Skip to main content
On every sign-in, SAML2.0, OIDC, and CAS sync a member’s roles and teams from the role and team names the identity provider returns. For how to set the sync switches, role and team fields, and defaults, the overwrite rules, and when defaults apply, see Role and team mapping. LDAP maps by Group DN instead; see LDAP role and team synchronization.
Leave default roles and default teams empty in most cases. Don’t configure administrator roles or sensitive teams just to make a sign-in test work.

​
Where each protocol reads names

The names you enter in Role field and Team field refer to these locations:

​
Name matching details

  • A value can be a single string or an array of strings. Non-string array elements are ignored.
  • Names are trimmed and matched exactly, case-sensitive: Ops and ops are different names.
  • The preset roles Admin, Responder, and Viewer always match. A custom role must be enabled; a disabled role doesn’t match even with the same name.
  • Only teams that haven’t been deleted match.
  • When several roles or teams share a name, the one with the smallest ID is used.
  • Names that match nothing are skipped and don’t affect other names.
  • A role or team selected as a default can’t be deleted until you clear it in the SSO configuration. See When defaults apply.

Single Sign-On Configuration

Overall configuration guide for every protocol

Authing Integration

Configuring Flashduty SSO with Authing

Keycloak Integration

Configuring Flashduty SSO with Keycloak

OpenLDAP Integration

Configuring Flashduty SSO with OpenLDAP