Organization Client Portal User Guide

Organization Client Portal User Guide / Settings / Single Sign-On (SSO) BETA / SAML Authentication and Provisioning / Azure AD Procedure

Steps for Configuring SAML Authentication with Azure AD

If your organization uses Microsoft’s Azure Active Directory (Azure AD), follow this detailed procedure to set up the SAML protocol. This process has four parts:

A. Preparing the Client Portal

B. Preparing Azure AD

C. Configuring SAML in Azure AD

D. Configuring SAML in the Client Portal

A. Preparing the Organization’s Client Portal

  1. Go to the Settings tab in your organization’s Client Portal.

  2. Make sure all domain names needed for SAML authentication have been added and verified. If you need to add one, see the instructions provided in the Domain Names section.

1
2

  1. Go to the SAML Authentication and Provisioning section.

  2. Begin Step 1 of the configuration process as indicated on the screen. Select Microsoft as your identity provider (ID Provider).

  3. Select the domain name or names that are involved in the authentication process.

  4. Click Next.

3
4
5
6
  1. On the next screen, Step 2: SAML Configuration, download the XML metadata file. Leave this window open and start preparing Azure AD in a new browser window.

7

B. Preparing Azure AD

  1. In your Azure portal, go to the Enterprise applications section. You can access it quickly by typing the first few characters of the section name in the search bar.

    1

  2. Click New application.

    2

  3. On the next page, click Create your own application.

  4. Name the application (ex. Client Portal - Druide).

  5. Select Integrate any other application you don’t find in the gallery (Non-gallery).

  6. Click Create. Application creation can take several minutes.

3
4
5
6
  1. Once the application has loaded, indicate which users can use it: all users (A) or only some (B).

A) For all users

Go to Properties (A1) and set Assignment required to No (A2).

A1
A2

Click Save and close the panel.

B) For certain users only

Go to Users and groups (B1) and click Add user/group (B2).

B1
B2

Click the names of the desired users (B3), then the Select button (B4).

B3
B4

Finally, click Assign (B5).

B5

All preparations in Azure AD are now complete and you can begin SAML configuration.

C. Configuring SAML in Azure AD

  1. In the application you just created in Azure AD, go to the Single sign-on tab.

  2. Select the SAML tile.

    1
    2

  3. Click Upload metadata file.

  4. Select the metadata file you downloaded earlier from the Client Portal (section A, step 7).

  5. Click Add.

3
4
5
  1. Click Save in the next panel, then close it.

    6

Tip — You can also configure the data manually (see detailed instructions).

Note — If Microsoft asks whether you would like to do a test now or later, choose later.

  1. Go to the next block, Attributes & Claims, and click Edit.

    7

Tip — If you do not use Azure AD, you can find the required attributes in the SAML configuration overview.

  1. Next, click Unique User Identifier (Name ID) to make changes to the claim.

    8

  2. Click Choose name identifier format and change the format to Persistent.

  3. Change the source attribute to user.objectid.

9
10

Important — You must do one final verification in Attributes & Claims. Make sure that your configuration of the claim emailaddress (set to the attribute user.mail by default) contains an email address. If this is not the case, use another attribute such as user.userprincipalname, which usually corresponds to the user’s email address.


  1. Click Save and close the panel.

  2. Go to the next block, SAML Certificates, and click Edit.

    12

  3. Select Sign SAML response and assertion in the signing options.

  4. Click Save, then close the panel.

    13
    14

  5. Download the Certificate (Base64) file.

  6. Download the Federation Metadata XML file.

15
16

SAML configuration in Azure AD is now complete. Keep this window open in case you need to configure SAML manually in the Client Portal.

D. Configuring SAML in the Client Portal

  1. Return to the Client Portal window and go to Step 2: SAML Configuration. Click Upload a file and select the XML metadata file you just downloaded from Azure AD.

    1

Important — You can also configure the data manually (see detailed instructions).

  1. It is recommended you assign a resource person to receive technical details in case of login or configuration issues.

  2. Click Next.

2
3
  1. If your organization has one or more active subscriptions to Antidote Web, choose how you would like to manage Antidote Web access. You have three options:

  • Manual management
    Choose this option to activate SAML authentication without automatically granting access to Antidote Web. You can grant users access to Antidote Web from the Users tab in the Client Portal.

  • Impose access to Antidote Web upon login
    Choose this option to automatically grant access to Antidote Web to all users who log in with SAML authentication. If your organization has multiple subscriptions, specify which one should be used. If a user already has access to another subscription, their subscription will be changed the next time they log in.

  • Grant Antidote Web access to users who do not have access upon logging in
    Choose this option to grant Antidote Web access to users who do not already have it. For example, this option is useful if your organization already has a subscription, and you want new users to have access to a different subscription than those who already hold one.

Note — If you intend to set up automated provisioning later, please note that the Antidote Web access management settings defined by that configuration will override the options described here. Learn more >

  1. Click Next once you have made your choice.

4
5


  1. On the next screen, click Try logging in. The result of the test will appear in a new window, confirming a successful connection or providing an error report if the connection fails.

  2. Finally, click Activate SAML authentication.

6
7