Setting up SSO for Azure AD

Decisions allows users to use Single Sign-On for Azure Active Directory using Azure and the SAML Module.

Prerequisite:

• Azure iDP configured within Portal
• Azure application (non-gallery app)
• Metadata document from the application in Azure
• SAML module installed (to learn more on installing modules, see Installing Modules) 

Configuration

1. In Azure, ensure that the correct endpoint URL is added to the Reply URL (Assertion Consumer Service URL) field.
   
   
2. In Decisions Studio, navigate to System > Settings, right-click SAML Settings, and select Edit.
3. From the Edit SAML Settings window, check the Enabled box. Then under Identity Providers, click ADD. 
4. From Add Identity Providers, provide a Display Name. Under Metadata Document Preference, select Fetch Metadata From URL. Then, map the applicable metadata via the chosen method. 
   The Metadata URL is generated by the AD server and is a required input. Providing it will automatically fill in all module fields except for the SP Issuer ID, which is the Portal Base URL.

   

   The screenshot below is an example of the Azure portal to demonstrate where to find the metadata URL for a created app.

   

5. Under the PROCESS IF USER NOT FOUND category, select Run Flow In Background. Under Run Flow, click PICK OR CREATE FLOW and pick SAMLDefaultCreateAccount. 
6. If manually configuring the module, click ADD under X.509 Certificates, and add a valid x509 Certificate. Click OK. If the metadata URL were used, the X.509 certificate would automatically be pulled.
   For more information on x.509 Certificates, see What an x509 Certificate is. 
7. In the Edit SAMLSettings window, select the newly added Identity Provider from the Primary Identity Provider list. Select the Log SAML Requests & Responsesoption and click SAVE. 
   These requests and responses are kept in a set of logs called SAML found at C:\\Program Files\Decisions\Decisions Server\Logs.

   

Enabling SSO

1. Navigate to C:\Program Files\Decisions\Decisions Server and open Settings.xml in a Text Editor.
2. Locate <EnableSingleSignOn> and change the false value to true.
3. Save the file, then close the file. 
4. Open DecisionsServerInstaller.exe, then select RESTART SERVICE. 
5. Continue testing on an Incognito Session; use the first open session to uncheck the Enabled button in the SAML module should something not work. 
   This saves users from having to set EnableSSO to false and restarting Service Host Manager again.

   
   

Troubleshooting

• Modify the UserID of the account
• Use SQL to modify the entity_account table and change the type of account
• Create a new account after SAML has been turned on and add it to the admin group

• Check the Retry on Log-In checkbox
• Ensure “[base]:[port]/Account/Login” is at the end of the Sign-On URL (case-sensitive)

• Add the IP/Domain to the list of ‘LoginAllowedIPs’ in the Settings.XML file
  (1.1.1.1 used as an example)