Who can set up SSO with Microsoft Azure
This can be done by an Admin or an IT person in your company.
How to set up SSO with Microsoft Azure
Create an Application
To configure SSO for Microsoft Azure, you need to follow these steps to set it up properly.
Login to your Active Directory
Click on “Enterprise applications / New application” > “Create your own application”
Enter the name “Moss” for your App
Select “Integrate any other application you don’t find in the gallery (Non-gallery)”
Click “Create” at the bottom of the page (this may take a while)
Assign Users
Before you start assigning users make sure that you created an application with Microsoft Azure in the step before. In this step we will specify what users / user groups are allowed to login to the Moss app.
Create the application in the previous step
Click on “User and Groups”
Click on “Add user/group” and add single users or groups of users from the list.
Configuring SSO for the Moss application
By copying some parameters Azure can check if the expected service is going to use identity service.
Select “Single sign-on” and select “SAML”
In a separate tab open Moss > Click “Settings” > “SAML SSO”
Copy values from Moss “SP Entity ID” “SP ACS URL” and “SP Logout URL”
Paste them into the Active Directory settings (Section 1):
The entered values would look like this:
Scroll down and enter the Logout URL
Exposing user attributes
Next, you need to ensure needed user attributes are exposed to the Moss app.
In order to deliver that you need to edit section 2 of the SAML configuration in Azure:
The following attributes should be present. The fields should be populated automatically when the admin selects the appropriate parameters.:
Needed to match user to Moss account
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname - user.givenname
Needed for card creation
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/mobilephone - user.mobilephone
(OPTIONAL) for 3DS feature
3. Finally, the page would look like this:
How to set up SSO on the Moss platform
URLs allow initiation of SSO. Certificate ensures SSO requests could be trusted by Moss platform as originating from a proper Azure account.
You need to copy these information from the Microsoft Azure Active Directory to the corresponding Moss SSO fields.
Login URL
Entity ID and certificate
2. Open Moss and click “Settings” > “SAML SSO”
3. Paste the information into the corresponding fields
4. Click “Save” (bottom of the page) and finally enable SSO by enabling the toggle button.