What is single sign-on? What is involved in the integration?

Single sign-on is an authentication scheme that allows a user to log in with a single ID and password to any of several related, yet independent, software systems.

FMX supports the WS-Federation and SAML 2.0 specifications for SSO with AAD. Users with an on-premise AD FS installation can integrate with FMX using these instructions.

Azure Active Directory (AAD)

Configure AAD for https://hostname.gofmx.com/login:

  1. Create a new enterprise application through AAD.
  2. Navigate to the new application then click on Single sign-on under the Manage heading.
  3. Select the SAML single sign-on method.
  4. Edit and save Basic SAML configuration:
  5. Enter https://hostname.gofmx.com/ for Identifier (Entity ID).
  6. Enter https://hostname.gofmx.com/login/saml2/callback for Reply URL (Assertion Consumer Service URL).
  7. Edit User Attributes & Claims:
  8. Add a new claim named urn:oid:0.9.2342.19200300.100.1.3 with source attribute user.mail.
  9. Add a new claim named urn:oid:2.16.840.1.113730.3.1.241 with source attribute user.displayname.
  10. (Optional) Add a new claim named urn:oid:2.5.4.20 with source attribute user.telephonenumber.
  11. Add a group claim, checking Security groups.
  12. Add a new claim named urndir:attribute-def:groups-mapping with source attribute of the mapping document generated following the instructions below titled Build the mapping document.
  13. Reply to this email with the value of App Federation Metadata Url under the SAML Signing Certificate header.

Build the mapping document

  1. Prepare a list of AAD group names and their object ID's to reference in step 3. Go to AAD > Groups > click Download groups.

  2. Prepare a list of FMX building and user type names and their ID's to reference in step 3. Navigate to https://hostname.gofmx.com/login/saml2/metadata and find this data in the descriptions of the urndir:attribute-def:building-access and urndir:attribute-def:user-type-id attributes.

  3. Use the prepared reference data to build a mapping document following the contextual documentation and sample data in the attached mapping document sample-groups-mapping.json. Be aware that there is a roughly 20k character limit on this document that's imposed by AAD.

 

Was this article helpful?

  • 0 out of 0 found this helpful