Application Registration using Azure Portal

To setup Azure Single Sign-On with SecurEnds and Azure AD, you need to register SecurEnds as an application within the Azure portal. Doing this will create the service principal object in your Azure AD tenant.

The information that will need to be gathered and saved throughout the steps below are as follows:

• Tenant Id
• Client Secret (Value)
• Client Id
• Group Name
  • Notice: Desired group must be associated with the SSO application created

• How to Associate Azure Group to you SSO App in Azure portal:
  • Navigate to Enterprise Applications and search for the application
  • Click on Application name
  • In the Overview screen, click on Assign users and groups
  • Click on Add user/group
  • Here we can add either the user or the group to an application

Step 1: Create Application

• Login in to https://portal.azure.com
• Navigate to left navigation menu and select Azure Active Directory

• Make note of the Tenant ID displayed on the right as this will need to be supplied to the SecurEnds team. After making note, select Enterprise applications

• Select New application. Be sure you have appropriate access. Admin permission is needed to create new application.

Select Non–gallery application

• Give an application name and select Add

• After creating an application, you will be automatically navigated to the application overview page
  • Make note of the Application ID and Object ID displayed on the screen as these will need to be supplied to the SecurEnds team
  • After making note, select Single sign-on on the left navigation menu

• Select Linked as the single sign-on method

• Provide the Sign on URL and select Save

• Navigate to home page > select Azure active directory > then select App registrations

• Select the application just created

• Select Certificates and secrets

• Select New client secret

• Add a Description and select a Expires timeframe. Once complete select Add

• The Client Secret will be displayed when these settings are saved and compulsory, copy the key to the clipboard, once you leave the page the key will not be visible
  • Make note of the Client Secret (Value) displayed on the screen as this will need to be supplied to the SecurEnds team

Step 2: Azure Permissions

After registering SecurEnds as an application within the Azure portal, the next step is to make sure the application has the correct API permissions to access data within Microsoft Graph. To do this the user or administrator must grant the correct permissions via a consent process.

• Select the Authentication link on the left navigation menu and select Add a platform

• Select Web as the configure platform under web applications

• Select “Add a platform” and input Redirect URL as below:
• https://companyname.securends.com/login/oauth2/code/azure
• Configure
• No need to add Logout URL since we are using REST API for logout

Under Logout URL in Implicit Grant, ID token checkbox should be enabled

• Select API permissions on the left navigation menu and select Add a permission

• Select Microsoft Graph under Commonly used MicrosoftAPIs

• Under Microsoft Graph give the following Delegated Permissions. Totaling 4 permissions in all.

• Delegated permissions:
  • Email
  • Openid
  • Profile
  • Directory
• Search for Directory Permissions and Select Directory.AccessAsUser.All permission.

• Select email, openid and profile permissions as shown below

• Select Add permissions and then select Grant admin consent for ******”

• Select Yes

• After selecting required permissions check the status for granted/not granted
  • Admin will get an option to grant those permissions beside “Add a permission button”

Step 3: Manifest Configuration

• Select the “Manifest” link on the left navigation menu and update the following:
  • oauth2AllowImplicitFlow value to true

Step 4: Users and Groups Creation (Optional)

If users and groups HAVE already been created, perform the following actions:

• Assign the existing Group being used to the Application/SSO
• Make note of “Group Name” as this info needs to be relayed to the SecurEnds team

If users and groups HAVE NOT been created, perform the following actions to create them:

• Create users and groups (If already created then ignore this step)
• Navigate to Azure Active Directory and select Users

• Select New User and add the appropriate details
• Navigate to Azure Active Directory and select Groups

• Select New Group and add the appropriate users to that group
  • This group contains a list of Active Directory groups to use for authorization
  • Make note of this Group Name as it will need to be supplied to the SecurEnds team

Step 5: Configuration Settings

Once the steps above have been completed then you can provide SecurEnds the following information that was saved based on the directions from each step

• Tenant Id
  • Contains your Active Directory’s Directory ID from earlier
• Client Id
  • Contains the Application ID from your app registration that you completed earlier
• Client Secret
  • Contains the Value from your app registration key that you completed earlier
• Group Name
  • Contains a list of Active Directory groups to use for authorization

Step 6: Update Azure Claim Token

Required if your company utilizes two logins like UPN (UserPrincipalName) and email. Please go through the below steps to update Azure email claim token.

• Select the “App registration” link on the left navigation menu.

• Go to All Applications tab and click on the application for which looking to update an email token.
  • Example : securends-sharepoint as shown in the below screen.

• Once you have clicked on the Selected application the screen will redirect to the below.
• Select Token Configuration link on the left navigation menu.
• Click on Add optional claim, a new screen appears on the left side to Add optional claim.
• Select Token type as ID and Claim as email.
• Click on Add button.

Successfully, email claim token is updated.

The post Azure SSO appeared first on SecurEnds.

This app connector provides the SAML values your app needs to communicate with Okta SAML as an identity provider. It also provides a place for you to provide SAML values that SAML requires to communicate with your app as a service provider.

1. Access Okta.
2. Go to Applications

Please click on Create App Integration

Please select an option SAML2.0

Please Enter App Name and click on Next button

Please Enter Single Sign On URL and Audience URI(SP Entity ID) and Click On Next Button

Single sign-on URL – https://XXX.securends.com/login/saml2/sso/securends

Audience URI (SP Entity ID)  – https://XXX.securends.com/saml2/service-provider-metadata/securends

Note: Replace XXX in the URLwith your domain

Please Select I’m an Okta customer adding an internal app option

click on Finish Button

Please share the following Metadata URL with the securends team.

Please Click On View Setup Instructions

Final Step: Please assign the created application to people/groups.

The post Okta SSO (SAML) appeared first on SecurEnds.

SecurEnds application supports the following OIDC feature:
. Service Provider (SP)-Initiated Authentication (SSO) Flow

Okta SSO Integration Setup Instructions
1. Create an app integration after log in to Okta

2. Choose OIDC-OpenID Connect as Sign-in method and Web Application as Application type, then click Next.

3. Please fill out the form and give your app integration a descriptive name (e.g., SecurEnds). Follow the steps below:

1. Sign-in redirect URIs:  e.g., https://XXX.securends.com/login/oauth2/code/okta (Replace XXX with your domain)
2. Sign-out redirect URIs: e.g., https://XXX.securends.com(Replace XXX with your domain)
3. Skip group assignment for now
4. Others remain default settings
5. Then click Save

4. Click General tab, Click Edit under General Settings, Please make the following changes as shown in the screen shot and click Save

5. Once the application created, Go to the application , Select the General tab, copy the Client ID and Client secret values. These values will need to be provided to your SecurEnds Implementation Consultant to be configured within your organizations SecurEnds instance

The following information will need to be provided with SecurEnds team to enable Okta SSO

• Client ID
• Client Secret
• Issuer  Ex: https://dev-880769.okta.com (In the upper-right corner, locate the organization URL, which takes the form of https://your_domain.okta.com.)

6. Assign Users/Groups

• Choose application the one you created
• Select the Assignments tab
• Select Assign and then select either Assign to People or Assign to Groups
• Enter the appropriate users or groups that you wish to enable Single Sign-On into your application, and then select Assign for each
• For any users that you added, verify the user-specific attributes, and then select Save and Go Back
• Select Done

Test Single Sign-On

1. Sign out of your administrator account within your development org by selecting “Sign out” in the upper-right corner of the Admin Console
2. Sign in to the Okta End-User Dashboard as the normal user who was assigned the SecurEnds integration
3. In your dashboard, select the Okta tile for the integration and confirm that the user is signed into SecurEnds application

Notes:
Users can access SecurEnds application using OIDC features in the following ways:

1. Customer can login to their okta org url
   • After authentication, customer can click on the SecurEnds App available in the dashboard and will be redirected to the SecurEnds application
2. Access SecurEnds instance url directly
   • Customer will be redirected to their okta org for authentication and after authentication customer will be redirected back to SecurEnds application

The post Okta SSO (OIDC) appeared first on SecurEnds.

Use the SAML Test Connector (Advanced) connector to build an application connector for your app.

This app connector provides the SAML values your app needs to communicate with OneLogin as an identity provider. It also provides a place for you to provide SAML values that OneLogin requires to communicate with your app as a service provider.

1. Access OneLogin.
2. Go to Apps > Add Apps.
3. Search for SAML Test Connector.
4. Select the SAML Test Connector (Advanced) app.

5. Edit the Display Name, if required. In the case of working with the demo1 app, enter demo1.
6. Accept the default values and click Save.
7. Keep the OneLogin app connector UI open for the next task. Click Save

Side Navigation Bar Details

Info :

Configuration:

The screenshot below represents sample data to setup the SAML OneLogin SSO.

Audience (EntityID) – https://XXX.securends.com/saml2/service-provider-metadata/securends

Recipient – https://XXX.securends.com/login/saml2/sso/securends

ACS (Consumer) URL Validator* – https:\/\/XXX.securends.com\/login/saml2/sso/securends

ACS (Consumer) URL* – https://XXX.securends.com/login/saml2/sso/securends

Login URL – https://XXX.securends.com/login/saml2/sso/securends

Note: Replace XXX in the URLwith your domain

The data will be transferred between the Service Provider(SecurEnds) to the Identity Provider(OneLogin) in a secure manner. A public key needs to be added in the SAML Encryption field.

Parameters:

SSO:

Select “SHA-256” for SAML Signature Algorithm. Copy the Issuer URL and forward to the SecurEnds team.

Add Users:

Go to Users > Users and click the New User button to open the User Info page

On the User Info page, verify that the user is activated (Green). Enter the user’s name and email address, along with any other personal information you want to include. (Note: The user will receive the verification email and should activate the account). Click the SAVE USER button.

Assign User to App

• In OneLogin, click Users, and then select each user you want to add.
• In the user info page, click Applications
• Click + icon and select the application from drop down and click Continue.
• Then click Save.

Add Role

• Click Users and select Roles
• Enter a name for the new role, click Save. (Example: Admin/Finance/ Account. It can be any name you want to provide for the role).
• In Roles, open the new Role by clicking the one you created.
• Click Users (left side navigation)
• In Check existing or add new users to this role, enter the name(s) of the users to add.
• When you have located each user name, click Check.
• For each user, click Add to Role. When you are done, the user(s) are listed in Users Add Manually.

• Click Save. You are returned to the Roles page.
• In the Role, click Applications.
• Click the Add Apps or + Icon.

The post OneLogin SSO appeared first on SecurEnds.