Overview
To integrate your cloud portals with your corporate Azure AD you need to carry out the configuration steps as described in this section.
Note that these are done only once, typically by an admin user of your Customer Portal having access to your Azure AD.
Once you have carried out these steps users sign in to any cloud-based service directly via your Azure AD, as described at Signing in the Bizagi Cloud Portals and Applications.
To configure your Identity Provider you must follow these steps:
1. Generate certificates to sign assertions (mandatory)
This step is not bound to Bizagi nor restricted by any special requirement of Bizagi (you normally do it yourself).
If you need some guidance or an example on this step, refer to Certificates for SAML 2.0 authentication.
To proceed with these guided steps, you need to have:
•One certificate to sign assertions (mandatory) in .P12 or .PFX file format. You need The password for the certificate file, as defined by you when you exported the public and private keys.
•One certificate to encrypt messages (optional) in .P12 or .PFX file format. You need The password for the certificate file, as defined by you when you exported the public and private keys.
|
You will need to be in charge of managing your installed certificates (keep track of its expiration date and other relevant maintenance aspects such as changes in your Identity Provider's endpoints). |
2. Configure the Enterprise Application in Azure AD
Do this in the admin options provided by Azure AD.
1.1 Log in to your Azure services with a user account with admin rights.
Access your Azure subscription with the Azure AD service using any of the following roles: Global Administrator, Cloud Application Administrator, Application Administrator, or owner of the service principal.
You will need to sign into Azure's portal at https://portal.azure.com.
1.2 Register the Enterprise Application
Open the Azure AD, and select the Enterprise Applications menu. Click New Application:
Search the Bizagi application and select it:
1.3 Define users that are going to be authenticated in Bizagi using Azure SSO
Define users that are going to be authenticated in Bizagi, using Azure SSO. Add them manually or with any predefined group on your Azure AD. Remember that users must be registered in Bizagi.
1.4 Configure the Single sign-on properties
Select the Single sign-on menu, and click the SAML option:
1.4.1 Set up basic SAML configuration
Register Bizagi's endpoints
Endpoints
•Identifier (Entity ID): It is the Bizagi 's URL used for authentication, with the following format https://accounts-<companyname>.bizagi.com
•Reply URL: This is the destination in the SAML response https://accounts-<companyname>.bizagi.com/saml2/assertionConsumer
•Sign on URL: It is the Bizagi 's URL used for authentication, with the following format, https://accounts-<companyname>.bizagi.com
•Logout URL: It is the Bizagi's cloud logut URL https://accounts-<companyname>.bizagi.com/saml2/logout
Review and fill the rest of mandatory fields:
1.5 Verify or upload the certificate
You must include the SAML signing certificate. If the configuration does not have a certificate, click Add a certificate and upload the same certificate used in the Bizagi's configuration.
If the certificate is configured correctly, you can see its properties. Make sure its status is active.
1.6 Define the Unique User Identifier
To identify users when they are being authenticated by Bizagi, you need to define the a Unique Identifier. In Bizagi, unique identifiers for users is the email. We recommend setting the email as the Unique Identifier. Click the edit icon in the User Attributes & Claims options:
Click the Unique Identifier:
Select the Email Address format, and user.mail as the Source Attribute:
Finally, copy the App Federation metadata URL:
|
The metadata URL must have the following format:
https://login.microsoftonline.com/<TenantID>/federationmetadata/2007-06/federationmetadata.xml?appid=<applicationID>
It is very important to make sure that the appid parameter is contained at the end of the URL. |
3. Configure your IdP in the Customer Portal
After you configure the application in Azure AD, now you must access the Bizagi Customer Portal and register the Identity Provider. Follow the steps in Configure a SAML 2.0 IdP in the Customer Portal.
4. Upload the Bizagi metadata file in Azure AD's application
After you configure the identity provider in Bizagi's Customer Portal, you must generate the metadata file. Refer to Download the metadata file.
Then, access the enterprise application created previously, click the Single sign-on option, and then select Upload metadata file:
Review that all the configuration parameters are right and save.
Now you can test your single sign-on. To test your configuration we recommend that all users log out and opening a new tab using incognito mode, or use a different browser. If the configuration with a new IdP fails, you can Restore the authentication protocol.
Troubleshooting
In case the authenticator fails, you can review: