Who can set up SSO with Microsoft Azure
This can be done by an Admin or an IT person in your company.
How to set up SSO with Microsoft Azure
Create an Application
To configure SSO for Microsoft Azure, you need to follow these steps to set it up properly.
Login to your Active Directory
Click on “Enterprise applications / New application” > “Create your own application”
Enter the name “Moss” for your App
Select “Integrate any other application you don’t find in the gallery (Non-gallery)”
Click “Create” at the bottom of the page (this may take a while)
Assign Users
Before you start assigning users make sure that you created an application with Microsoft Azure in the step before. In this step we will specify what users / user groups are allowed to login to the Moss app.
Create the application in the previous step
Click on “User and Groups”
Click on “Add user/group” and add single users or groups of users from the list.
Configuring SSO for the Moss application
By copying the parameters, Azure can check if the expected service is going to use identity service.
Click on “Single sign-on” and select “SAML”
In a separate tab open Moss > click on “Settings” > “SAML SSO”
Copy values from Moss “SP Entity ID” “SP ACS URL” and “SP Logout URL”
Paste them into the Active Directory settings (Section 1):
The entered values would look like this:
Scroll down and enter the Logout URL
Exposing user attributes
Next, you need to ensure that the needed user attributes are exposed to the Moss app.
In order to do that you need to edit section 2 of the SAML configuration in Azure:
The following attributes should be present. The fields should be populated automatically when the admin selects the appropriate parameters.:
Needed to match user to a Moss account
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname - user.givenname
Needed for card creation
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/mobilephone - user.mobilephone
Needed for 3DS (Optional - Alternatively users will need to fill in their phone number by themselves once they have access to Moss)
3. Finally, the page would look like this:
How to set up SSO on the Moss platform
URLs allow initiation of SSO. The certificate ensures SSO requests can be trusted by the Moss platform as originating from a proper Azure account.
You need to copy these information from the Microsoft Azure Active Directory to the corresponding Moss SSO fields.
Login URL
Entity ID and certificate
2. Open Moss and go to “Settings” > “SAML SSO” > "Edit configuration"
3. Paste the information into the corresponding fields
4. Click “Save” and finally enable SSO by enabling the toggle button.
