Configure and deploy user flows

User flows define the policy details for an application. This topic guides you through the four main steps of creating a user flow.

Select an application you’ve already configured.
Define the policy details (fields are dependent on the type of app).
Select the environment for the user flow.
Preview your changes and deploy the user flow.

Before creating a user flow, you must have at least one environment, one authentication provider, and one application configured.

Create or edit a user flow

From the dashboard, click Create user flow. Alternatively, from the sidebar, click User Flows, and click New. Enter a name for the user flow and select an application to use. Click Create.

To edit an existing user flow, click User Flows from the sidebar and click the name of the user flow you want to edit.

The fields available on the next page are dependent on the type of app being defined.

Proxy apps

The name of the user flow appears at the top of the screen and can be edited. The application appears under the name. You can click the application to edit the app configuration, but you cannot change the application tied to the user flow.

In the Attribute Providers section, use the Settings section to select an attribute provider, a username mapping provider, and a username mapping attribute. Click Add to save your attribute. Repeat this process to add multiple attributes.
(Optional) Under Service Extensions, select a service extension for use with the attribute provider. Click Add to select multiple service extensions.
Under Access Control Policies, you can select a resource that you’ve defined in the application configuration to apply fine-grain access controls and pass user information through HTTP headers. Click Add to define the access control.
1. On the Access Control page, select an authentication provider and the access policy you want to use.
  - Authentication: By default, users are denied access to the resource unless they are authenticated. You can select Allow unauthenticated users under Authentication if you want to allow access to unauthenticated users.
  - Authorization: By default, users are denied access to the resource unless granted access through an authorization rule.
    - You can select Allow all access if you want to allow all users access without an authorization rule.
    - If you wish to leave this option turned off, you can apply fine-grain access control and authorization by selecting Use rules to define access and using the boolean rule builder that appears on screen.
      - The rule builder allows you to add rules and conditions by provider. Additionally, you can add a rule or condition to restrict access based on HTTP request method. You can specify the HTTP method and create different access rules for reading a resource (using GET) versus modifying it (using POST or PUT).
    - Alternatively, you can select a service extension if you have any authorization service extensions already configured.
2. Define the headers in the Headers section by entering the header name, selecting the provider, and entering the attribute. Click Add to save the header, and repeat to add multiple headers.
3. If you’ve configured a Header Creation service extension, you can select it under Service Extensions. Click Add to save the service extension, and repeat to add multiple service extensions.
The Headers section allows you to define broad policies for the application. Define the headers in the Headers section by entering the header name, selecting the provider, and entering the attribute. Click Add to save the header, and repeat to add multiple headers.
If you’ve configured service extensions, you can select them under Service Extensions. Click Add to save the service extension, and repeat to add multiple service extensions.
To save the complete user flow, click Deploy… at the top of the page.
The Choose revision and environment modal appears. The Revision field reflects the latest number. Select an environment to deploy to and click Preview.
On the Deployment Preview screen, you can view the revision history and a diff view of the current user flow against the new user flow (if you’re editing an existing user flow).
Click Deploy at the top of the screen to deploy the latest revision to your selected environment.

SAML apps

Under Authentication Provider, select an IDP you’ve configured.
In the Attribute Providers section, select an attribute provider, a username mapping provider, and a username mapping attribute. Click Add to save your attribute. Repeat this process to add multiple attributes.
The Claims section allows you to provide additional claims to this user. This maps claims to session attributes provided by the IDP(s) and any optionally defined AttributeProvider(s).
1. Use the SAML Attributes section to select an attribute provider, a username mapping provider, and a username mapping attribute. Click Add to save your claim. Repeat this process to add multiple claims.
2. Under NameID mapping, you can define custom NameID mappings in SAML responses. Select a provider and enter the attribute you want to define. Click Add to save the mapping.
3. If you’ve configured Build Claims or Build Relay State service extensions, you can select them under Service Extensions.
To save the complete user flow, click Deploy… at the top of the page.
The Choose revision and environment modal appears. The Revision field reflects the latest number. Select an environment to deploy to and click Preview.
On the Deployment Preview screen, you can view the revision history and a diff view of the current user flow against the new user flow (if you’re editing an existing user flow).
Click Deploy at the top of the screen to deploy the latest revision to your selected environment.

OIDC apps

Under Authentication Provider, select an IDP you’ve configured.
In the Attribute Providers section, select an attribute provider, a username mapping provider, and a username mapping attribute. Click Add to save your attribute. Repeat this process to add multiple attributes.
The Claims section allows you to provide additional claims to this user. This maps claims to session attributes provided by the IDP(s) and any optionally defined AttributeProvider(s).
1. Use the OIDC Claims Mapping section to select an attribute provider, a username mapping provider, and a username mapping attribute. Click Add to save your claim. Repeat this process to add multiple claims.
2. If you’ve configured an Access Token or ID Token service extension, you can select it under Service Extensions. Click Add to save.
To save the complete user flow, click Deploy… at the top of the page.
The Choose revision and environment modal appears. The Revision field reflects the latest number. Select an environment to deploy to and click Preview.
On the Deployment Preview screen, you can view the revision history and a diff view of the current user flow against the new user flow (if you’re editing an existing user flow).
Click Deploy at the top of the screen to deploy the latest revision to your selected environment.

API

No additional configuration is needed for API apps. On the user flow configuration page, click Deploy… at the top of the page.
The Choose revision and environment modal appears. The Revision field reflects the latest number. Select an environment to deploy to and click Preview.
On the Deployment Preview screen, you can view the revision history and a diff view of the current user flow against the new user flow (if you’re editing an existing user flow).
Click Deploy at the top of the screen to deploy the latest revision to your selected environment.

Orchestrator resources

For more information on setting up environments, we recommend the following Orchestrator reference topics:

Applications API Service extensions

Configure service extensions View orchestrator telemetry