Setup Guide: Azure AD SSO | Communifire Documentation

This guide provides detailed steps to integrate Azure Active Directory (AD), or Entra ID, enabling Single Sign-On (SSO) without automatic user provisioning. Users will authenticate using Azure AD credentials, but their accounts will be managed manually in Axero.

To enable auto-provisioning, please see the Azure AD Auto-Provisioning Setup Guide.

Preparation

The following process will take 1-2 hours to complete. Before you start, ensure you have administrative access to your Azure portal and Axero site.

Step 1: Set Up SSO

1.1 Create a New Application in Azure

1. Log into the Azure portal as an administrator.

2. Navigate to Enterprise applications.
   

3. Click New application.
   

4. Click Create your own application.
   

5. Provide a name (for example, "Axero SSO"). Be sure the non-gallery option is selected.
   

6. Click Create to add the application.
   

1.2 Configure SSO

1. Click Single sign-on and select SAML.
   

2. In the Basic SAML Configuration section, click Edit, and enter the following details:

   • Identifier: Click Add identifier and enter your intranet's URL (for example, https://mycompany.communifire.com).

   • Reply URL: Click Add reply URL and enter your intranet's URL followed by /SAML/AssertionConsumerService.aspx (for example, https://mycompany.communifire.com/SAML/AssertionConsumerService.aspx).

   • Sign-on URL: Enter your intranet's URL followed by /login (for example, https://mycompany.communifire.com/login).
     

3. Click Save and close the side page.

1.3 Configure User Attributes

1. In the Attributes & Claims section, click Edit.
   

2. Under Additional claims, delete each attribute by clicking the three dots on the right.
   

3. Click Add new claim and add the following required attributes.

   Name	Source Attribute
   givenName	user.givenname
   surname	user.surname
   mail	user.mail

   Leave the Namespace field blank and click Save after entering the information for each attribute.

   

   Suggested optional attributes:

   Name	Source Attribute
   companyName	user.companyname
   department	user.department
   jobTitle	user.jobtitle
   employeeId	user.employeeid
   hireDate	user.employeehiredate
   telephoneNumber	user.telephonenumber
   city	user.city
   state	user.state
   country	user.country

4. Close the page when done.
   

5. Click Properties in the application menu.
   

6. (Optional) Select No for Assignment required? to allow users to log in without being assigned to the application.
   

7. Click Save.

1.4 Download the Metadata XML

1. Click Single sign-on in the application menu.

2. In the SAML Certificates section, click Edit.
   

3. Select Sign SAML response and assertion for the Signing Option. Select SHA-256 for the Signing Algorithm.
   

4. Click Save and close the side page.

5. Find Federation Metadata XML and click Download. This SAML signing certificate is required to configure Axero in the next step.
   

Step 2: Configure Axero

2.1 Access Axero SSO Settings

1. Log in to your Axero site as a site administrator.

2. Navigate to the Control Panel > System > Single Sign-On.

2.2 Configure SSO Settings

1. On the Settings tab, select Azure Active Directory as your authentication method.
   

2. Click Save.
   

3. Click Choose File to upload the Metadata XML file you downloaded in step 1.4.5.
   

4. Select a login type:

   • SSO Login + Communifire Login allows users to log in with either Azure AD or Axero credentials. See the instructions for adding a "Login via SAML" button to your login page before testing.

   • SSO Login Only allows Azure AD credentials only, and the login page will redirect users to the Azure AD login page. Only choose this option after you have confirmed that SSO works.
     

5. Click the Data Mapping tab.

6. For Type, select Azure Active Directory.
   

7. Ensure the property names are identical to the claim names you entered in step 1.3.3. The fields on the right are your site's user profile fields, which will receive values from Azure AD when users log in. Data mappings are case-sensitive. Click Update when you are done.
   

8. Click System in the header and select System Properties.

9. Start typing SAMLRelyingPartyTrustIdentifier in the filter bar to locate the property.

10. If the property's value does not match your site's URL, click Edit to update.

11. Click System in the header and select Advanced System Utilities.

12. Click Restart Site.

Step 3: Test SSO

3.1 Ensure the Azure Admin Has an Axero Account Before Testing SSO

1. Navigate to Control Panel > People > Manage People.

2. Click Add User.
   

3. Enter the administrator's name and email address as it appears in Azure. Enter a username and password.
   

4. Click Register.

3.2 Log in Via SSO

1. Follow the instructions for adding a "Login via SAML" button to your login page.

2. Log out of your Axero site, or open an Incognito or InPrivate window.

3. Go to your site's login page.

4. Log in via SSO.

Optional: Configure User Syncing

Axero updates user data at each login. Setting up user syncing allows for the automatic update of user data at predefined times. While this step is optional, it is required for updating profile pictures and can streamline the management of user information without auto-provisioning.

4.1 Configure Azure AD for User Syncing

1. Log into the Azure portal and navigate to App registrations.

2. Click All applications and select the application used for SSO.

3. Copy the Application (client) ID and save it for later.
   

4. Click Manifest in the application menu.
   

5. Insert the following code between the requiredResourceAccess brackets:

   {
     "resourceAppId": "00000002-0000-0000-c000-000000000000",
     "resourceAccess": [
       {
         "id": "5778995a-e1bf-45b8-affa-663a9f3f4d04",
         "type": "Scope"
       },
       {
         "id": "5778995a-e1bf-45b8-affa-663a9f3f4d04",
         "type": "Role"
       }
     ]
   }

6. Click Save.

7. Click API Permissions in the application menu.
   

8. Click Add a permission and select Microsoft Graph.
   

9. Under Microsoft Graph, choose Delegated permissions, then search for and select both Directory.Read.All and User.Read.All.
   
   
   

10. Under Microsoft Graph, switch to Application permissions and select both Directory.Read.All and User.Read.All.
    
    
    

11. Click Add permissions.

12. Click Grant admin consent.
    

13. Return to Enterprise applications and select the application used for SSO.

14. Click Permissions and Grant admin consent to apply permissions.
    

4.2 Set Up Client Secret

1. Navigate to App registrations.

2. Click All applications and select the application used for SSO.

3. Click Certificates & secrets.

4. Click New client secret.
   

5. Enter a description and an expiration date and then click Add. Note Set a reminder to update the client secret in Azure and Axero before it expires.
   

6. Copy the client secret Value (not the Secret ID) and save it for the next step. This is the only time the password will be shown. If you lose it, you can generate a new client secret.
   

4.3 Finalize User Syncing in Axero

1. Log in to your Axero platform as a site administrator.

2. Navigate to the Control Panel > System > Single Sign-On.

3. Select Enable user syncing.
   

4. Select Sync profile pictures to import photos from Azure AD, understanding that this will overwrite any changes made within Axero.

5. Enter the Application ID from step 4.1.3 and the client secret Password from step 4.2.6 into the respective fields.
   

6. Set the Syncing Day Interval and UTC Syncing Start Time to define the frequency and start time of syncing.

7. Click Update to apply the changes.
   

Optional: Configure Roles Import

Roles can be imported into Axero using attribute mapping. The Azure attributes represent roles, and the attribute values should be true or false. When a role attribute is true, the user is assigned the Axero role. When a role attribute is false, the Axero role is removed from the user. User roles are updated upon login only.

5.1 Configure Azure for Role Mapping

1. In Azure Active Directory, create user attributes to represent distinct roles, assigning "true" or "false" as their values. This might involve generating and syncing new custom attributes for Active Directory users.

2. Navigate to Azure AD > Enterprise applications, select your app, then Single sign-on > Attributes & Claims and click Edit.

3. Choose Add new claim. For each role, enter a concise, space-free Name and select the corresponding attribute under Source attribute.

4. Click Save after each new claim and repeat for each role required.

5.2 Configure Axero for Role Integration

1. Create new roles within Axero by going to Control Panel > People > Roles and selecting Add User Role. Define each role with a Name and Description, then Save.

2. Go to Control Panel > System > Data Mapping > Azure Active Directory.

3. Click Add and enter the following information:

   • Property name: Enter the claim name you entered in Azure.
   • Field: Select Set User Role.
   • Role: Select the corresponding role in Axero.

4. Repeat this process for all roles created in Azure.

5. Click Update.

Additional Considerations

Without auto-provisioning, profile field values may persist in Axero after being changed in Azure. Manual adjustments can be made in Control Panel > People > Manage People.

Without auto-provisioning, Axero cannot detect when a user is disabled in Azure AD. Use the Delete User option in Axero to remove users and decide whether their content should be deleted, reassigned to another user, or moved to the system anonymous user. Alternatively, the Ban User option prevents a user from logging in but preserves their content.

Troubleshooting

If you encounter issues during testing, review the SAML response and ensure all claims match between Azure AD and Axero. Check the Azure Audit logs for any errors.