SSO

This page summarizes how to setup SSO with an external Identity Provider.

Overview¶

The Single Sign-On (SSO) feature allows users to authenticate to the aedifion.io platform using their organization's own Identity Provider (IdP).

SSO allows users to authenticate once and gain access to multiple applications without needing to log in again for each one. The IdP manages the authentication process, leveraging a single set of credentials for all integrated services. This improves security, reduces password fatigue, and enhances user productivity by streamlining the login process across various applications.

The aedifion.io platform can authenticate users via OIDC and SAML, i.e., any third party IdP that supports these protocols can be integrated. In the following sections, detailed instructions are given for setting up popular IdPs, while it should be understood that the SSO feature is not limited to them.

Once the SSO integration is set up and working, it will do the following:

• Any user authenticated and authorized by the IDP is granted access to the aedifion.io platform.
• If the user, identified by their email address, already exists on the aedifion.io platform, the existing user account is linked to the user account on the IdP.
• If the user does not exist, yet, on the aedifion.io platform, a new user account is created on the aedifion.io platform and then linked to the user account on the IdP. The new user account is not assigned any roles by default, thus won't be able to access any projects.

Azure Active Directory¶

Azure AD can be integrated via OIDC or SAML.

OIDC-based Setup¶

1. On the Azure portal, navigate to App registrations.

   

2. Click "New registration" and provide the following information:

   • Set a name that identifies this application to the user who logs in to it. We recommend name "aedifion.io", but you can choose freely.
   • Keep the "Supported account types" limited to "Accounts in this organizational directory only (Single tenant)", which is the safe default.
   • Select "Web" for Redirect URI and enter the REDIRECT URI obtained from the aedifion support.

   

3. In the newly registered application, go to "Manage" -> "Certificates & secrets" → "New client secret" to generate a secret.

   • The client secret will be used by the aedifion.io IdP to connect to your IdP, so "aedifion.io IdP" seems a good name for the secret, but you can freely choose it.
   • Choose expiry in line with your organizational policies and keep in mind that SSO will cease to work once this secret expires.
   • Copy/note the secret's value now, as you won't be able to retrieve it once closing the view.

4. By default, everyone in your organization can now sign up and sign in to your dedicated aedifion.io deployment. If access shall be restricted:

   1. On the Azure portal, navigate to Enterprise Applications.
   2. Locate the created application, e.g., using the search.
   3. Go to "Manage" → "Properties" and switch "Assignment required" to "Yes".
   4. Under "Manage" → "Users and groups", grant users and/or groups access to the application.

5. Finally, send the following data to your aedifion contact person through a secure channel:

   • From "Overview" → "Endpoints": "OpenID Connect metadata document", an URL that looks like this https://login.microsoftonline.com/<TENANT ID>/v2.0/.well-known/openid-configuration
   • From "Overview" → "Essentials": "Application (client) ID", a UUID string.
   • The "Value" of the secret generated in the previous step, a random string value.

6. The aedifion support will validate your information and setup the SSO integration on your dedicated aedifion.io platform instance, after which it is ready to work.

SAML-based Setup¶

1. On the Azure portal, navigate to Enterprise Applications, then go to "Manage" -> "All Applications".

   

2. Click "New Application" and then "Create your own application" and provide the following information:

   • Set a name that identifies this application to the user who logs in to it. We recommend "aedifion.io", but you can choose freely.
   • This application is meant to "Integrate any other application you don't find in the gallery (Non-gallery)".

   

3. You will be taken to your newly created app. If not, go to the Enterprise Applications and search by name to find it.

4. In your newly created app, go to "Overview" and in the "Getting Started" section click on "Set up single sign on".

   

5. Select "SAML" and in Point 1 "Basic SAML configuration", set the two required fields:

   • For "Identifier (Entity ID)" enter the ENTITY ID obtained from the aedifion support.
   • For "Reply URL" enter the REPLY URL obtained from the aedifion support.

   Don't forget to save.

6. On your application, go to Point 3 "SAML Certificates" section, copy the "App Federation Metadata Url" and send it to your aedifion contact person.

7. By default, only assigned users in your organization can now sign up and sign in to your dedicated aedifion.io deployment now. Either go to "Manage" → "Properties" and switch "Assignment required" to "No" to enable access for all users in your organization. Or, go to "Manage" → "Users and groups" and assign users and/or groups access to the application.

8. The aedifion support will validate your information and setup the SSO integration on your dedicated aedifion.io platform instance, after which it is ready to work.