E3 - How to configure an Account SSO (Azure)

E3 - How to configure an Account SSO (Azure)

Azure Panel

1. Login to your Azure account
2. Open the Microsoft Entra ID service
3. In the left sidebar, click on Enterprise application
4. Click on Create a New application
5. Then Create your own application
6. Fill the What's the name of your app?
   (suggest using E3 APP)
7. In the What are you looking to do with your application?, select the last one Integrate any other application you don't find in the gallery (Non-gallery)
   
8. In the left sidebar, click on Single sign-on
9. Then click on SAML
   
10. Click on Edit in the Basic SAML Configuration card
11. In the Identifier (Entity ID), use your domain + your app name
    (example: yourdomain.com/e3-app)
12. Reply URL (Assertion Consumer Service URL) put: https://admin.e3.software/api/auth/sso/login
13. Click on Save and close the modal
14. Click on Edit in the Attributes & Claims card
15. Delete all existing Additional claims (clicking on the “…” at the end of each table row)
16. Add new claims

* If you are already using the user's officelocation attribute, you can choose another attribute that is not being used.

1. Go back to the Single Sign-On page (don't close this page opened, we will need to copy some data in the next steps)

E3 Admin

1. Go to Accounts
2. Create or edit your if already have one
3. Go to the Integration(s) tab
4. Click on the Settings in the Single Sign-On (SSO) card
5. Active Enable and Show toggles
   
   
6. In the Single Sign-On page, Basic SAML Configuration card
   • Copy the Identifier (Entity ID)
   • Past in the Account -> SAML Issuer
7. In the Single Sign-On page, SAML Certificates card, Download the Certificate (Base64)
   • Edit the file and copy the content (should start with -----BEGIN CERTIFICATE-----)
   • Past the content in the Account -> SAML Verification Certificate
8. In the Single Sign-On page, Set up E3 APP card
   • Copy the Login URL
   • Past in the Account -> SAML Login URL
9. In the Single Sign-On page, search in the sidebar and open the Overview
   • Copy the Application ID
   • Past in the Account -> SAML Application ID
10. In the Account page, click on Save

Mapping Default Roles

1. In the settings modal of Single Sign-On page, activate the Emergent 3 Only toggle, and click in mapping
2. All account groups will be listed.
3. You can fill a new identity to your groups. It can be used to set groups to a user in the e3groups attribute
4. Choose the default role that new users will receive on login
5. Click on Save

Azure Users

When configuring your Microsoft users, you will use the source attribute of e3groups (office location in the example case) to set e3 groups to this user.

The attribute can have one group or multiple groups. If the field has multiple groups, the delimiter to make that possible will be ; (semicolon).

You can use the group name or the identity (set up on the mapping).

The user will be assigned to a default role set up using the mapping feature; if the group is a child group and does not have a default role, then the role will default to the parent group’s default role.

John will be added to the "Group Test” and “Other Group” groups with the default roles set up in the mapping step.

If there is no default role in the parent group or in the group, then the user will be added to the group without any role.

SSO users only will be auto-added to groups in the first login, if you need to add more groups to an existing user, you can do it directly in the User(s) tab on the group's page.