SSO - Microsoft Entra ID
Last updated
Last updated
To configure Microsoft Azure Entra ID as Identity Provider (Id) for Xygeni as Service Provider (SP), you should first contact Xygeni to request data needed to properly configure the SAML integration between Entra ID and Xygeni.
You must provide the following information to Xygeni:
IDP Sign on URL: URL of the Identity Provider (or IDP, Entra IDin this case) against which the Xygeni user is going to authenticate
Entity ID or Issuer: Globally unique name for an Identity Provider or a Service Provider, is a URI used to identify the issuer of a SAML request, response, or assertion
URL Metadata: URL Metadata is the discovery information that the IDP exposes, to securely interoperate
Signing Certificate : Allows the Service Provider (or SP, Xygeni in this case) to verify the authenticity of the SAML response
Once submitted above info to Xygeni, you will receive some information back needed to properly configure the integration. This information will contain:
SP Single Sign on URL: SP's URL that processes the SAML response, verifies and validates it.
Login to Azure Entra ID, go to Enterprise Applications and click on New application
A new page will open. Click on Create your own application.
Then, you can name your application and select “Integrate any other application you don’t find in the gallery (Non-gallery)”. Click on Create button.
Choose whatever name you prefer to identify your app (in our example we will use "xy1" ). Entra ID will redirect you to the workflow to create your SAML integration.
Click on option 2. Set up single sign on . A new page wiil open.
Select SAML and the main configuration page will open.
In Section 4 (Set up xy1) you will find the following information (you must provide to Xygeni):
Login URL : a.k.a. IDP Sign on URL, URL of the Identity Provider (or IDP, Entra ID in this case) against which the Xygeni user is going to authenticate
Microsoft Entra identifier : a.k.a. Entity ID or Issuer, globally unique name for an Identity Provider or a Service Provider, is a URI used to identify the issuer of a SAML request, response, or assertion
In Section 3 (SAML Certificates) :
App Federation Metadata URL : a.k.a. URL Metadata, the discovery information that the IDP exposes, to securely interoperate
Certificate (Base64) : a.k.a. Signing Certificate, it allows the Service Provider (or SP, Xygeni in this case) to verify the authenticity of the SAML response
Copy the above information, download the Signing Certificate and send it to Xygeni.
CAUTION: In order to save the created app, you must enter required info in Section 1. You can enter some dummy values that will be modified later upon receiving proper values from Xygeni. Just to save it, you can provide some dummy values such as:
Identifier (Entity ID) (something similar to “20-xy1-azure”)
Reply URL (Assertion Consumer Service URL) (something similar to https://api.xygeni.io/sso/details/20-xy1-azure)
Once submitted above info to Xygeni, you will receive some information back needed to properly configure the integration. This information will contain:
Identifier (Entity ID) (something similar to “20-xy1-azure”)
Reply URL (Assertion Consumer Service URL) : SP's URL that processes the SAML response, verifies and validates it (something similar to https://api.xygeni.io/sso/details/20-xy1-azure)
Copy those values to Section 1 (Basic SAML Configuration)
Once it’s done, click on Edit in Section 2 (Attributes & Claims)
By default, the app will send user.userprincipalname as Unique User Identifier (Name ID).
IMPORTANT: Xygeni expects that value to be a valid (and existing) Xygeni user id (email). So, be sure that user.principalname contains a valid Xygeni user id (an email). If, for example, the valid Xygeni user id (email) would be in other user metadata, such as user.othermail, click on the three dots to change it
And select the proper field in the Source attribute field.
IMPORTANT: The username of Entra ID must already be an existing Xygeni user !!
Do not forget to assign people to your just created integration app. To do it, select the Users and Groups tab and include people/groups as needed.
Once you have sent to Xygeni the above information, and updated with the values that Xygeni sent back to you, you are able to test the application integration.
To do it you can go to Xygeni login page ( https://in.xygeni.io/auth/login ) and after specifying your login name you will be presented to a page where you can enter your password or click on the Azure AD button.
If you click on Azure AD button, you will be redirected to Azure AD login page. Once authenticated in Azure AD, your browser will be redirected to the Xygeni dashboard.
Alternatively, you can also login to Xygeni from Entra ID. To do it, just select your App and click on the Test button in Section 5. You will be redirected to the Xygeni dashboard without any further authentication.
