Build your first journey in Identity Orchestration

Identity Orchestration (IO) runs your user journeys: sign-in, registration, password reset, account recovery and API flows. You build each journey as a flow: a graph of nodes that you connect in the flow designer. Each node does one thing, such as show a page, call an API or check a condition. Each node has named outputs (ports), and you connect every output to the next step.

In this guide you build a small login flow. It shows a form, checks the username and password, and ends in success or failure:

Flow - Start Login ─NotAuthenticated→ Frontend - Form ─Submit→ Authenticate User ─Success→ End Success
                                                                                  └─(every other output)→ End Failure

You need an administrator account with access to IO in the admin console. The guide uses the built-in Login flow type, which is the quickest way to learn the designer.

1. 1

   Open the Authentication category

   Select Identity Orchestrator in the left menu, then Authentication.

2. 2

   Add a flow

   Select Add. Set Flow Type to Login, the name to My first login, and a short description.

3. 3

   Start from an empty canvas

   Under Initialize, choose to create an empty flow, then select Add. The designer opens.

1. 1

   Add the start node

   Select Add Node and drag Flow - Start Login onto the canvas. It has three outputs: NotAuthenticated (no sign-in session yet), AlreadyAuthenticated (the user already has a session) and Failure.

2. 2

   Add the form

   Drag a Frontend - Form node onto the canvas. It comes with Username and Password fields. Connect the start node's NotAuthenticated output to the form.

3. 3

   Give the form a submit output

   Open the form. In the Variable Output Table, add a row with Submit Element ID login and output Submit. The form now has a Submit output next to Failure.

4. 4

   Save what the user typed

   On Save in the flow store, select both fields, set the variable name to login, and turn frontend available off. Later nodes read {{login.username}} and {{login.password}}. With frontend availability off, the password never goes back to the browser.

5. 5

   Add Authenticate User

   Drag Authenticate User onto the canvas and connect the form's Submit output to it. Bind the user by username with the value {{login.username}}, and set the password to {{login.password}}.

6. 6

   Add the end nodes

   Add Flow - End Success Login and Flow - End Failure Login. End Success creates the user's sign-in session. Its session lifetime and idle time are in minutes.

An output that fires without a connection stops the run with an error, and the user's session is lost. So connect every output, including the ones you don't expect to fire. Authenticate User has seven:

Then open the settings menu (gear icon, bottom right) and select Save Flow.

1. 1

   Copy the flow URL

   In the designer's settings menu, or in the flow's row in the list, select Copy Flow URL. Flow URLs have this shape:

https://{tenant-host}/io/flow/{category}/{flow-type}?domain_id={domain-id}&flow_id={flow-id}

1. 1

   Open it in a private browser window

   A private window starts without an old sign-in session, so you see the form.

2. 2

   Try each path

   Sign in with a valid user. Then try a wrong password, an unknown username and empty fields. The last three must all show the same failure message.

3. 3

   Reload on each page

   A reload must never strand the user on an error. If it does, connect the page's Failure output to a step that shows the page again.

To test a flow that is inactive, use a debug link. Its normal URL doesn't run it.

1. 1

   Start a debug run

   In the flow list, select Debug in the flow's actions. Set the link's lifetime (TTL, in seconds) and the cookie domain. Optionally make it one-time use.

2. 2

   Set the debug cookie

   Select Start, then SET. This puts the debug cookie in your browser.

3. 3

   Open the link

   Copy the debug link and open it in the same browser.

1. 1

   Open the flow settings

   In the flow list, select the pencil icon next to the flow.

2. 2

   Turn it on

   Select Active.

3. 3

   Make it the default only when it is ready

   Each flow type has one default flow: the one the platform runs for that journey. Selecting Default flow replaces the current default, so do it only after testing.

4. 4

   Save

   Select Save.

To roll back, make the previous flow the default again. Keep the old flow until the new one has run in production for a while.

• Start sign-in journeys from your application through OneWelcome Access: Add sign-in to your application.
• Give every new journey its own flow type, and learn the node families: Flows and nodes.
• Move every secret, host and client ID into a vault: Vaults.
• Cap login retries, use one message for wrong username and wrong password, and style your error pages: Best practices.
• When something goes wrong: Troubleshooting.