This feature is only available for the price plan Enterprise.

Azure SSO setup guide

In this article you will learn how to configure SSO with Azure.

Create the Oneflow application in Azure

1. Log in to the Azure portal with administrator permissions: https://portal.azure.com/. 
2. Press the menu icon on the top left of the page and select Azure Active Directory > Enterprise applications.
3. Click New application.
4. On the new application page, click Create your own application. 
5. Type “Oneflow” as the application name, and click the Create button at the bottom.
6. The system will redirect you to the Oneflow application you have just created. Add users by clicking Users and groups on the left pane.
   
7. Click Add user/group.
   
8. Go back to the Oneflow application (in Enterprise applications) and click Single sign-on on the left pane.
9. Download the Federation Metadata XML (third section).
10. Gather the following fields from the file content you downloaded earlier:

• Step one - entityID.
  Example :https://sts.windows.net/.../
  
  
• Step two - X509Certificate.
  It is a long string. If there is more than one certificate, choose the first one.
  
  Example: MIIDdDCCAlygA…
  Example: MIIC8DCCAdigA...
  
  
•  Step three - Single Sign-On Service
  (Attribute: Location)
  Example: "https://login.microsoftonline.com/.../saml2"

Enable Single Sign-On in Oneflow

1. Log in to your Oneflow account.
2. Go to Marketplace.
3. Click on Single sign-on > Enable (if disabled).
4. Click Edit.

Configure Single Sign-On (SSO)

1. Click on Edit 
2. Select an identity provider in the "Type" field.
3. Specify SSO service URL (the ‘SingleSignOnService (Attribute: Location)’ field from the ‘Federation Metadata XML’ file).
4. Specify Entity ID (the ‘entityID’ field from the ‘Federation Metadata XML’ file).
5. Specify X.509 certificate (the ‘X509Certificate’ field from the ‘Federation Metadata XML’ file).
6. Click Confirm in the top left corner.

Complete SSO configuration in Azure

After enabling the SSO in Oneflow, you need to note the information from the following fields of the Oneflow Single sign-on page.

1. In Oneflow, go to Marketplace > Single sign-on:
   - Identifier (Entity ID)
   - Reply URL (Assertion Consumer Service URL)
   - IdP login URL
2. In Azure, Enterprise applications, go to the Oneflow application and click Single sign-on on the left pane.
3. Fill in the Identifier (Entity ID) and the Reply URL (Assertion Consumer Service URL) fields that you obtained earlier on the Oneflow Single sign-on page.
4. The SSO configuration is complete! Try to log in using the IDP login URL.

Configure group sync in Azure

NOTE
You can configure groups between Azure and Oneflow in Oneflow, you need to contact your CSM or Support and request to enable enforce sso for your account. For more info please see this article.

To configure the group sync in Azure:

1. Go to the Oneflow application in Enterprise applications and click Single sign-on on the left pane.
2. In the User Attributes & Claims section, click Edit.
3. Click Add a group claim.
4. On the Group Claims right pane, select All groups.
5. In the Advanced options section, select the following options:

   - Customize the name of the group claim

6. Click Save.
7. Go to Users and groups.
   
8. Create a group by clicking on Add user/group.
   
9. Once the group is created, note the Object ID (you will need it later for syncing the group with a group in Oneflow).
10. Log in to your Oneflow account.
11. Go to Admin > Groups.
12. Get the group name that has to be synced with the group in Azure (if the group does not exist, create it by clicking Create group).
    
13. Create a support ticket with the title Azure SSO group sync and write the group information in the following format:
    “<Azure Group Object ID>”: “<Oneflow group name>”
    “<Azure Group Object ID 2>”: “<Oneflow group name 2>”
    “<Azure Group Object ID 3>”: “<Oneflow group name 3>”
    
    Example:
    “21032101-2ee1-4091-be23-746d2d759c90”: “HR - Sweden”.

Configure group sync in Azure for more than 150 groups

To configure group sync in Azure for more than 150 groups:

1. In Azure Enterprise applications, go to the Oneflow application and click Single sign-on from the menu on the left panel.
2. In the User Attributes & Claims section, click Edit.
3. If a group claim does not already exist, click Add a group claim.
4. In the Group Claims pane, select Groups assigned to the application.
5. In the Advanced options section, check the following options:
   - Customize the name of the group claim
   - Emit groups as role claims
6. Save.
7. Follow step 4 of the Configure Group Sync in Azure chapter of this article to create groups in Azure and sync them with groups in Oneflow.