Authentik integration

From Planfix

Integration with authentik lets your company employees sign in to Planfix with a single password via Single Sign-On (SSO). This simplifies authorization, increases security, and helps centrally manage employee access.

Supported features

  • IdP-initiated sign-in (SSO)
  • SP-initiated sign-in
  • Just-In-Time (JIT) user creation
  • SCIM Provisioning

SCIM Provisioning features

  • Create users
  • Update user data
  • Deactivate users

Single Sign-On (SSO) setup

Steps in Planfix

  1. Go to Account managеment - Integrations - Single Sign-On.
  2. Enable the authentik integration.
  3. Keep the integration settings window open: you will need the values for Audience, ACS URL (Assertion Consumer Service), SCIM URL and SCIM Token from it.

Steps in authentik

  1. Open the authentik admin panel.
  2. Go to Applications - Applications.
  3. Click New Application.
  4. Provide application details, for example:
    • Name: Planfix
    • Slug: planfix
  5. On the provider selection step choose SAML Provider.
  6. In the SAML provider settings, enter the values from the Planfix integration window:
Field in authentik Value
ACS URL Copy the ACS URL (Assertion Consumer Service) from Planfix
Audience Copy the Audience from Planfix
  1. Create the application and provider.
  2. In the provider settings on the Metadata tab, copy the SAML provider metadata URL from authentik.

Steps in Planfix

  1. Return to the authentik integration settings in Planfix.
  2. In the Metadata URI field, specify the authentik SAML provider metadata URL:
https://<authentik-domain>/application/saml/<application-slug>/metadata/

For example: 

https://auth.example.com/application/saml/planfix/metadata/
  1. Save the settings.

The Planfix sign-in page will now offer authentication via Authentik. When a new user signs in for the first time, Planfix will automatically create their account using JIT Provisioning.

SCIM Provisioning setup

SCIM Provisioning is required if you need to automatically create, update, and deactivate employees in Planfix based on data from Authentik.

Steps in authentik

  1. Go to Applications - Providers.
  2. Create a new provider of type SCIM Provider.
  3. In the SCIM provider settings, specify:
Field in authentik Value
SCIM Base URL SCIM URL from the Planfix settings
Authentication Mode Token
Token SCIM Token from the Planfix settings
  1. Open the Planfix application in authentik.
  2. In the Backchannel Providers field add the created SCIM provider.
  3. Save changes.

After configuration, authentik will synchronize users with Planfix. Make sure users that should be provisioned to Planfix have access to the Planfix application in authentik.

Integration check

  1. Ensure SSO integration with authentik is enabled in Planfix.
  2. Ensure an application Planfix with a SAML provider is created in authentik.
  3. Verify that ACS URL and Audience in authentik match the values from Planfix.
  4. Verify that the correct authentik Metadata URI is specified in Planfix.
  5. Grant a user access to the Planfix application in authentik.
  6. Sign in to Planfix via authentik.
  7. If SCIM is used, verify user creation or update in Planfix after synchronization.

Important

  • If the SSO only authentication option is enabled, employees will be able to sign in only via SSO, except for employees on the exception list and the Primary Account Admin.
  • If SCIM Provisioning is not enabled, deactivating a user in authentik will not automatically deactivate the employee in Planfix. In that case, you must deactivate the employee manually.
  • When an employee is created via JIT Provisioning or SCIM Provisioning, if the account reaches the user limit, the subscription will be automatically extended by reducing the remaining paid subscription period for the account.
  • If an employee is deactivated via SCIM Provisioning, the number of paid extra seats in the subscription will be reduced automatically.


Go To