Skip to main content

Configure SSO for a Private Brand Instance

Syngrafii Support Team
Updated

This guide outlines how to configure SSO in your organization for use with either Azure AD SSO or Windows Server ADFS.

 

1 Azure AD SSO

1.1 Private Instance Hosted by Syngrafii

In order to have your private instance hosted by Syngrafii configured to support Azure AD SSO you will have to register an App under your Azure AD (see Configuring Azure AD) and provide Syngrafii with the following details in a secure manner:

  • Application (client) ID
  • Directory (tenant) ID
  • Client Secret

1.2 Configuring Azure AD

Note:

When you see yourinstance.syngrafii.com URL referenced make sure you replace it with your Syngrafii instance URL.

  1. Login to Azure Portal
  2. Open appropriate Azure Active Directory
  3. Click App registrations
  4. Click New registration
  5. Under Name, enter Your Company | Syngrafii
  6. Under Supported account types, select Accounts in this organizational directory only (Single tenant)
  7. Under Redirect URI, select Web and enter https://yourinstance.syngrafii.com/sign-ad
  8. Click Register
  9. Click Authentication
    a. Under Logout URL, enter https://yourinstance.syngrafii.com/signout
    b. Under Implicit grant, enable ID tokens
    c. Click Save
  10. Click Certificates & secrets
    a. Click New client secret
    b. Under Description, enter Syngrafii 2020
    c. Under Expires, select preferred option
    d. Click Add
  11. Click Token configuration
    a. Click Add optional claim
    b. Under Token type, select ID
    c. Under Claim, select email, family_name, given_name
    d. Click Add
  12. (Optional) Click Branding
    a. Under Home page URL, enter https://yourinstance.syngrafii.com
    b. Under Terms of service URL, enter https://yourinstance.syngrafii.com/terms
    c. Under Privacy statement URL, enter https://yourinstance.syngrafii.com/privacy
    d. Click Save
    e. Under Publisher domain, select Update domain,
    f. Select Verify a new domain
    g. (Optional) Under Publisher domain, enter yourinstance.syngrafii.com
        i. Click Download
            1. For Syngrafii hosted private instances send the file to Syngrafii and request that it be uploaded
            2. For on-premise instances upload the file to the specified location
        ii. After the file has been uploaded, click Verify and save domain

2 Windows Server AD FS

2.1 Private Instance Hosted by Syngrafii

In order to have your hosted private instance configured to support Windows Server AD FS SSO you will have to configure a trusted WS-Federation relying party within Windows Server AD FS (see Configuring Windows Server AD FS) and provide Syngrafii with the following details:

  • WS-Federation metadata endpoint

2.2 Configuring Windows Server AD FS

Note:

When you see yourinstance.syngrafii.com domain referenced make sure you replace it with your Syngrafii instance domain.

  1. Start Administrative Tools > AD FS Management
  2. Click Add Relying Party Trust…
  3. Select Claims aware
  4. Click Start
  5. Select Enter data about the relying party manually
  6. Click Next
  7. Under Display Name field, enter Syngrafii
  8. Click Next
  9. Skip Configure Certificate by clicking Next
  10. Select Enable support for the WS-Federation Passive Protocol
  11. Under Relying party WS-Federation Passive protocol URL, enter https://yourinstance.syngrafii.com/sign-ws
  12. Click Next
  13. Configure Access Control Policy and click Next
  14. Review configuration and click Next
  15. Select Configure claims issuance policy for this application and click Close
  16. Click Edit Claim Issuance Policy…
  17. Click Add Rule…
  18. Select Send LDAP Attributes as Claims and click Next
  19. Under Claim rule name field, enter Active Directory
  20. Under Attribute store, select Active Directory
  21. Add the following mappings:
LDAP Attribute Outgoing Claim Type
E-Mail-Addresses E-Mail Address
Display-Name Name
Given-Name Given Name
Surname Surname
User-Principal-Name Name ID

    22. Click Finish

    23. Click OK

 

 

Powered by Zendesk