Flex SSO URL Migration Guide

If your Flex instance is running Flex UI 2.7.x or later, migrate your SSO connection to a new solution that offers enhanced security using OAuth 2.0.

Migrating to enhanced SSO configuration requires changes in two places: Flex Console and your IdP. When choosing a setup type, consider whether the Flex administrator has access to make changes in the IdP. If you need to collaborate with an IdP administrator on the migration, this may influence which setup method works best for your organization.

With this option, the IdP administrator will update the Entity ID and ACS URL for the existing IdP application used for Flex.

With this option, the IdP administrator will set up a new IdP application to use for Flex.

Migrating has three or four steps, depending on your setup type:

1. Select setup type.

2. Update your identity provider.

3. Enter identity provider data.

   Note This page only appears if you create a new SSO connection. If you modify your existing connection, Flex uses the IdP data from your legacy connection, so you don't need to enter this information again.

4. Validate successful connection in Flex.

To start your migration:

1. In Console, navigate to Flex > Manage > Single sign-on. If you're running Flex UI 2.7.x or later, you'll see a New SSO Solution Available section.

2. Click Start setup.

   The Single sign-on set up workflow appears.

1. Select a setup type:
   • Modify existing SSO connection
   • Create new SSO connection
2. Click Continue.

In this step, the IdP administrator sets the Entity ID and ACS URL values for the new connection in the IdP. However, the IdP may not use the same labels to identify these values.

Check the following table to see what field labels your IdP uses. If you need help locating the fields, click the IdP name in the table to go to the full setup instructions. There, you can find the steps to navigate to the appropriate page in your IdP.

To update your IdP:

1. Copy the Entity ID and ACS URL values from the Single sign-on setup workflow.
2. In your IdP, paste the values into the appropriate fields.
   • If you're modifying your existing connection, update these values in your existing application.
   • If you're creating a new SSO connection, make sure you add the values to the new application, not to the application used for your legacy connection.
3. In the Single sign-on setup workflow, confirm that the values have been updated.
4. Click Save and Continue.

This page only appears in the workflow for creating a new SSO connection.

1. Enter the SAML setting values from your new application. If you need more information about the settings, see the setup instructions for your IdP:
   • Google SSO: Configure Google Single Sign-On (SSO) with Twilio Flex
   • Okta IdP: Configure Flex with your new SAML credentials
   • Salesforce SSO: Set up SSO in Twilio Flex
   • Azure AD: Configure Flex with your new SAML credentials
   • Auth0 IDP: Configure Flex with your SAML credentials
2. Click Save.

1. Click Log in with SSO.

2. When prompted, enter the credentials of a user who has access to the application in your IdP used for Flex.

   Flex loads when your login is successful.

3. Click Finish to complete the migration.

This returns you to the Single sign-on page:

• If you modified your existing connection, you'll see your new OAuth 2.0 connection.
• If you created a new SSO connection, you'll see both your new OAuth 2.0 connection and your inactive legacy connection.

Flex saves your legacy connection details for 30 days after completing the migration. If you experience login issues during this time, you can switch back while you troubleshoot your SSO connection.

If you modified your existing connection, you have only one SSO connection defined. To switch to your legacy connection, have the IdP administrator revert the Entity ID and ACS URL values in your IdP to those of your previous connection.

1. On the Single sign-on page, under New connection saved, click switch back to legacy connection.

   The Revert SSO connection page appears.

2. From the Legacy Flex SSO section, provide the Entity ID and ACS URL values to your IdP administrator to add to the IdP.

3. When the IdP updates are complete, click I confirm that my Flex application reflects the Legacy Flex SSO connection.

4. Click Switch connection.

When you want to return to using your new connection, complete the migration steps again.

If you created a new SSO connection, both your OAuth 2.0 connection and your legacy connection are saved. Switch back to your previous connection using the link on the Single sign-on page.

1. On the Single sign-on page, under New connection saved, click switch back to legacy connection.
2. In the Switch to OAuth 2.0 SSO Connection dialog, click Confirm.

The link on the Single sign-on page now reads switch back to OAuth 2.0 connection. Use this link you want to return to using your new connection.