Azure Single Sign-On for Web Client

Building on the previously explained Single Sign-On (SSO) procedure, this feature adds more security and convenience when signing on to SEI using Azure Active Directory (Azure AD).

This page helps you set up Azure so that it can work seamlessly with SEI.

First, configure the Azure Domain, as it will be from this platform that we retrieve the data required to correctly set up SEI.

Azure Domain Configuration

1. In your Web browser, go to https://portal.azure.com/ and enter your login credentials (if required).
2. In the left menu, click on Enterprise Applications.
   
3. In the upper bar, click on + New application.
   
4. Under the Add your own app section, select Non-gallery application.
   
5. In the Name field, enter a name for your application and click on Add.
   
6. Under the Getting Started section, select 2. Set up single sign on.
   
7. Select SAML for the single sign-on method.
   

Although there are 5 sections for the SAML SSO method, you only need to set the following:

• Basic SAML Configuration
• User Attributes & Claims

Basic SAML Configuration

1. In the upper-right corner, click on the pencil to edit the Basic SAML Configuration section.
   
2. In the Identifier (Entity ID) field, enter your SEI URL + :port following by a Unique Identifier for your Azure Domain.
   Important

   Only for users who never did the https binding for external access: Take note of URL address used for the Web Client on your certificate to communicate with the Azure Domain. This will be explained in further detail in SEI Server Installation and Configuration.

   Example

   Here, we use biwebserver.mycompany.com as the URL address, on port 444.
   

3. In the Reply URL (Assertion Consumer Service URL) field, enter your SEI URL + :port following by /AuthServices/Acs.

4. Click on Save to apply changes.
5. In the left menu, under the Manage section, click on Users and groups.
   
6. In the upper bar, click on + Add user to add the Users and Groups you want authorized to use SSO.
   
7. This completes the Basic SAML Configuration section.

User Attributes & Claims

The installation package for the configuration of the SEI application automatically fills in the SAML2 answer's Attribute for user name field with the mailnickname attribute by default.

For Azure Domain, you can replace this value with one of the attributes listed in the User Attributes & Claims section.

If you want to use the mailnickname attribute (because you want to choose the part of the email address before the @ sign), you will have to create it, since this attribute does not exist by default in Azure Domain.

To do so:

1. In the left menu, under the Manage section, click on Single Sign-On.
   
2. In the upper-right corner, click on the pencil to edit the User Attributes & Claims section.
   
3. Click on + Add new claim.
4. In the Name field, enter mailnickname.
5. For the Source, select Attribute.
6. In the Source Attribute field, enter user.mailnickname and click on Save to finish.
   

SEI Server Installation and Configuration

Before starting the SEI Server Installation / Configuration, retrieve the certificate from Azure Domain.

To do so:

• Scroll to the SAML Signing Certificate section and click on Download next to the Certificate (Base64) field.
  

For a First-Time Installation of SEI

• Follow the procedure described in Installing the Web Application and Distribution until Step 11 then fill in the fields according to the settings described in this section.
• For the screen below, fill in the fields as described.

• For the Full certificate name field, enter the name of the certificate you downloaded from Azure Domain with the .cer extension (for example: AzureBIWebServer.cer).
• You should have a result similar to this:
  
• Click on Next and finish the installation.

Binding the Web Client

By adding an https binding to your Web Client through this procedure, external connections will also be secured.

To do so:

1. Press the Windows key + R to open the Run window.
2. Enter inetmgr and press the Enter key.
3. On the left pane, click on the little arrow to expand the connection.
4. In the Sites tab, right-click on WebClient and select Edit Bindings...
5. In the Site Bindings window, click on Add...
6. In the Type drop-down list, select https.
   
   Note

   For this https connection, we are using port number 444 but feel free to customize it according to your preferences.

7. Click on OK to finish.

You should have a result similar to this:

Editing the web.config file

In order to fully benefit from Azure SSO functionality, you will have to edit the web.config file located in C:\inetpub\wwwroot\WebClient.

• Make sure the entityID attribute from the sustainsys.saml2 tag has the same value you defined in the Identifier (Entity ID) field in the Basic SAML Configuration section. In this document we set "https://biwebserver.mycompany.com:444/biwebclient" as value.
• Once open, change the other values in the web.config file as described in the table below:

<sessionState cookieSameSite="Lax"/>

<sessionState cookieSameSite="None"/>

<httpCookies httpOnlyCookies="true" requireSSL="false" sameSite="Lax"/>

<httpCookies httpOnlyCookies="true" requireSSL="true" sameSite="None"/>

You should have a result similar to this:

<sustainsys.saml2 entityId="https://biwebserver.mycompany.com:444/biwebclient" returnUrl="https://biwebserver.mycompany.com:444/Account/SSO" modulePath="/AuthServices">
        <identityProviders>
            <add entityId="https://sts.windows.net/c2c50f21-66a7-xxxx-xxxx-xxxxxxxxxxxx/" signOnUrl="https://login.microsoftonline.com/c2c50f21-66a7-xxxx-xxxx-xxxxxxxxxxxx/saml2" allowUnsolicitedAuthnResponse="true" binding="HttpRedirect">
                <signingCertificate fileName="~/App_Data/AzureBIWebServer.cer"/>
            </add>
        </identityProviders>
</sustainsys.saml2>

<system.web>
        <sessionState cookieSameSite="None"/>
        <compilation targetFramework="4.8">
            <assemblies>
                <add assembly="System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"/>
            </assemblies>
        </compilation>
        <!-- change value of MaxHttpCollectionKeys to max int(2147483644) to webserver support recsive big data-->
        <httpRuntime targetFramework="4.8" maxUrlLength="10999" maxRequestLength="2147483644" executionTimeout="1600" useFullyQualifiedRedirectUrl="false" requestLengthDiskThreshold="2147483647" maxQueryStringLength="2097151"/>
        <httpCookies httpOnlyCookies="true" requireSSL="true" sameSite="None"/>
</system.web>

Steps after the Installation/Configuration

Copying the Azure Domain Certificate

• Copy the certificate you downloaded from Azure Domain and paste it to C:\inetpub\wwwroot\WebClient\App_Data.
  

Creating Users / Groups in SEI

• Refer to Users to create your Web Client user by entering the same value for User Name and SAML2 answer's Attribute for user name you defined during the installation of the package.

Accessing SEI with Azure SSO enabled

To log in with SSO enabled, simply use your default Web Client URL: https://biwebserver.mycompany.com:444.

If your Admin account is not set up with SSO and you need to log in, you can use this special URL to log in with your default credentials (without SSO): https://biwebserver.mycompany.com:444/Account/Login.