To set up SSO for Requester login with Azure AD and SuperOps, please follow the below steps.
📝Note: Separate SSO applications should be created in Azure AD for Technicians and Requesters. Refer to this article for detailed instructions on setting up SSO for Technician logins with Azure AD.
1. Login to your Azure AD instance.
2. Choose the Enterprise Application option from the navigation menu on the left.
3. Click on '+ New Application
4. Since we are yet to be listed in AD's marketplace, Click " + Create your own application".
5. Give it a name and choose the option, " Integrate any other application you don't find in the gallery (Non-gallery)".
6. Here, assign users who must have access to SuperOps.
7. Now choose, "Set up single sign-on" and choose SAML.
📝 Note: If you configure CNAME after setting up SSO, ensure that you update them in the corresponding Azure settings as well.
8. Edit the Basic SAML configuration as shown below and click save:
-> Identifier (Entity ID): https://clientuser.superops.ai ( Mark it as default and delete any other default available.)
-> Reply URL: This is the URL present under Settings -> Requester Login -> SSO -> Consumer Service URL (from your SuperOps instance).
9. Next edit user attributes to pass the below values for SuperOps to allow the login requests coming in from Azure AD.
Click edit -> Add new claim, and add the below records ( Given as name - source attribute pair)
-> email - user.mail
-> firstname - {placeholder used for first name in your instance}
-> lastname - {placeholder used for first name in your instance}
Please keep in mind that these attributes are case-sensitive. You'll encounter issues unless the attributes are used precisely as mentioned.
10. To add the certificate under SuperOps, download the Base64 certificate available under section "3. SAML Signing Certificate" and open it in Notepad. Copy the certificate and paste it into SuperOps under Settings -> Requester Login -> SSO -> Certificate.
11. Similarly to Section 4, copy the login URL and paste it under the login URL in SuperOps. ( under Settings -> Requester Login -> SSO -> Login URL ).
12. You are all set!