The following manual configuration creates a SAML SSO configuration for your Enterprise organization.
-
Owner
oradmin
role in an Enterprise organization -
Administrative access to your organization’s Microsoft Azure AD portal
This configuration supports the following:
-
Service provider initiated SSO
-
Single Log Out [optional]
Before configuring SSO, you need to assign a namespace and make files of your service provider certificate and private key. These steps provide information you need to enter later.
Create your namespace:
-
Go to Organization > SSO.
-
Under Namespace, enter the namespace you want for your organization, for example,
acme_corp
. Your organization members enter this namespace when they log in via SSO. -
Under SSO type, select SAML 2.0.
Find your service provider primary key and certificate:
-
Scroll down to find the fields Service Provider Primary Key and Service Provider Certificate.
-
Copy the Service Provider Primary Key and paste it into a text editor.
-
Rename the file as
key.pem
. -
Copy the Service Provider Certificate and paste it into a text editor.
-
Rename the file as
cert.pem
.
This procedure creates two separate files:
-
key.pem
-
cert.pem
Locate these files and have them ready to upload later.
-
Log in to Microsoft Azure AD and go to Manage Azure AD.
-
Click Enterprise applications.
-
Click + New Application.
-
Click + Create your own application.
-
Enter a name for your app and select Integrate any other application you don’t find in the gallery.
-
Click Create.
-
Find 2. Set up single sign on and click Get started.
-
Click SAML.
-
For Basic SAML settings. click Edit and enter the following values:
You need to rename items in the Attributes & Claims section for your Login IML resolve.
-
In the Attributes & Claims sections, click Edit.
-
Under Additional claims, find the value you want to edit and click that row.
-
Enter the new name in the Name field. Use the following chart to find the names required for your IML resolve.
email
user.mail
name
user.displayname
id
user.userprincipalname
Unique User Identifier
user.userprincipalname
-
Repeat steps 2 and 3 for each attribute you need to change.
-
Click Save.
You need to download the base 64 SAML certificate from Microsoft Azure and upload it to the Identity Provider Certificate field of the SSO tab in your Make organization.
-
Go to Organization > SSO.
-
Under Identity Provider Certificate, click Extract. A pop-up appears.
-
Under P12, PFX or PEM file, click Choose file and select the
.cer
file you downloaded. -
Enter the following information from Okta into the IdP login URL and Identity provider certificate fields.
Field on MS Azure AD
Field on Admin > System settings
Under 4 Set up:
Login URL
IdP login URL
Under 3 SAML certificates
Certificate (Base64)
Identity provider certificate
-
Enter the following in the Login IML resolve field:
{"email":"{{get(user.attributes.email, 1)}}","name":"{{get(user.attributes.profileFirstName, 1)}} {{get(user.attributes.profileLastName, 1)}}","id":"{{user.name_id}}"}
-
Select the following settings:
Allow unencrypted assertions
Yes
Allow unsigned responses
No
Sign requests
Yes
-
Click Save.
-
Go to Boost.space IntegratorPart of the Boost.space system, where you can create your connections and automate your processes.‘s login page.
-
Click Sign in with SSO.
-
Enter the namespace you chose for your organization.
-
Log in using your Okta credentials and consent to Boost.space Integrator‘s access to your user data.