During the single sign-on configuration process, you will need to perform certain actions on the single sign-on provider side.
This page explains the steps for Microsoft Azure AD.
The following steps are based on “Configuring Single Sign-On” under “4. Tasks in the Single Sign-On Provider.”
Configure Azure Active Directory
Log in to the Microsoft Azure management portal ( https://portal.azure.com/#home). Click “Azure Active Directory.”
Click “Azure Active Directory.”
Click “Enterprise applications.”
Click “New application.”
Click “Create your own application.”
In the “What’s the name of your app?” field, enter any name (e.g., Shifter-Azure-AD).
In the “What do you want your app to do?” section, select “Integrate other apps not found in the gallery (non-gallery),” then click the “Create” button.
It may take anywhere from a few tens of seconds to a minute for the creation to complete.
Add users to Azure Active Directory who will log in
Click “1. Assign users and groups.”
Click “Add user or group.”
Click “Users.”
Select the users you want to register, then click the “Select” button.
Click the “Assign” button.
Set up single sign-on with SAML
Click “Single sign-on.”
Click “Edit” under “Basic SAML Configuration.”
Configure each field as follows:
- Identifier (Entity ID): The value of the audience in the Shifter dashboard (a value starting with `urn:amazon:cognito`)
- Response URL (Assertion Consumer Service URL): The callback URL from the Shifter dashboard (a value starting with https://)
- Sign-in URL (optional): The login URL from the Shifter dashboard (a value starting with https://)
- Relay Status (optional): https://go.getshifter.io
- Logout URL (optional): https://go.getshifter.io
Click “Save.”
Download the “Federation Metadata XML” from “SAML Certificates.”
Settings for Registered Users
If the “User Principal Name” field in a registered user’s profile contains #EXT#, remove it. Follow these steps:
Click “Users.”
Click the target user.
Click “Edit properties.”
Delete the #EXT# set in the “User Principal Name” field.
Before deletion
After deletion
[Optional] Assign a specific role (administrator, editor, contributor) to a registered user
Click “Edit” under “Attributes and Claims.”
Click “Add new claim.”
Configure the following items:
- Name: systemrole
- Namespace: http://schemas.xmlsoap.org/ws/2005/05/identity/claims
- Source: Attribute
- Source Attribute: Set one of the following: Administrator, Editor, or Contributor
Save the settings.
[Optional] Specify the team to which registered users belong
Click “Edit” under “Attributes and Claims.”
Click “Add new claim.”
Configure the following fields:
- Name: systemteam
- Namespace: http://schemas.xmlsoap.org/ws/2005/05/identity/claims
- Source: Attribute
- Source Attribute: Enter the Team ID. If there are multiple, separate them with commas.
Save the settings.
That completes the steps on the Microsoft Azure side.
Next, configure single sign-on starting from “5. Operations on the Shifter Dashboard.”