search
SSO configuration Guide for Azure

Last Updated:

SSO Configuration for Beamery

The following steps are to enable single sign-on for Azure AD accounts with the Beamery production and Sandbox systems

Prerequisites :

  • Azure administrator or Global Administrator privileges
  • Access to a secure file transfer (Excluding Zoom, Dropbox or other third party file transfer system)
  • Beamery admin support to upload Metadata and certificates into Beamery system
  • SAML configuration identifiers supplied by the external party/provider

Steps

Step 1: Access Azure AD to create SSO application

    • Browse to https://aad.portal.azure.com
    • Select ‘Enterprise Application’
    • Select ‘ + New application’
      e15c321a-99a7-4a93-8a17-3f70956a0516.png
    • Select ‘ + Create your own application’
    • Enter the name of the application using the naming convention
      “DDIE – “ + System name + “SSO” + Instance e.g. “DDIE – Beamery SSO sandbox”

71f6d105-2636-4a57-8499-aa3b186e7d6d.png

Step 2: Assign Users to access this SSO

      • In the AAD portal select ‘Enterprise Applications’ and search for the name of the application used above
        256f0acb-6c73-44c6-9fed-8d77dd13e77c.png
      • Select ‘User and groups’, the current members will be displayed
      • To delete a user , select the name and click on ‘Remove’
      • To add a user of group, select ‘+ Add user/group’
      • Click on ‘None Selected’
      • Use the search box to find and select user names or group names, once complete click on ‘Select’
      • Once all users and group have been selected, click on assign

3c7a5727-6792-41f9-a08e-401ecd570d02.png

Step 3: Setup Single sign-on

  • In the AAD portal, open the enterprise app and select ‘Single Sign-on
    88eaf946-4b4c-4edb-9482-d61ccc3cb6dd.png
  • Choose the SO method required, for this example ‘SAML’ is the default

  • Basic SAML configuration

    • Select ‘Edit’ in the SAML config section
      a1864620-fa96-4e67-b561-bf9dd52f744e.png
    • The two mandatory values are ‘Entity ID’ and ‘Assertion Consumer Service URL
      744ca3c5-0417-4257-bf4e-e537cecac483.png
    • To update select ‘Add Identifier’ and enter the provided URL from the 3rd party
      7ed2ec3b-bcf7-4300-a341-5e6134f0ac14.png
    • repeat for Reply URL (note this can be the same as Identifier)
      • There are optional configuration URLs for sign-on, relay and logout
    • Select ‘Save’ once complete
      c7ec0d06-ac69-41d0-9bc2-7ce69e0f8b66.png

  • Attribute & Claims configuration
    • The default attributes are displayed and generally no change is required. In the event where the 3rd party requires a specific metadata attribute, this can be added or an existing one updated
    • Select ‘Edit’ in the ’Attributes & Claims’ section
  1.  

82cec3dc-f622-45a6-b86e-6391cd50e507.png

    • To add the required attribute ‘emailAddress’ (note the capital ‘A’), select ‘+ Add new claim’
    • Type Name as ‘emailAddress’ and Namespace as ‘http://schemas.xmlsoap.org/ws/2005/05/identity/claims’
    • In the ‘source attribute’ section select the dropdown and choose ‘user.mail’

5b4cb345-7b3f-4bdc-a7f6-3c58e0e224af.png

    • Select ‘Save’ to complete

  • Export SAML Metadata and certificates
    • In the ‘SAML sign Certificate ‘ section, select download beside ‘Federation Metadata XML’
  1.  

3b50b432-14e9-4930-a723-b80500d1d4aa.png

    • Save the file to a secure location and arrange to transfer the file to the 3rd party using a secure method. Do not use 3rd party ‘dropbox’ or similar.
    • The 3rd party may also require the ‘certificate (Base64)’ file, download and transfer as per above.
    • Once the 3rd party have installed the files, the SSO should now be available for testing.

Step 4: Testing SSO

    • Either use the inbuilt ‘Test option

764fa4e0-e0fe-4009-8de2-c66aab0a3165.png


or use a URL provided by the 3rd party

    • You will be prompted to enter your login ID, then the system should automatically connect without a password prompt
      Note: you must use a login ID that is included in the ‘Assigned User to Access SSO’ section, secondary login may not prompt for a login ID as the details are now cached.
    • It is recommended that you use the ‘Test’ option initially, if there is an error then a more detailed message will be provided

089eb39b-9055-46d6-b605-32837f413953.png