Motadata Docs

Azure AD

ServiceOps offers support for SAML 2.0, which facilitates integration for Single Sign-On. ServiceOps acts as the Service Provider (SP) and it integrates with Identity Providers (IdP) using SAML 2.0. The integration basically involves supplying details about SP to IdP and vice-versa. ​Once you integrate ServiceOps with an IdP, the users simply have to sign-in to IdP and then, they can automatically sign-in to ServiceOps from the respective identity provider’s GUI without having to provide credentials again. ​ServiceOps supports integration with Azure.

To configure SSO with the Azure AD service, follow the below steps:

  1. Sign-in to the ServiceOps portal as a Technician.
Sign-In Page
Sign-In Page
  1. Navigate to Settings > Admin > Organization > System Preference > Application Settings tab, and the following page appears.Verify that the Base URL (3) is the same as the portal URL. If it has default IP Address, update it, and click Update (4) as shown below.
System Preference
System Preference
  1. Navigate to Settings > Admin > Users > SSO Configuration and the below page appears.
SSO Configuration Page
SSO Configuration Page
  1. Enable the SSO functionality, and the following parameters appear. The parameters are available only if the SSO functionality is enabled. By default, it is disabled. In this, the IDP details of the Azure AD portal are to be configured in the ServiceOps while the SP details in the Azure AD.
SSO Configurations
SSO Configurations
  1. Provide the following details:
    Parameter Description
    Enforce to authenticate with Single Sign-On only (Refer Note) This parameter indicates that the users created in the system must be authenticated and allowed via SSO Login only. If enabled, the Login button (for local authentication) will be hidden for all the users. Also, the parameter Excluded Technicians will be available for configuration. By default, it is disabled.

    Note: Once the SSO is enabled, the user can only login via SSO using valid configurations and credentials.
    Auto Create User Enable if the user is to be created automatically, if not available in the system. By default, disabled.
    Excluded Technicians Select the technicians to exclude from using the Single Sign-On functionality. You can select multiple technicians. Also, you can search for the desired technician. Here, chosen technicians having Local Authentication mode will be allowed to use SSO login mechanism.
    IDP Entity ID Enter the Entity ID of the IDP available from the Azure AD portal as shown below. It is a mandatory field.
    IDP Login URL Enter the login URL of the IDP on which the user will get redirected. It is available in the Azure AD portal as shown below.
    IDP Logout URL Enter the logout URL of the IDP on which the user will be redirected once signing-out from the ServiceOps portal. If not provided, the user will remain on the same page. This field is optional.
    IDP Security Certificate Enter the certificate that IDP provides for integration. The response sent by the IDP is validated using it.
Azure AD - IDP Details
Azure AD - IDP Details
SP Entity ID It displays the entity ID of the Service Provider. This is to be configured in the Azure AD portal in the ‘Identifier (Entity ID)’ field.
Assertion Consumer URL It displays the endpoint of the ServiceOps application where the IDP posts the SAML responses. This is to be configured in the Azure AD portal in the ‘Reply URL’ field.
SP Single Logout URL It displays the URL to which the user gets redirected after sign-out. This is to be configured in the Azure AD portal in the ‘Logout URL’ field.
SP Public Key It is provided by the Service Provider.
SP Private Key It is provided by the Service Provider.
SP Metadata File Download the metadata file provided by the Service Provider. It contains all the details about the interaction of the Service Provider and the SAML enabled entity.

Notes:

  • Super admin (Tenant registered User) is always allowed to login normally without SSO even if not added in the exclusion list.
  • The Login button is always visible whether this option is enabled or not.(If any super admin user wants to update/configure, then one can login and update).
  • If this option is enabled, no one can login using “Login” button. Also, an error message “You are not allowed to Login from here. Try login from Single Sign on Login page.” is displayed. (Except Tenant user).
  1. Click Update, and a confirmation message “SSO Configuration has been updated successfully” will appear.
  2. To configure the SAML settings in Microsoft Azure, navigate to Enterprise Application > SSO Azure > Single Sign-On tab, and the following page will appear:
Setting up Single Sign-on with SAML
Setting up Single Sign-on with SAML
  1. Edit the Basic SAML Configuration and configure the following details:
    • Identifier Entity ID
    • Reply URL
    • Sign-on URL
    • Relay State
    • Logout URL
Basic SAML Configuration Parameters
Basic SAML Configuration Parameters
  1. Open the ServiceOps Portal and sign-in using the SSO Login button as shown below.
ServiceOps Portal
ServiceOps Portal
  1. You will be redirected to the Microsoft Azure sign-in page, as shown below.
Microsoft Azure Sign-in Page
Microsoft Azure Sign-in Page
  1. Sign-in to Microsoft Azure, and you will be redirected to the ServiceOps Portal. For Signing out, go to username, and click Sign-Out. You will be redirected again to the Microsoft Azure page.
Signing-Out from the ServiceOps Portal
Signing-Out from the ServiceOps Portal
  1. To import users, click the User Import Configuration button and a popup appears.
    Enter the following details:

    • Enable the functionality. By default, it is disabled.
    • SSO Provider: Select the provider of SSO functionality.

Notes:

  • Here, you can import both Azure AD and Office 365 users.
  • Office 365 uses Azure Active Directory for user management; hence the configurations of both the services are identical.
User Import Configuration
User Import Configuration
  1. In the Configuration tab, configure the following details:
    • Client ID: Enter the Client ID.
    • Client Secret: Enter the Client Secret.
    • Tenant ID: Enter the Tenant ID. You can get these details from Microsoft Azure as shown below:
    • Group Filter: Enter the Group Filter whose users you want to import from the Azure AD.
    • Add Notification Email: Add the email address of the users who should be notified about the import.
Azure AD Details - Client ID and Tenant ID
Azure AD Details - Client ID and Tenant ID
Azure AD Details - Client Secret
Azure AD Details - Client Secret
  1. In the Mapping tab, map the fields that you want to import as shown below:
Import Users Mapping
Import Users Mapping
  1. In the Schedule tab, schedule the date and time when you want to import the users automatically.
Import Users Schedule
Import Users Schedule
  1. Once all the details are filled, click Save. You can also check the connectivity by clicking the Test Connection button.
  2. Once the connection is successful, click Import Users button and the imported users get added as requesters in the ServiceOps as shown below:
AzureAD Imported Users
AzureAD Imported Users
  1. Here, you can also click the Show History button to view the User Import Configuration history.
AzureAD Imported Users History
AzureAD Imported Users History

On this Page