Dokuflex SSO: Active Directory, ADFS, OAuth, SAML, CAS and 2FA — every enterprise authentication standard

Why a BPM needs enterprise SSO

A BPM handles case files, contracts, invoices, signatures and approvals. In other words: personal, financial and legal data. Every user that authenticates outside the corporate perimeter is a risk vector and one more identity to maintain.

Without SSO four problems pile up: weak or reused passwords, ex-employees with live access, audit logs you cannot correlate with the corporate SIEM, and onboarding/offboarding that drags for weeks instead of minutes.

With SSO wired to your source of truth (Active Directory, Entra ID or Google Workspace), an HR offboarding deactivates the Dokuflex account in the same provisioning cycle. No tickets, no spreadsheets.

Supported protocols at a glance

What is covered out of the box — no custom development, no hidden premium modules:

All protocols are included in the Business plan and above, with no per-user surcharge and no separate "Enterprise Security" license.

Active Directory and LDAP/LDAPS

The most common scenario in mid-size companies running a Windows domain. Dokuflex talks to the domain controller via LDAPS (LDAP over TLS) and authenticates the user without ever storing the password.

What you configure in under an hour:

• DC URL: ldaps://dc.empresa.local:636
• Technical bind DN (service account with read permission).
• Search base DN: OU=Usuarios,DC=empresa,DC=local
• Attribute mapping: sAMAccountName, mail, memberOf for roles.
• Membership filter: only users in the group CN=Dokuflex-Users,OU=Apps.

For hybrid setups (AD on-prem + Entra ID in the cloud), we recommend delegating authentication to Entra ID with OIDC and reserving LDAP for back-office integrations only.

ADFS and SAML 2.0

If your organisation already federates applications via ADFS or a SAML IdP (Okta, OneLogin, Ping Identity, Auth0, Keycloak, Shibboleth), Dokuflex plugs in as a Service Provider in just a few steps:

1. Download the Dokuflex SP metadata (XML with entityID, ACS URL and certificate).
2. Import them into your IdP as a new Relying Party / Application.
3. Define the claims that travel in the SAML assertion: NameID, email, groups, department.
4. Upload the IdP metadata in the Dokuflex panel.
5. Map SAML groups → Dokuflex roles.

We support SP-Initiated SSO, IdP-Initiated SSO, Single Logout (SLO), signed and encrypted assertions, and automatic certificate rotation.

OAuth 2.0 and OIDC with Google and Microsoft Entra ID

For cloud-identity organisations, the recommended flow is OAuth 2.0 + OpenID Connect (authorization code + PKCE). It is the modern standard: token rotation, refresh tokens, claims signed as JWTs.

In both cases Dokuflex never stores the password or the authentication factor: the session lives in your IdP and Dokuflex only receives the signed token.

CAS (Central Authentication Service)

CAS is the dominant standard in public universities, hospitals and government bodies across Spain and Europe. Dokuflex implements CAS 3.x as a client:

• Configuration of the cas-server-url.
• Service ticket validation via /serviceValidate.
• Attribute readout (department, role) from the CAS response.
• Federated logout (single sign-out) with notification to the CAS server.

If your organisation works with cl@ve, Cl@ve Firma, AutenticaIDP or other public-sector IdPs, they also integrate over federated SAML 2.0.

2FA / MFA: factors and policies

When the corporate IdP already enforces MFA (Entra ID Conditional Access, Google 2-Step), Dokuflex respects it without asking for a second factor on top. When it does not, Dokuflex applies MFA directly at login.

Supported factors:

• TOTP (RFC 6238): Google Authenticator, Authy, Microsoft Authenticator, 1Password, Bitwarden.
• WebAuthn / FIDO2: YubiKey, device passkeys (Touch ID, Windows Hello), Titan keys.
• SMS (with the caveats recommended by NIST for sensitive environments).
• Email OTP for external users without a corporate smartphone.
• Push notification from the Dokuflex mobile app.
• Digital certificate + eID as a second factor in signing operations.

Configurable policies: mandatory for administrators, conditional by role, by IP (internal without MFA / external with MFA), by action sensitivity (sign, export, approve > €X), and by session inactivity.

Automatic provisioning (SCIM 2.0) and JIT

Beyond login, Dokuflex syncs with your IdP in two modes:

• JIT (Just-In-Time): the user is created in Dokuflex automatically on first SSO login. Handy for SAML/OIDC with groups as claims.
• SCIM 2.0: proactive sync from Entra ID, Okta, OneLogin or Workspace. Creates, updates and deactivates users and groups in real time from the IdP, no manual intervention.

Combined: when HR offboards someone in Workday/SAP SuccessFactors, the change flows to the IdP and from there to Dokuflex within minutes. Zero orphaned access.

Regulatory compliance

Dokuflex SSO/MFA is designed to withstand audits for:

Every authentication, failed attempt, MFA factor change and policy update is recorded in Dokuflex's immutable log, exportable to your SIEM (Splunk, QRadar, Elastic, Sentinel) via syslog or API.

CISO checklist before rollout

• 1. Authoritative IdP chosen: Entra ID, Google Workspace or ADFS as the single source.
• 2. MFA enforced for administrators: mandatory, with WebAuthn/FIDO2 as the recommended primary factor.
• 3. Break-glass account: a local emergency account with strong MFA and usage logging, outside the IdP.
• 4. Role mapping validated: IdP groups ↔ Dokuflex roles documented and approved by the business.
• 5. SLO tested: signing out of the IdP also ends the Dokuflex session.
• 6. Logs wired into the SIEM: authentication events streamed to the security operations centre.
• 7. Session policy: token lifetime, re-authentication for sensitive actions, IP allowlist if applicable.

Frequently asked questions