Azure Single-Sign-on Setup

The following describes how to set up Single-Sign-on in dbFront using Azure (Azure.com).

Note: Microsoft offers a Free Azure Active Directory account which can be somewhat helpful for testing Single-Sign-on.  For pricing and limits see: Azure Active Directory Pricing.  The two most significant limits of the free version are:

1. No support for groups (can't test groups including admin access),
2. No Public Certificate (therefore not secure).

Information Collection

When setting up Azure Single-Sign-on you need to collect or decide on the following pieces of information:

1. Determine a display name for your application. e.g. "dbFront - Records Maintenance",
2. Determine the root URL for your dbFront install.  This would be something like:
   • https://dbFront.YourCompany.com/dbFront/ (public server with SSL)
   • http://localhost/dbFront/ (Non-SSL testing URL)
   • NOTE: Azure requires SSL for all except "localhost".
3. Create a unique application id:  A suggested value is "sp.dbFront.YourCompany.com",
4. Determine / Create an Azure group for administrators: e.g. "dbFrontAdmins".

Azure Application Setup Steps

1. Browse to Azure and logon: https://portal.azure.com,
2. On the Azure Home screen click on the App registration services link to view the configured applications,
3. Click on the New registration to configure a new application,
4. This will open a window with the following prompts;
   1. Name: Set with the Display name previously chosen,
   2. Supported account types: Set as appropriate for your needs,
   3. Redirect URI: This should match the root URL for your dbFront install,
      e.g. "https://dbFront.YourCompany.com/dbFront/default.aspx",
      Note: The "/default.aspx" must be included when using Azure, 
5. Click on the blue  Register  button to create your new Azure application,
6. This will open your new Azure application in the [Overview] screen,
7. From the [Overview] screen:
   1. Save the Application (client) ID and enter in dbFront as the dbFront Application Id (see below)
      e.g. "7a0a500e-2240-467b-a4dc-4151d91907db"
   2. Inside the [Overview] screen click on [Endpoints],
      (a link above the details beside [Delete]),
      1. A side-window with multiple endpoints will appear,
      2. Save the SAML-P sign-on endpoint and enter in dbFront as the Azure Endpoint Url (see below)
         e.g. "https://login.microsoftonline.com/92c67466-b89b-46a5-9c0f-1a6804dee116/saml2"
      3. Close the [Endpoints].
8. Click on [Manage] / [Branding] and update:
   1. Publisher Domain: Update the domain to match your application domain,
   2. Update other settings as desired.
9. Click on [Manage] / [Token Configuration]  and:
   1. Click Add Optional Claim,
   2. Select the token type of ID,
   3. Select the Email token and click Add.
10. Click on [Manage] / [Manifest] and update the manifest JSON:
    NOTE: Update the Manifest last because other changes are liable to overwrite your custom Manifest changes.
    1. groupMembershipClaims: from null to "SecurityGroup" in quotes,
    2. Save the Manifest changes and exit.

dbFront Application Setup Steps

Once the application is set up in Azure, you can then proceed with the setup in dbFront.

The Azure specific instructions are:

1. Single-Sign-On Service: Azure,
2. dbFront Application Id: As collected from [Overview] config above,
3. Azure Endpoint Url: As collected from [Endpoints] config above,
4. Azure Public Certificate: Enter if provided, leave blank for the Free Azure,
5. Azure Admin Group: Enter the Object Id of the Azure admin group that should have Admin access to dbFront,
   See Azure Groups for more details on finding and using a group's Object Id.
6. Logout Redirect Url: Enter "https://www.office.com/apps?auth=1".
   This special URL will allow users who log out of dbFront to return to the Microsoft Apps menu where they can either log out completely or start another application.

For complete instructions on completing the dbFront Single-Sign-on setup see: Single-Sign-on

Trouble Shooting

For a list of Single-Sign-On issues and answers see: Single-Sign-On Questions