How
to configure Azure Active Directory Federated Single Sign On (SSO) for
BuyOnline portal
Background
To simplified user authentication process
and improve user experiences on BuyOnline, we are enabling Single Sign On (SSO) features by leveraging
Azure Active Directory (AAD).
There are 2 main components involved to
enable SSO features on BuyOnline, first is on the application itself which is
written on JAVA and secondly on Azure Active Directory (AAD) as Identity
Provider (IdP)
This document will only cover the second
part which is how to configure SSO for BuyOnline website in Azure Active
Directory.
Please follow the below steps:
1. Create
a Group
Group is used for a logical grouping of
BuyOnline users for example a staff, volunteer, etc.
How to create a group in AAD:
Step 1:
After sign-in to Azure portal, navigate to
Azure Active Directory -> Users and Groups -> All Groups -> + New
Group
Step 2:
Add group for example, volunteer and set
membership to “Assigned” and give a description.
Step 3:
Assigned user to a group, click “Members”
on the group screen and follow the instruction.
2.
Registering BuyOnline on Azure Active Directory (AAD)
To establish authentication from BuyOnline
to AAD, we have to register the website in AAD.
Step 1: Create New Application
After sign-in to Azure portal, navigate to
Azure Active Directory -> Enterprise Application -> All Applications
-> + New Application
Step 2: Add Non-Gallery Application
Choose “Non-Gallery Application” -> Key
In the Name for example buyonline_test for test system and buyonline for
production.
Step 3: Configuring SSO
On the application settings screen,
navigate to “Single Sign-On”
Set SAML-based Sign-On on the Single
Sign-on Mode.
Identifier:
TEST: Ananda Please supply the URI
PRODUCTION: Ananda Please supply the URI
Reply URL:
TEST: Ananda Please supply the URI
PRODUCTION: Ananda Please supply the URI
User Identifier: user.userprinciplename
“tick” on
View and edit all other user attributes and “add attribute”
Name: userid
Value: user.userprincipalname
Namespace: http://schemas.microsoft.com/ws/2008/06/identity/claims
3.
Create Role for BuyOnline
For authentication purpose, a “manager”
role has to be created in the system.
Step 1: Adding Manager Role on Application
Manifest
Navigate to Azure Active Directory ->
App Registrations –> Click on the application name e.g BuyOnline -> Click
Manifest
Append AppRoles section by addition the
below code snippet and click save.
{
"allowedMemberTypes": [
"User"
],
"displayName": "manager",
"id": "d1c2ade8-98f8-45fd-aa4a-6d06b947c66f",
"isEnabled": true,
"description": "Its
a Manager",
"value": "manager"
}
Step 2: Assign Role to the User Group
Navigate to Azure Active Directory ->
Enterprise Applications -> All Application -> Select your application
-> Users & Groups
Assign user group to the role by clicking
“+ Add user”
Select the group and assigned “manager”
role.
------------------------------------ END
-------------------------------------------
