Login via Active Directory

Make your IS Tools application sync with your company’s Active directory to help the employees log in with their corporate account, which will ease internal user administration. This is done thanks to the Security Assertion Markup Language (SAML) which allows to exchange authentication and authorization data between your identity provider and us.

Prerequisites

  1. Azure AD account with the role Cloud application administrator or Application administrator (this allows you to create an “enterprise application” in the GUI).

  2. IS Tools administration application access.

Configure Azure

  1. Click Enterprise applications in the menu.

  2. Click the New application button in the top toolbar.

  3. Click Create your own application in the top toolbar.

  4. Enter a name and use the option Integrate any other application you don’t find in the gallery (Non-gallery).

  5. In the application’s page, open the menu item Single sign-on.

  6. Set Identifier (Entity ID) to https://[subdomain].istools.com/istools/saml2/service-provider-metadata/[registrationId].

  7. Set Reply URL to https://[subdomain].istools.com/istools/login/saml2/sso/[registrationId].

    Note that [registrationId] is an identifier that you pick that identifies this SAML connection. It has to be unique per instance. A good practice is to use an abbreviation for the customer.

  8. Copy the App Federation Metadata URL for later usage when configuring IS Tools.

  9. Click the Edit next to User Attributes & Claims.

  10. IS Tools reads the following attributes: email, firstName, lastName, groups, mobilePhone.

Configure IS Tools

  1. Open Administration application.

  2. Open Password policies.

  3. Click New button to create a new password policy.

  4. In the IDP Metadata URL field enter the App Federation Metadata URL you saved in previous step #8.

  5. In Registration ID, enter the [registrationId] you used in the Entity ID earlier.

Configure Role mapping (optional)

  1. Users can now login, but if you want to assign them to an application and roles automatically, you also need to use this password policy as SAML connection for role mapping in Application settings.

  2. Log in to the application.

  3. Open Role administration.

  4. Select a role you want to map, and enter the ID of the group in Azure (it may also be possible to map on group name instead).