SSO Configuration

SSO Configuration in Azure Active Directory

This article outlines the steps to follow to configure SSO in Azure Active Directory.

1) Register a new application from the Enterprise Application | All Applications screen in the Azure Active Directory portal: https://aad.portal.azure.com/#blade/Microsoft_AAD_IAM/StartboardApplicationsMenuBlade/AppAppsPreview/menuId/

2) Create a new non-gallery application. Including SSO or SAML in the name for this application can help to distinguish this from future GraphAPI applications for the same instance.

3) Once the application has been created and the configuration pages are visible, navigate to Single sign-on under the Manage section and select SAML.

4) Enate will supply an XML metadata file for each instance**. This can be imported using the “Upload metadata file” button at the top of the page.

**Note that since Test Mode uses a different url to the standard Live Mode url, you will need to perform additional setup for SSO to work in Test Mode (if you wish users to access Test Mode with SSO). See 'Update SAML Configuration to enable SSO in Test Mode' for how to do this.

5) Once imported, verify that the Identifier (Entity ID) and the Reply URL (Assertion Consumer Service URL) have been populated and the press Save.

6) On the Single sign-on page with the newly populated Basic SAML Configuration section, you should be able to download the Federation Metadata XML under section 3, SAML Signing Certificate.

Note: Enate typically uses the Email Address field configured for users within Enate to validate claims. This must match one of the supplied claims. User.userprincipalname or user.mail typically satisfy this but if you domain has multiple email addresses or situations where the userprincipalname may not always match the email address you may need to transform a claim to provide the correct information.

7) This downloaded XML file should be supplied to Enate to complete the Enate side of the SSO configuration prior to testing.

8) On the Properties page under the Manage section, you should change the “Visible to users?” setting to “No”.

9) Depending on your configuration you can also change the “Assignment required?” to “No” and then manually assign Users to the application under the Users and groups page under the Manage section.

Update SAML Configuration to enable SSO in Test Mode

Here are the steps to update your SAML configuration to enable SSO to run in Test Mode for a given Enate instance.

Note: These steps assume that Live mode SSO has already been configured

1. Sign in to the Microsoft Entra Admin Center.

2. Navigate to Identity → Applications → Enterprise Applications.

3. Select the application used for Enate SSO.

4. Go to Single Sign-On and select SAML.

5. Under Basic SAML Configuration, click Edit.

6. Add the Test Mode Identifier (Entity ID) under the Identifier (Entity ID) section.

Example: If live mode url is:

https://instancename.enate.app (Default)

then you should add

https://instancename.test.enate.app

as new identifier

1. Add the Test Mode Reply URL (Assertion Consumer Service URL) under the Reply URL section.

Example: If live mode url is:

https://instancename.enate.app/identity/e8dfge1f-9f8f-4464-93fd-b42369fdfb3c/saml2/Acs (Default)

then you should add an an additional entry with the Test mode url, i.e.

https://instancename.test.enate.app/identity/e8dfge1f-9f8f-4464-93fd-b42369fdfb3c/saml2/Acs as an additional new identifier

1. Verify that the existing Live Mode URLs remain unchanged.

2. Click Save to apply the changes.

3. Back in Enate, test SSO login to both Live Mode and Test Mode to confirm successful authentication.