Configure and deploy user flows

User flows define the policy details for an application. This topic guides you through the four main steps of creating a user flow.

Select an application you’ve already configured.
Define the policy details (fields are dependent on the type of app).
Select the environment for the user flow.
Preview your changes and deploy the user flow.

Before creating a user flow, you must have at least one environment, one authentication provider, and one application configured.

Create or edit a user flow

From the dashboard, click Create user flow. Alternatively, from the sidebar, click User Flows, and click New. Enter a name for the user flow and select an application to use. Click Create.

To edit an existing user flow, click User Flows from the sidebar and click the name of the user flow you want to edit.

The fields available on the next page are dependent on the type of app being defined.

Proxy apps

The name of the user flow appears at the top of the screen and can be edited. The application appears under the name. You can click the application to edit the app configuration, but you cannot change the application tied to the user flow.

In the Attribute Providers section, use the Settings section to select an attribute provider, a username mapping provider, and a username mapping attribute. Click Add to save your attribute. Repeat this process to add multiple attributes.
(Optional) Under Service Extensions, select a service extension for use with the attribute provider. Click Add to select multiple service extensions.
Under Access Control Policies, you can select a resource that you’ve defined in the application configuration to apply fine-grain access controls and pass user information through HTTP headers. Click Add to define the access control.
1. On the Access Control page, select an authentication provider and the access policy you want to use.
  - Authentication: By default, users are denied access to the resource unless they are authenticated. You can select Allow unauthenticated users under Authentication if you want to allow access to unauthenticated users.
  - Authorization: By default, users are denied access to the resource unless granted access through an authorization rule.
    - You can select Allow all access if you want to allow all users access without an authorization rule.
    - If you wish to leave this option turned off, you can apply fine-grain access control and authorization by selecting Use rules to define access and using the boolean rule builder that appears on screen.
      - The rule builder allows you to add rules and conditions by provider. Additionally, you can add a rule or condition to restrict access based on HTTP request method. You can specify the HTTP method and create different access rules for reading a resource (using GET) versus modifying it (using POST or PUT).
    - Alternatively, you can select a service extension if you have any authorization service extensions already configured.
  - Service Extension Policy Decision Lifetime: Define the length of time when policies are re-evaluated by service extensions. If your user flow does not leverage a service extension for authorization or load attributes, you can skip this option.
    - Cached for the duration of the session: The policy decision will be cached for the lifetime of the session. For more information, see Max Lifetime.
    - Specify a duration: Set the duration of policy re-evaluation in seconds, minutes, or hours. The policy decision will be cached for the specified duration or until the session ends.
    - Continuous re-evaluation: The policy decision will not be cached and every request will be evaluated.
2. Define the headers in the Headers section by entering the header name, selecting the provider, and entering the attribute. Click Add to save the header, and repeat to add multiple headers.
3. If you’ve configured a Header Creation service extension, you can select it under Service Extensions. Click Add to save the service extension, and repeat to add multiple service extensions.
The Headers section allows you to define broad policies for the application. Define the headers in the Headers section by entering the header name, selecting the provider, and entering the attribute. Click Add to save the header, and repeat to add multiple headers.
If you’ve configured service extensions, you can select them under Service Extensions. Click Add to save the service extension, and repeat to add multiple service extensions.
To save the complete user flow, click Commit and Deploy at the top of the page and proceed to the next section.

SAML apps

Under Authentication Provider, select an IDP you’ve configured.
In the Attribute Providers section, select an attribute provider, a username mapping provider, and a username mapping attribute. Click Add to save your attribute. Repeat this process to add multiple attributes.
The Authorization section allows you to define your access policy. By default, users are allowed access unless granted access through an authorization rule.
- Allow all access is selected by default, and allows all users access without an authorization rule.
- Select Use rules to define access to apply fine-grain access control and authorization. The Boolean rule builder appears after selecting this option, and allows you to add rules and conditions by provider.
- Alternatively, you can select a service extension if you have any authorization service extensions already configured.
The Claims section allows you to provide additional claims to this user. This maps claims to session attributes provided by the IDP(s) and any optionally defined AttributeProvider(s).
1. Use the SAML Attributes section to select an attribute provider, a username mapping provider, and a username mapping attribute. Click Add to save your claim. Repeat this process to add multiple claims.
2. Under NameID mapping, you can define custom NameID mappings in SAML responses. Select a provider and enter the attribute you want to define. Click Add to save the mapping.
3. If you’ve configured Build Claims or Build Relay State service extensions, you can select them under Service Extensions.
To save the complete user flow, click Commit and Deploy at the top of the page and proceed to the next section.

OIDC apps

Under Authentication Provider, select an IDP you’ve configured.
In the Attribute Providers section, select an attribute provider, a username mapping provider, and a username mapping attribute. Click Add to save your attribute. Repeat this process to add multiple attributes.
The Claims section allows you to provide additional claims to this user. This maps claims to session attributes provided by the IDP(s) and any optionally defined AttributeProvider(s).
1. Use the OIDC Claims Mapping section to select an attribute provider, a username mapping provider, and a username mapping attribute. Click Add to save your claim. Repeat this process to add multiple claims.
2. If you’ve configured an Access Token or ID Token service extension, you can select it under Service Extensions. Click Add to save.
To save the complete user flow, click Commit and Deploy at the top of the page and proceed to the next section.

API

No additional configuration is needed for API apps.

Commit and Deploy

Commit and deploy

After clicking Commit and Deploy, the Commit revision modal appears. From here, you have several options:

Select an environment and click Commit new revision and deploy to save your user flow changes, and deploy them to the selected environment.
Select a previous revision and an environment and click Deploy to deploy a previous configuration to the selected environment. The Deploy button only appears after choosing a previous revision from the dropdown.
Click Commit & close to save the changes to the user flow and close the window (This will not deploy the user flow to an environment).

Orchestrator resources

For more information on setting up environments, we recommend the following Orchestrator reference topics:

Applications API Service extensions

Configure service extensions View orchestrator telemetry