Configuring SAML Protocol
Configuration path: Platform Management → Single Sign-On → Enable → Settings → Select SAML2.0 protocol type
| Field | Description |
|---|---|
| Protocol Type | Select SAML2.0 |
| Metadata Document | XML document obtained from the identity provider |
| Field Mapping | Flashduty extracts user email, username, and phone information from the identity provider through mapped fields |
| Create Account on Sign In | Enabled by default; when disabled, members must be invited before they can sign in |
| Flashduty Service Provider Info | Service Provider Metadata and Assertion Consumer Service URL (assertion address for identity provider to call for single sign-on) |
Configuring OIDC Protocol
Configuration path: Platform Management → Single Sign-On → Enable → Settings → Select OIDC protocol type
| Field | Description |
|---|---|
| Protocol Type | Select OIDC protocol |
| Issuer | Obtained from identity provider, case-sensitive URL that cannot contain query parameters |
| Client ID | Client ID, obtained from identity provider |
| Client Secret | Client secret, obtained from identity provider |
| Field Mapping | Flashduty extracts user email, username, and phone information from the identity provider through mapped fields |
| Create Account on Sign In | Enabled by default; when disabled, members must be invited before they can sign in |
| Scopes | Specifies the information and functionality permissions the request can access, with support for customization. Defaults to openid, profile, email, phone; you can add custom scopes as tags |
| Flashduty Service Provider Info | Redirect URL: Identity provider callback address Supported Signing Algorithms: RS256, RS384, RS512, ES256, ES384, ES512, PS256, PS384, PS512 (HS256 not supported) |
Configuring CAS Protocol
Configuration path: Platform Management → Single Sign-On → Enable → Settings → Select CAS protocol type
| Field | Description |
|---|---|
| Protocol Type | Select CAS protocol |
| CAS Address | CAS service address obtained from identity provider, e.g., https://xqlsd3irx2gm-demo.authing.cn/cas-idp/669e050856d5b07b4399b242 |
| CAS Login Path | CAS login path, e.g., /login |
| Skip TLS Check | Optional; when enabled, skips TLS certificate verification, suitable for CAS services using self-signed certificates |
| Field Mapping | Flashduty extracts user email, username, and phone information from the identity provider through mapped fields |
| Create Account on Sign In | Enabled by default; when disabled, members must be invited before they can sign in |
| Flashduty Service Provider Info | Redirect URL: Identity provider callback address |
Configuring LDAP Protocol
LDAP single sign-on is only supported in the private deployment version.
| Field | Description |
|---|---|
| Protocol Type | Select LDAP protocol |
| LDAP URL | LDAP service address, e.g., ldap://10.10.10.10:389 |
| BIND DN | Username for connecting to LDAP, e.g., cn=admin,dc=flashduty,dc=com |
| BIND DN Password | Password for connecting to LDAP, stored encrypted in the database |
| Encryption | Supports TLS and StartTLS encryption methods (mutually exclusive, only one can be enabled). After enabling either method, you can optionally skip SSL/TLS certificate verification; if not skipped, you can optionally provide the SSL/TLS certificate path |
| User DN | Defines where to start searching for users, e.g., ou=people,dc=flashduty,dc=com |
| Auth Filter | Custom filter expression for retrieving user DN information, basic form: (&(mail=%s)). Note: Opening and closing parentheses are required |
| Field Mapping | Flashduty extracts user email, username, phone, and Group information from the identity provider through mapped fields. Email is a required mapping field. The Group field defaults to memberOf and is used for role and team synchronization |
| Create Account on Sign In | Enabled by default; when disabled, members must be invited before they can sign in |
LDAP Connection Test
After configuring the LDAP connection information, you can click the Connection Test button at the bottom of the settings drawer to verify that Flashduty can successfully connect to your LDAP server. The system will attempt to establish a connection using the currently entered LDAP URL, BIND DN, and password, and return a success or failure result.LDAP Role and Team Synchronization
When using the LDAP protocol, you can automatically synchronize Flashduty roles and teams based on the user’s LDAP Group membership. Configuration path: LDAP Settings page → Sync ConfigurationEnable Synchronization
In the sync configuration area, enable the Sync Roles and/or Sync Teams toggles.
Add Mapping Rules
Click Add Mapping Rule and configure the following for each rule:
| Field | Description |
|---|---|
| Group DN | The full Distinguished Name of the Group in LDAP, e.g., cn=devops,ou=groups,dc=example,dc=com |
| Mapped Roles | Available when Sync Roles is enabled; select the Flashduty roles this Group maps to |
| Mapped Teams | Available when Sync Teams is enabled; select the Flashduty teams this Group maps to |
- You can add multiple mapping rules, each corresponding to one LDAP Group
- When a user signs in, the system automatically matches and synchronizes the corresponding roles and teams based on their LDAP Group membership
- The Group DN in mapping rules must be the full path of the Group in LDAP
External member management
When you enable single sign-on, members automatically created through their first SSO login are marked as external members. You can enable the Prevent editing external members option in SSO settings (disabled by default). When enabled, these external members become read-only in Flashduty — you cannot modify their roles or delete them in Flashduty. All member management must be done through the identity provider. This feature is ideal for organizations that need to centrally manage user permissions in the identity provider, ensuring member information in Flashduty always stays in sync.
- This option only affects external members created via SSO; manually invited members are not affected
- If the SSO configuration is deleted, existing external members remain read-only by default
Login Domain Management
The login domain is an important identifier for your account, used to locate the correct SSO configuration during single sign-on. Each account’s login domain is globally unique. After configuring the login domain, members can initiate single sign-on directly through the
{domain}.sso.flashcat.cloud address without manually selecting an identity provider.
You can modify the account domain on the Platform Management → Basic Information page. The domain must be 5–40 characters long and can only contain letters, numbers, or -, and cannot start or end with -.
- It is recommended to use your company’s English name as the login domain for easy memorization
- Once set, changing the login domain will immediately invalidate the old domain; members using the old domain will need to update their login address
Best Practices
Authing Integration
Configure Flashduty SSO single sign-on through Authing
Keycloak Integration
Configure Flashduty SSO single sign-on through Keycloak
OpenLDAP Integration
Configure Flashduty SSO single sign-on through OpenLDAP