diff --git a/packages/@okta/vuepress-site/conductor.yml b/packages/@okta/vuepress-site/conductor.yml index 93cf66e962c..4f5f5a9ce61 100644 --- a/packages/@okta/vuepress-site/conductor.yml +++ b/packages/@okta/vuepress-site/conductor.yml @@ -4626,47 +4626,57 @@ redirects: - from: /docs/guides/style-the-widget/next-steps/index.html to: /docs/guides/custom-widget/main/#see-also - from: /docs/guides/oin-oidc-guide/overview - to: /docs/guides/oin-sso-overview/ + to: /docs/concepts/sso-overview/ - from: /docs/guides/oin-oidc-guide/background - to: /docs/guides/oin-sso-overview/ + to: /docs/concepts/sso-overview/ - from: /docs/guides/oin-oidc-guide/protocol-level-requirements to: /docs/guides/build-sso-integration/openidconnect/main/#build-your-integration - from: /docs/guides/oin-oidc-guide/multi-tenancy - to: /docs/guides/oin-sso-overview/#okta-organization-and-multi-tenancy + to: /docs/concepts/multi-tenancy/#sso-app-integrations-and-multi-tenancy - from: /docs/guides/oin-oidc-guide/integration-best-practices - to: /docs/guides/oin-sso-overview/ + to: /docs/concepts/sso-overview/ - from: /docs/guides/oin-oidc-guide/next-steps - to: /docs/guides/oin-sso-overview/#next-steps + to: /docs/concepts/sso-overview/ - from: /docs/guides/oin-oidc-guide/overview/index.html - to: /docs/guides/oin-sso-overview/ + to: /docs/concepts/sso-overview/ - from: /docs/guides/oin-oidc-guide/background/index.html - to: /docs/guides/oin-sso-overview/ + to: /docs/concepts/sso-overview/ - from: /docs/guides/oin-oidc-guide/protocol-level-requirements/index.html to: /docs/guides/build-sso-integration/openidconnect/main/ - from: /docs/guides/oin-oidc-guide/multi-tenancy/index.html - to: /docs/guides/oin-sso-overview/#okta-organization-and-multi-tenancy + to: /docs/concepts/multi-tenancy/#sso-app-integrations-and-multi-tenancy - from: /docs/guides/oin-oidc-guide/integration-best-practices/index.html - to: /docs/guides/oin-sso-overview/ + to: /docs/concepts/sso-overview/ - from: /docs/guides/oin-oidc-guide/next-steps/index.html - to: /docs/guides/oin-sso-overview/#next-steps + to: /docs/concepts/sso-overview/ - from: /docs/guides/oin-oidc-best-practices/main - to: /docs/guides/oin-sso-overview/ + to: /docs/concepts/sso-overview/ - from: /docs/guides/oin-oidc-best-practices/main/index.html - to: /docs/guides/oin-sso-overview/ + to: /docs/concepts/sso-overview/ - from: /docs/guides/oin-oidc-best-practices/main/#rate-restrictions to: /docs/guides/build-sso-integration/openidconnect/main/#rate-limit-considerations - from: /docs/guides/oin-oidc-multi-tenancy/main - to: /docs/guides/oin-sso-overview/#okta-organization-and-multi-tenancy + to: /docs/concepts/multi-tenancy/#sso-app-integrations-and-multi-tenancy - from: /docs/guides/oin-oidc-multi-tenancy/main/index.html - to: /docs/guides/oin-sso-overview/#okta-organization-and-multi-tenancy + to: /docs/concepts/multi-tenancy/#sso-app-integrations-and-multi-tenancy - from: /docs/guides/oin-oidc-protocols/main to: /docs/guides/build-sso-integration/openidconnect/main/ - from: /docs/guides/oin-oidc-protocols/main/index.html to: /docs/guides/build-sso-integration/openidconnect/main/ - from: /docs/guides/oin-oidc-overview/main - to: /docs/guides/oin-sso-overview/ + to: /docs/concepts/sso-overview/ - from: /docs/guides/oin-oidc-overview/main/index.html - to: /docs/guides/oin-sso-overview/ + to: /docs/concepts/sso-overview/ + - from: /docs/guides/oin-sso-overview/ + to: /docs/concepts/sso-overview/ + - from: /docs/guides/oin-sso-overview/index.html + to: /docs/concepts/sso-overview/ + - from: /docs/guides/oin-sso-overview/#choose-your-sso-protocol + to: /docs/concepts/sso-overview/#choose-your-sso-protocol + - from: /docs/guides/oin-sso-overview/#okta-organization-and-multi-tenancy + to: /docs/concepts/multi-tenancy/#sso-app-integrations-and-multi-tenancy + - from: /docs/guides/oin-sso-overview/#tenants-in-okta + to: /docs/concepts/multi-tenancy/#tenants-in-okta - from: /docs/guides/third-party-risk-integration/overview to: /docs/guides/third-party-risk-integration/ - from: /docs/guides/third-party-risk-integration/overview/index.html diff --git a/packages/@okta/vuepress-site/docs/concepts/multi-tenancy/index.md b/packages/@okta/vuepress-site/docs/concepts/multi-tenancy/index.md index d1f73729c83..26bdf9caa1b 100644 --- a/packages/@okta/vuepress-site/docs/concepts/multi-tenancy/index.md +++ b/packages/@okta/vuepress-site/docs/concepts/multi-tenancy/index.md @@ -42,6 +42,20 @@ different types of data is shown below: +### Tenants in Okta + +In Okta, a tenant is represented as an Okta org. Each org is an isolated container that manages its own users, groups, and apps independently. Identity in Okta is scoped to the org, not globally unique across all of Okta. + +As an example, the same email address can exist as separate users in multiple orgs. For example, `alice.doe@example.com` can be a registered user in both `https://company1.okta.com` and `https://company2.okta.com` with different profile data in each. When building an app that serves multiple tenants, track which org authenticated a given user. You can't assume that profile data is consistent across orgs. + +Okta orgs host their interfaces through individual subdomains and each org is assigned a separate URL. The typical org URL is the tenant name (the subdomain) followed by the domain name. However, you can customize the domain name for your own domain and add individual aliases for each of your tenants. + +## SSO app integrations and multi-tenancy + +SSO app integrations are multi-tenant by design. Each customer (the organization deploying the SSO app) operates through a separate Okta org, and each org is a distinct tenant. The org serves as the identity provider (IdP) for that customer's users. For OpenID Connect (OIDC) integrations, the org acts as the authorization server. For SAML integrations, the org acts as the IdP. + +Because each org manages its own users, policies, and application access independently, a single app integration can serve multiple customers without their data or configurations affecting one another. + ## Why would you want more than one tenant An organization can create a tenant for various reasons. For example @@ -107,7 +121,7 @@ platform is ultimately decided by the customer. Okta offers four main configurations for multi-tenancy. They are: * [Configuration 1: Host tenants in a single org using Universal Directory (UD)](#configuration-1) -* [Configuration 2: Host tenants in separate orgs (for example, hub-and-spoke](#configuration-2) +* [Configuration 2: Host tenants in separate orgs (for example, hub-and-spoke)](#configuration-2) * [Configuration 3: Mixed. Host tenants in both single and separate orgs](#configuration-3) * [Configuration 4: Host tenants in a single org not using UD](#configuration-4) diff --git a/packages/@okta/vuepress-site/docs/concepts/sso-overview/index.md b/packages/@okta/vuepress-site/docs/concepts/sso-overview/index.md index 1196d3b39e1..48e83dfb27b 100644 --- a/packages/@okta/vuepress-site/docs/concepts/sso-overview/index.md +++ b/packages/@okta/vuepress-site/docs/concepts/sso-overview/index.md @@ -28,7 +28,7 @@ When you implement SSO, you let a central IdP handle authentication for you. SSO ## How Okta supports SSO -Okta is a cloud-based identity and access management (IAM) platform that acts as the centralized IdP for your users. Okta provides SSO integrations for thousands of cloud, on-premises, and mobile apps. The platform uses standard protocols such as OIDC, SAML, and SWA to maintain these integrations. +Okta is a cloud-based identity and access management (IAM) platform that acts as the centralized IdP for your users. Okta provides SSO integrations for thousands of cloud, on-premises, and mobile apps. The platform uses standard protocols such as OIDC, SAML, and SWA to maintain these integrations. Okta also handles user verification, multifactor authentication (MFA), and lifecycle management, providing a robust and secure foundation for your app. A user's SSO experience with Okta can happen in a few different ways: @@ -41,6 +41,18 @@ A user's SSO experience with Okta can happen in a few different ways: In these scenarios, the user only has to remember a single credential, which is managed securely by Okta. +## Choose your SSO protocol + +Okta supports two protocols for handling federated SSO: OpenID Connect (OIDC) and Security Assertion Markup Language (SAML). The SSO protocol that you choose to implement your app integration with is based on your app and use case. For new app integrations, OIDC is recommended. + +|   | ![OIDC](/img/idp-logos/oidc.png) OIDC | ![SAML](/img/idp-logos/saml.png) SAML | +| ------ | :------------------- | :----------------------- | +| **Description** | [OpenID Connect](/docs/concepts/oauth-openid/#openid-connect) extends OAuth 2.0 to provide an ID token that can be used to verify a user’s identity and sign them in to a cloud-based app. It's quickly becoming the new standard for SSO. | [Security Assertion Markup Language (SAML)](/docs/concepts/saml) is a traditional enterprise protocol for SSO in web apps. Okta supports SAML 2.0. | +| **Benefits** | | | +| **Technology** | | | +| **Resources** | | | +| **Get started** | | | + ## SSO, Single Logout (SLO), and Universal Login With SSO in Okta, a user authenticates once with Okta (the IdP) and can seamlessly access multiple apps, using federation protocols like SAML, OIDC, or WS-Fed. [​Single Logout (SLO)](/docs/guides/single-logout/saml2/main/) extends this by allowing a sign-out action from one app to propagate back to the IdP and, in turn, notify other connected apps to terminate their sessions. However, as SLO relies on each app’s protocol support, the sign-out experience can be inconsistent. @@ -51,5 +63,4 @@ Universal Logout addresses these inconsistencies by creating a more reliable, ce The Okta Integration Network (OIN) is a catalog of pre-built integrations with thousands of apps. You can easily integrate Okta SSO to apps with a guided experience that still supports the most secure configuration options. -For information on SSO integrations in the Okta Integration Network (OIN), see [Overview of Single Sign-On in the OIN](https://developer.okta.com/docs/guides/oin-sso-overview/). - +For information on SSO integrations in the Okta Integration Network (OIN), see [Publish an OIN integration](/docs/guides/submit-app-overview/). diff --git a/packages/@okta/vuepress-site/docs/guides/create-an-app-integration/main/index.md b/packages/@okta/vuepress-site/docs/guides/create-an-app-integration/main/index.md index 527047de9ed..e3fd11d9816 100644 --- a/packages/@okta/vuepress-site/docs/guides/create-an-app-integration/main/index.md +++ b/packages/@okta/vuepress-site/docs/guides/create-an-app-integration/main/index.md @@ -52,7 +52,7 @@ The following table summarizes the key differences: ### Supported protocols -Okta app integrations support standard protocols for both [SSO](https://developer.okta.com/docs/guides/oin-sso-overview/) and automated user provisioning: +Okta app integrations support standard protocols for both [SSO](/docs/concepts/sso-overview/) and automated user provisioning: * [OpenID Connect (OIDC)](https://developer.okta.com/docs/concepts/oauth-openid/): Authentication protocol based on OAuth 2.0, which enables secure SSO and supports advanced security features. * [Security Assertion Markup Language (SAML)](https://developer.okta.com/docs/concepts/saml/): An XML-based protocol for exchanging authentication and authorization data between Okta and external apps. diff --git a/packages/@okta/vuepress-site/docs/guides/index.md b/packages/@okta/vuepress-site/docs/guides/index.md index 4b1c3ad1f38..11a9f99008c 100644 --- a/packages/@okta/vuepress-site/docs/guides/index.md +++ b/packages/@okta/vuepress-site/docs/guides/index.md @@ -295,7 +295,7 @@ You can publish your integration in the Okta Integration Network (OIN) catalog t If you're creating an Okta integration for the first time, Okta recommends the following sequence of guides: 1. [OIN landing](/docs/guides/okta-integration-network/) -1. [Overview of Single Sign-On in the OIN](/docs/guides/oin-sso-overview/) +1. [What is Single Sign-On (SSO)?](/docs/concepts/sso-overview/) 1. [Overview of lifecycle management in the OIN](/docs/guides/oin-lifecycle-mgmt-overview/) 1. [Overview of API service apps in the OIN](/docs/guides/oin-api-service-overview/) 1. [OIN submission requirements](/docs/guides/submit-app-prereq/) diff --git a/packages/@okta/vuepress-site/docs/guides/oin-sso-overview/index.md b/packages/@okta/vuepress-site/docs/guides/oin-sso-overview/index.md deleted file mode 100644 index 0c5fd3125d0..00000000000 --- a/packages/@okta/vuepress-site/docs/guides/oin-sso-overview/index.md +++ /dev/null @@ -1,108 +0,0 @@ ---- -title: Overview of Single Sign-On in the OIN -meta: - - name: description - content: Provides a high level overview of Single Sign-On app integrations for the Okta Integration Network. ---- - -The Okta Integration Network (OIN) is a collection of over 7000 pre-built app integrations to connect and exchange secure authentication between users, devices, and apps. Customers can easily integrate Okta Single Sign-On (SSO) to apps with a guided experience that still supports the most secure configuration options. - -To get your app integration into the OIN: - -1. [Build an app integration](/docs/guides/sign-in-overview/main/) using a free [Okta Integrator Free Plan org](https://developer.okta.com/signup/) and any of the wide array of [languages and libraries](/code/) supported by Okta. -1. [Submit your app](/docs/guides/submit-app-overview/) integration for verification and approval by the Okta OIN team. - -Your integration is available in the OIN for the Okta community to use after Okta validates and publishes your app integration. - -After your customer adds your SSO app integration to their Okta org, their workforce can use their company-issued Okta credentials to securely access your app. In addition to email-password credentials, your customers can control their authentication experience with Okta sign-on policies and features. See the [Multifactor Authentication](https://help.okta.com/okta_help.htm?id=ext_MFA) and [Okta FastPass](https://help.okta.com/okta_help.htm?type=oie&id=ext-fp-enable) features. - -## Why build an SSO integration with Okta? - -|   |   | -| ------ | ------ | -| **Enhance security** | Integrating with Okta allows your customers to manage password strength and configure access policies for your apps. For example, they may require employees to use multifactor authentication (such as a push notification to their phone or SMS) to access your apps from an unknown device. | -| **Deliver a strong end user access experience** | Take away all the friction of managing usernames and passwords. After users authenticate through Okta, they can access your apps with a single click. | -| **Enterprise ready** | Your customers have a growing set of compliance needs that are continuously evolving. An Okta app integration helps you meet compliance and audit requirements and shortens sales cycles. | -| **Ease of adoption** | Your customers can add SSO to your OIN-published app integration with minimal effort. They use Okta to add and configure your app integration into their identity ecosystem without extensive support from your customer service resources. Their workforce can access your app within hours of configuring the integration and policies. | - -## Choose your SSO protocol - -Okta supports two protocols for handling federated SSO: OpenID Connect (OIDC) and Security Assertion Markup Language (SAML). The SSO protocol that you choose to implement your app integration with is based on your app and use case. For new app integrations, OIDC is recommended. - -|   | ![OIDC](/img/idp-logos/oidc.png) OIDC | ![SAML](/img/idp-logos/saml.png) SAML | -| ------ | :------------------- | :----------------------- | -| **Description** | [OpenID Connect](/docs/concepts/oauth-openid/#openid-connect) extends OAuth 2.0 to provide an ID token that can be used to verify a user’s identity and sign them in to a cloud-based app. It's quickly becoming the new standard for SSO. | [Security Assertion Markup Language (SAML)](/docs/concepts/saml) is a traditional enterprise protocol for SSO in web apps. Okta supports SAML 2.0. | -| **Benefits** | | | -| **Technology** | | | -| **Resources** | | | -| **Get started** | | | - -> **Note:** For specific OIDC and SAML protocol features not supported in the OIN, see [OIN submission limitations](/docs/guides/submit-app-prereq/main/#oin-limitations). - -### Okta organization and multi-tenancy - -In a typical scenario, your app relies on Okta to act as a multi-tenant Identity Provider (IdP) for your customers' Okta orgs. An [Okta org](/docs/concepts/okta-organizations/) acts as a container that sets hard boundaries for all users, apps, and other entities that are associated with a single customer. This provides tenant-based isolation. In developing your SSO app integration, the customer’s Okta org serves as the authorization server (OIDC) or as the IdP (SAML). - -#### Tenants in Okta - -Within Okta, the concept of a tenant is instantiated as an Okta org. The org is the home for all user identity and access management, such as user store, handling connections, and mapping profile information. Your Okta org is used to authenticate your users for your apps. - -In Google Cloud products, the user identity is globally unique across the entire identity namespace through their email address. By contrast, in Okta the unique identity concept is specific to just within the tenant used to authenticate and authorize. Code your app so that it's aware of what tenant is being used to authenticate that user. - -As an example, `alice.doe@example.com` is a registered Okta user in both company 1 and company 2 Okta tenants, accessed at `https://company1.okta.com` and `https://company2.okta.com`. Your app aims to provide different services for users that are specific to each tenant. You can't assume that the user information is identical for a given user across both tenants. Your app needs to manage user credentials to identify each unique combination of user and tenant. - -Okta orgs host their interfaces through individual subdomains and each org is assigned a separate URL. The typical org URL is the tenant name (the subdomain) followed by the domain name. However, you can customize the domain name for your own domain and add individual aliases for each of your tenants. - -> **Note:** The process for specifying the variable app instance names in an OIDC app is explained in [Submit an SSO integration with the OIN Wizard: Integration variables](/docs/guides/submit-oin-app/openidconnect/main/#tenant-settings). - -## Use case examples - -### Example of a partner integration journey with Okta - -Erika is an app developer at Acme, a technology partner with Okta. Acme is looking to use the OIN as a way for their customers to adopt and incorporate Acme’s app to the customer’s existing Okta tenant. This allows Acme’s customers to add Acme’s app to their existing identity infrastructure with minimal integration resources. - -Erika performs the following tasks: - -* Builds the Acme-Okta integration, doing the heavy lifting so that their customers don’t have to -* Documents the required configuration steps for the customer admin -* Submits the app integration and corresponding documentation for the Okta OIN team to verify and review - -After approval, Acme’s app is published to the OIN. With a pre-built Acme-Okta integration, Acme avoids the extra support staff required for each individual customer integration. - -### Example of an identity admin journey with Okta - -Ali is an IT admin at Initech. Initech is looking to add Acme's app into their existing Okta identity infrastructure. - -Ali performs the following tasks: - -* Finds the Acme app in the OIN catalog. Since Acme is in the OIN, Ali knows that he can trust Acme to be securely incorporated into their existing Okta-managed SSO with minimal effort. -* Adds the Acme app integration from the Admin Console -* Follows the instructions provided by Acme to configure the app integration -* Configures the Okta app sign-in policy and the group of Initech employees who have access to the Acme app -* Tests signing in to the Acme app with existing Okta credentials to verify the authentication flow - -Initech's group of employees with privileges can sign in to the Acme app with their existing Okta credentials. No additional Acme app registration is required. - -### Example of an enterprise user Single Sign-On journey with Okta - -Ramon is an Initech employee with access to the Acme app. Follow his SSO journey: - -* Ramon starts his work day. In his web browser, he clicks the Okta browser extension and selects his email app, which loads in a new tab. -* Initech has an Okta global session policy, which requires each employee to verify their identity every 12 hours. Since it’s been more than 12 hours since he last worked, Ramon is prompted to enter his Okta username and password. -* Initech has also enabled Okta multifactor authentication. After Ramon successfully entered his credentials, a push notification is sent to the Okta Verify app on his phone. Ramon taps his phone to verify his identity. He can now access his email. -* Next, Ramon goes to his Okta browser extension and selects the Acme app. Since he started a session less than 12 hours ago, he has access to the app without needing to sign in again. Ramon can access all the Okta-integrated apps that he has privileges to without signing in again because he already has an authenticated session with Okta. - -## Next steps - -Ready to get started? Choose how you want to implement your SSO app integration: - - -Build an Okta SSO integration with OIDC - -Build an Okta SSO integration with SAML - -
- -After your app integration is built, [submit the integration](/docs/guides/submit-app-overview/) to the Okta OIN team for verification and publication. - -Want to automate even more for your customers and increase adoption of your product? Learn more about [lifecycle management integration](/docs/guides/oin-lifecycle-mgmt-overview/) in the OIN. diff --git a/packages/@okta/vuepress-site/docs/guides/submit-app-prereq/main/index.md b/packages/@okta/vuepress-site/docs/guides/submit-app-prereq/main/index.md index b30f469b0ec..bec72951f5d 100644 --- a/packages/@okta/vuepress-site/docs/guides/submit-app-prereq/main/index.md +++ b/packages/@okta/vuepress-site/docs/guides/submit-app-prereq/main/index.md @@ -45,7 +45,7 @@ Your app integration must support multi-tenancy to be listed in the public OIN c What does this mean? -Multi-tenancy in the OIN refers to the concept that as an ISV, you support several instances of your app. Each app instance has a unique credential system for each of your customers. An instance of an app that contains the infrastructure to support a group of users is considered a tenant. See [Tenants in Okta](/docs/guides/oin-sso-overview/#tenants-in-okta). +Multi-tenancy in the OIN refers to the concept that as an ISV, you support several instances of your app. Each app instance has a unique credential system for each of your customers. An instance of an app that contains the infrastructure to support a group of users is considered a tenant. See [Tenants in Okta](/docs/concepts/multi-tenancy/#tenants-in-okta). Provide a method for each of your customer tenants to uniquely connect to their Okta org. This allows your customers to find your app integration from the OIN catalog in their own Okta org. Then, they can instantiate the app integration with their unique tenant credentials, either with your support or on their own. diff --git a/packages/@okta/vuepress-site/docs/guides/submit-oin-app/main/openidconnect/protocol-supported.md b/packages/@okta/vuepress-site/docs/guides/submit-oin-app/main/openidconnect/protocol-supported.md index de16ba3806b..0d8286e25f7 100644 --- a/packages/@okta/vuepress-site/docs/guides/submit-oin-app/main/openidconnect/protocol-supported.md +++ b/packages/@okta/vuepress-site/docs/guides/submit-oin-app/main/openidconnect/protocol-supported.md @@ -12,6 +12,8 @@ This guide covers submissions that use the following protocols and integrations: * [Universal Logout](/docs/guides/oin-universal-logout-overview/) +See [Choose your SSO protocol](/docs/concepts/sso-overview/#choose-your-sso-protocol) for help choosing the right protocol for your app integration. + > **Notes:** > * Universal Logout integrations are only supported for the SAML 2.0 and OIDC protocols. If you want to submit a Universal Logout integration with SCIM provisioning, you must also submit an SSO integration with either SAML 2.0 or OIDC. > * Entitlement Management is supported for integrations that manage entitlements through a SCIM server. diff --git a/packages/@okta/vuepress-theme-prose/custom-landings/OktaIntegrationNetwork/components/Explore.vue b/packages/@okta/vuepress-theme-prose/custom-landings/OktaIntegrationNetwork/components/Explore.vue index e02617edc72..f2aaf61be77 100644 --- a/packages/@okta/vuepress-theme-prose/custom-landings/OktaIntegrationNetwork/components/Explore.vue +++ b/packages/@okta/vuepress-theme-prose/custom-landings/OktaIntegrationNetwork/components/Explore.vue @@ -56,7 +56,7 @@ caption: 'Design & build', text: 'OIN is a catalog and a support system. View SSO, lifecycle, and service app integration guides to help you to design, build, and test your integration before you submit it for verification. Get support from the Okta Developer Forum during your build journey.', link: 'Start with SSO', - path: '/docs/guides/oin-sso-overview/' + path: '/docs/concepts/sso-overview/' }, { id: 3, diff --git a/packages/@okta/vuepress-theme-prose/custom-landings/OktaIntegrationNetwork/components/Features.vue b/packages/@okta/vuepress-theme-prose/custom-landings/OktaIntegrationNetwork/components/Features.vue index b86de6e29bc..b68443dd2e7 100644 --- a/packages/@okta/vuepress-theme-prose/custom-landings/OktaIntegrationNetwork/components/Features.vue +++ b/packages/@okta/vuepress-theme-prose/custom-landings/OktaIntegrationNetwork/components/Features.vue @@ -102,7 +102,7 @@ id: 1, title: 'Enable Single Sign-On', text: 'Let users securely sign in to your app with their credentials.', - link: '/docs/guides/oin-sso-overview/', + link: '/docs/concepts/sso-overview/', linkText: 'Get started with Single Sign-On', list: [ 'Streamline the sign-in flow',