if something failed.

Were you also asked to add a DNS record?

Before this stage, Flockler needs the organisation's email domain verified with a DNS TXT record. If your colleague sent you those values as well, add them in whichever DNS provider hosts the domain:

Once the record is live, your colleague selects Verify in Flockler. DNS changes usually propagate within a few minutes but can take longer.

Troubleshooting

• The setup link has expired. Ask your colleague to select Generate new link on Settings → SSO in Flockler.
• The test sign-in fails with an access or assignment error. Confirm your own account is assigned to the application in your identity provider (Step 4).
• The test sign-in fails with a URL or audience mismatch. Recheck the Single Sign-On URL and Audience URI (SP Entity ID) in your provider against the values in the portal. A trailing space or truncated paste is the usual cause.
• The certificate or metadata is rejected. Use the metadata URL rather than manual entry where your provider offers one. If entering manually, paste the full X.509 certificate including the BEGIN    and END    lines if your provider includes them.
• My provider is not in the list. Any SAML 2.0 or OIDC provider will work. Choose the closest generic option, or contact team@flockler.com.