Azure Single Sign-On

Single Sign-On (SSO) adds more security and convenience when signing on to SEI using Azure Active Directory (recently renamed to Microsoft Entra ID).

This topic describes how to configure Microsoft Azure with SEI. These settings will be used for both Web Server and Excel Add-in.

To configure the Azure Domain:

1. In your Web browser, go to https://portal.azure.com/ and enter your login credentials (if required).

2. Under Azure services, click Enterprise applications.
   
   

   

3. In the upper bar, click + New application.
   
   

   

4. In the Browse Azure AD Gallery page, click Create your own application.
   
   

   

5. In the Name field, enter a name for your application and click Create.
   
   

   

6. Under the Getting Started section, select 2. Set up single sign on.
   
   

   

7. Select SAML for the single sign-on method.
   
   

   

Although there are 5 sections for the SAML SSO method, you only need to set the parameters in these sections:

• Basic SAML Configuration
• User Attributes & Claims

Basic SAML Configuration

1. In the Single sign-on page, click the pencil icon to edit the parameters in the Basic SAML Configuration section.
   
   

   

2. In the Identifier (Entity ID) field, copy the URL from the Entity ID parameter in the Web Server.

   In this example we have biwebserver.mycompany.com as the URL address with port :444 and biwebserver as Unique Identifier for the Azure Domain.
   
   

   

   Important

   Only for users who never performed the https binding for external access: Take note of URL address used for the Web Server on your certificate to communicate with the Azure Domain. This is explained in further detail in Azure Single Sign-On.

3. In the Reply URL (Assertion Consumer Service URL) field, copy the URLs from the Saml2 ACS URL parameter in the Web Server for both Web Server and the Excel Addin.

4. In the Sign on URL field, enter the URL of the Web Application if you wish to log in directly to SEI (e.g. https://yourserver:81).

5. Click Save to apply changes.

6. In the left menu, under the Manage section, click Users and groups.
   
   

   

7. In the upper bar, click + Add user/group to authorize users and groups to use SSO. This completes the basic SAML configuration.

User Attributes & Claims

In the Azure Domain, you can take the attributes listed in the User Attributes & Claims section.

If you want to use the mailnickname attribute (because you want to choose the part of the email address before the @ sign), you will have to create it, since this attribute does not exist by default in Azure Domain.

To create the attribute:

1. In the left menu, under the Manage section, click Single Sign-On.
   
   

   

2. In the upper-right corner, click the pencil icon to edit the User Attributes & Claims section.
   
   

3. The Manage Claim page is displayed. Click + Add new claim.
4. In the Name field, enter mailnickname.
5. For the Source, select Attribute.
6. In the Source Attribute field, enter user.mailnickname.
   
   
7. Click Save to finish.

Downloading the Certificate

To retrieve the Azure certificate:

1. Scroll to the SAML Signing Certificate section.
   
   

   

2. Click Download next to the Certificate (Base64) field.

3. Proceed to adding the Azure provider and create users in the Authentication page.