Communifire supports Azure Active Directory (AD) integration for for single-sign on (SSO). After integration, users can log into your intranet using their Azure AD credentials. User data can also be synced from Azure AD to Communifire.
This page covers information about Azure AD SSO, walks you through how to configure Azure AD SSO on your intranet, and provides solutions to common issues. For more information or assistance from the Axero team, submit a private case.
On visiting your intranet, users will be re-directed to the Azure Active Directory log in page.
Note: New users that login with Azure AD SSO are automatically approved. To prevent users from signing in from Azure AD SSO, you must remove them from the app in the Azure portal.
Logging in with Communifire credentials
You can allow users to log in using Communifire credentials. Set System Properties > EnableAutoLoginViaSaml to false. When this property is set to false, users will see the Communifire login page. Users can either log in with Communifire credentials or click Login via SAML to sign in using Active Directory credentials.
Return to top
In the mobile app, users will be re-directed to the Azure Active Directory log in page after entering the site URL.
Logging in to app with Communifire credentials
You can allow users to log in to the app using Communifire credentials. Set System Properties > EnableAutoLoginViaSaml to false. When this property is set to false, users will see the Communifire login page after entering the site URL. Users can either log in with Communifire credentials or click Active Directory Login to sign in using Active Directory credentials.
Roles can be imported into Communifire using attribute mapping. Azure roles are imported into Communifire as top level Roles . The roles are assigned to or unassigned from users when they login.
See the Configure Roles Import section in the setup guide below for how to import Azure roles into Communifire.
Communifire uses System for Cross-domain Identity Management (SCIM) for auto-provisioning. When auto-provisioning is configured, Azure AD acts as the data source for Communifire users. New users are automatically created in Communifire without requiring a login, users are automatically deactivated in Communifire when removed in Azure, and changes are synced to Communifire. Azure AD SSO can be configured with or without auto-provisioning. Below is information about Azure AD SSO with and without auto-provisioning.
When you set up auto-provisioning, users are automatically created in Communifire when they are added in Azure Active Directory.
Any data can be imported from Azure Active Directory, as long as there are corresponding User Profile Fields in Communifire. Attribute mappings must be added to Control Panel > System > Single Sign On > Data Mapping > SCIM.
To import user profile photos into Communifire, also set up user syncing (see the Configure User Syncing section below).
You can also use the REST API to import user data into Communifire.
User data is updated in Communifire every time a user logs in. When auto-provisioning is set up, user data is synced to Communifire every 40 minutes.
Notes:
When a user's sign in is disabled in Azure Active Directory, the user will be banned in Communifire.
When a user is deleted or removed from the Azure Active Directory app, the user will be banned in Communifire. Thirty days later, the user will be deleted. You can set whether deleted users' content will be deleted, reassigned to the system anonymous user, or reassigned to a specific user in Control Panel > System > Single Sign On > SCIM User Provisioning.
A user is created in Communifire when the user logs in for the first time. You can add users to Communifire before they log in using the methods below.
Bulk import users
Pre-populate users before Azure Active Directory setup or launch with Bulk Import Users . The Communifire usernames you create must match the usernames in Active Directory.
Add users
Add users in Control Panel > People > Manage People > Add User . The Communifire username you create must match the username in Active Directory.
REST API
You can use our REST API to import users - REST API: Add User , REST API: Update User Profile Fields .
Adding Communifire administrator accounts
If Communifire administrator accounts are created before Active Directory is set up and the Communifire usernames match Active Directory usernames, the administrator accounts will sync with the corresponding Active Directory accounts. If not, you will need to re-configure permissions for the admin Active Directory accounts and remove the previous Communifire administrator accounts.
Any data can be imported from Active Directory, as long as there are corresponding User Profile Fields in Communifire. Attribute mappings must be added to Control Panel > System > Single Sign On > Mapping > Azure Active Directory. Enter the attribute name as the property name in Communifire. See the table below for common fields to import.
To import manager and user profile photos into Communifire, set up user syncing (see section below).
You can also use our REST API to import user data into Communifire.
User data is updated in Communifire every time a user logs in. When user syncing is set up, you can configure syncing settings in Control Panel > System > Single Sign On > User Syncing:
You can also sync all users immediately at anytime by clicking Sync Now.
How to sync a specific user
Start typing a name and select the user from the menu that appears.
Note: User syncing does not update user roles. Roles are updated on login only.
When a user is disabled in Active Directory, this information is not sent to Communifire. You can Delete User and delete their content or re-assign their content to another user or to the system anonymous user. You can also Ban User , which will prevent the user from logging in, but will retain their content.
This guide walks you through how to enable Azure AD single sign-on in Communifire. Client-side setup is estimated to take 1-3 hours and Axero team setup is estimated to take 1 hour. The time to set up SSO can vary based on how long it takes to set up internal systems and to provide the Axero team with required information. The total time for setting up SSO may take up to 1-2 business days.
Once you complete the guide, Azure AD SSO will be active on your intranet. If you run into any issues, submit a case here for assistance.
To allow Communifire users to login via SSO, you need to have an Azure portal subscription. If you already have an Azure portal subscription, you can skip this section.
Note: To import profile photos into Communifire, you must also configure user syncing. Refer to the Configure User Syncing section below.
Communifire Azure Gallery App
Note: If you set up auto-provisioning and want to import profile photos into Communifire, you must also configure user syncing. Refer to the Configure User Syncing section below.
When user syncing is set up, user data is automatically synced at a time and frequency you specify. Mappings for basic properties must be configured exactly as below in Control Panel > System > Single Sign On > Data Mapping > Azure Active Directory.
{ "resourceAppId": "00000002-0000-0000-c000-000000000000", "resourceAccess": [ { "id": "5778995a-e1bf-45b8-affa-663a9f3f4d04", "type": "Scope" }, { "id": "5778995a-e1bf-45b8-affa-663a9f3f4d04", "type": "Role" } ] }
How to sync all users
Search for a user and select the user.
How to exclude the manager from syncing
The manager field builds the Organizational Chart . You can exclude the manager field from sync if you need a different org chart in Communifire.
User syncing after a name or email change
After a user has a name or email change in Active Directory, you may see the exception "Invalid directory size." To fix this exception, have the user log out and log in again via Azure SSO. You can submit a request here to force log out all users.
Roles can be imported into Communifire using attribute mapping. The Azure attributes represent roles. The attribute values should be true or false. When a role attribute is true, the user is assigned the Communifire role. When a role attribute is false, the Communifire role is removed from the user. User roles are updated on login only.
Step 1: Configure Azure
To set up roles import, first create user attributes to represent roles. The attribute values should be true or false. If you have Active Directory, you may need to create custom attributes and sync them to Azure.
Step 2: Configure Communifire
Error: At https://login.microsoftonline.com/xxxxxx-d38a-4a87-8e6a-dffaab339740/saml2: "The signed in user 'abc@xyz.com' is not assigned to a role for the application 'xxxxxx-d38a-4a87-8e6a-dffaab339740'."
Add the user to your enterprise application in Users and groups.
References: ComponentSpace Azure AD Integration Guide.pdf
Customizing claims issued in the SAML token for enterprise applications in Azure Active Directory
Exception: "UserRepository.AddUserWithSAMLActiveDirectoryProperties Error" when a new user tries to login. "InvalidPassword" in stack trace.
Go to Control Panel > System > General Settings > Advanced Settings. Set "Maximum length for password" to a value over 25.
Exception: "UserRepository.AddUserWithSAMLActiveDirectoryProperties Error" when a new user tries to login. "Failed" in stack trace.
Go to Control Panel > System > General Settings > Advanced Settings. Set "Minimum length for username" to a lower value. Set "Maximum length for username" to a higher value.
Exception: "Password field missing" while syncing users
Enter the password for user syncing in Control Panel > System > Single Sign On.
Exception: "Application ID field missing" while syncing users
Enter the application ID for user syncing in Control Panel > System > Single Sign On.
Exception: "The remote server returned an error: (401) Unauthorized." while syncing users
In the Azure portal, generate a password for the app in App registrations. The key value will appear on save.
Exception: "Invalid directory size." while syncing users
Have the user log out and log in again via Azure SSO. You can submit a request here to force log out all users.
Exception: AADSTS650056: Misconfigured application. This could be due to one of the following: The client has not listed any permissions for 'AAD Graph' in the requested permissions in the client's application registration. Or, The admin has not consented in the tenant. Or, Check the application identifier in the request to ensure it matches the configured client application identifier. Please contact your admin to fix the configuration or consent on behalf of the tenant. Client app ID: xxxxxxxx-64c8-43a5-bd20-033dd4ce8441.
Make sure the service provider name in the saml.config file and the identifier (Entity ID) in Azure are the same.
Issue: Data isn't syncing every 20 minutes when auto-provisioning is set up
Go to Azure Active Directory > Enterprise Apps and open the app. Click the Provisioning tab. Click Stop provisioning.
Click Ok.
Click Start provisioning.
Error: An item with the same key has already been added.
Cause: Duplicate attribute mapping.
Fix:
is requesting access to a wiki that you have locked: https://my.axerosolutions.com/spaces/5/communifire-documentation/wiki/view/24742/azure-ad-sso
Your session has expired. You are being logged out.