Azure Active Directory

This article shows how to configure Azure Active Directory (Azure AD) as the identity provider for single sign-on (SSO) on Sifflet.

To set up SSO in Azure, follow these steps:

• Configure your Identity Provider (IdP)
• Configure the SSO in Sifflet
• Test your SSO

📘

Requirements

To enable SSO in Sifflet, you need:

• a Sifflet admin account
• an Azure admin account with the same email address as the one used in Sifflet

1- Configure Your Identity Provider

To configure your IdP, follow these steps:
a. Log in to Sifflet and retrieve some SSO details
b. Add the Sifflet App in Microsoft Azure

a. Retrieve the SSO Details in Sifflet

• Connect to Sifflet with an admin account
  • Go to Settings > SSO > Enable single sign-on (SSO)
  • Choose your Platform (Azure Active Directory here)
  • Save the information under "Sifflet service provider details". You need it in the next section.

b. Create a Dedicated Application for Sifflet on Azure AD

Create your Sifflet application on Azure; to do so, follow the steps below or Microsoft's guide. Note that Microsoft's guide skips the (first) creation step of the application.

• Log in to Microsoft Entra Admin Center
• Create an application: Identity > Applications > Enterprise Applications > New application
• On the next screen, you can add the App:
  • Set up a name, for instance "sso-sifflet"
  • “Integrate any other application you don't find in the gallery (Non-gallery)”
  • “Create”
• Within the registered app, click on the 'Single sign-on' tab.
  • Click SAML > Edit. Locate the parameters below, and fill them with the values previously saved in Sifflet.
    • Identifier (Entity ID): use the Audience restriction value, e.g. https://{tenant}/api/login/saml2/service-provider-metadata/saml2
    • Reply URL: use the Single Sign-On URL value, e.g. https://{tenant}/login/saml2/sso/saml2
  • Within the ‘Set up Single Sign-On with SAML’ page:
    • Add new claim
      • name = email
      • source attribute = user.mail
    • And do not forget to download the “Certificate (base64)”, which will be used later
  • Finally, you can add Users and Groups to your Azure application
    • To add users, within your application (e.g. sso-sifflet) click on 'Users and groups'
    • Assign the users and groups of your choice

2- Configure the SSO in Sifflet

Now, enter the details of the application you just created in Sifflet. On Sifflet's SSO enablement page (where you initially obtained the Audience restriction and the Single Sign-On URL), paste the following values from the application you created:

• Login URL
• Microsoft Entra Identifier, which you will place within Sifflet's Azure AD Identifier parameter
• Certificate (base64). Open the downloaded .cer file with a file editor and paste the content in Sifflet. Make sure to include the "-----BEGIN CERTIFICATE-----" and "-----END CERTIFICATE-----" strings within the file.

You can find these values here:

Paste them here in Sifflet:

3- Test Your SSO

• You can now test your SSO by pressing the "Test" button on the bottom right of the page.

• If successful, make sure to click "Save" to activate SSO.

The configuration is done.