Configure SSO for an On Premise Instance

This guide outlines how to configure SSO in your organization for use with either Azure AD SSO or Windows Server ADFS.

1 Azure AD SSO

1.1 On-Premise Instance

To configure your on-premise Syngrafii instance to support Azure AD SSO you will have to register an App under your Azure AD (see Configuring Azure AD) and provide Syngrafii with the following details in a secure manner:

• Application (client) ID
• Directory (tenant) ID
• Client Secret

If you are managing your own server, please contact support@syngrafii.com for additional details. 

1.2 Configuring Azure AD

Note:

When you see yourinstance.syngrafii.com URL referenced make sure you replace it with your Syngrafii instance URL.

1. Login to Azure Portal
2. Open appropriate Azure Active Directory
3. Click App registrations
4. Click New registration
5. Under Name, enter Your Company | Syngrafii
6. Under Supported account types, select Accounts in this organizational directory only (Single tenant)
7. Under Redirect URI, select Web and enter https://yourinstance.syngrafii.com/sign-ad
8. Click Register
9. Click Authentication
   a. Under Logout URL, enter https://yourinstance.syngrafii.com/signout
   b. Under Implicit grant, enable ID tokens
   c. Click Save
10. Click Certificates & secrets
    a. Click New client secret
    b. Under Description, enter Syngrafii 2020
    c. Under Expires, select preferred option
    d. Click Add
11. Click Token configuration
    a. Click Add optional claim
    b. Under Token type, select ID
    c. Under Claim, select email, family_name, given_name
    d. Click Add
12. (Optional) Click Branding
    a. Under Home page URL, enter https://yourinstance.syngrafii.com
    b. Under Terms of service URL, enter https://yourinstance.syngrafii.com/terms
    c. Under Privacy statement URL, enter https://yourinstance.syngrafii.com/privacy
    d. Click Save
    e. Under Publisher domain, select Update domain,
    f. Select Verify a new domain
    g. (Optional) Under Publisher domain, enter yourinstance.syngrafii.com
        i. Click Download
            1. For Syngrafii hosted private instances send the file to Syngrafii and request that it be uploaded
            2. For on-premise instances upload the file to the specified location
        ii. After the file has been uploaded, click Verify and save domain

2 Windows Server AD FS

2.1 On-Premise Instance

To configure your on-premise Syngrafii instance to support Windows Server AD FD SSO you will have to configure a trusted WS-Federation relying party within Windows Server AD FS (see Configuring Windows Server AD FS) and provide Syngrafii with the following details:

• WS-Federation metadata endpoint

If you are managing your own server, please contact support@syngrafii.com for additional details.

2.2 Configuring Windows Server AD FS

Note:

When you see yourinstance.syngrafii.com domain referenced make sure you replace it with your Syngrafii instance domain.

1. Start Administrative Tools > AD FS Management
2. Click Add Relying Party Trust…
3. Select Claims aware
4. Click Start
5. Select Enter data about the relying party manually
6. Click Next
7. Under Display Name field, enter Syngrafii
8. Click Next
9. Skip Configure Certificate by clicking Next
10. Select Enable support for the WS-Federation Passive Protocol
11. Under Relying party WS-Federation Passive protocol URL, enter https://yourinstance.syngrafii.com/sign-ws
12. Click Next
13. Configure Access Control Policy and click Next
14. Review configuration and click Next
15. Select Configure claims issuance policy for this application and click Close
16. Click Edit Claim Issuance Policy…
17. Click Add Rule…
18. Select Send LDAP Attributes as Claims and click Next
19. Under Claim rule name field, enter Active Directory
20. Under Attribute store, select Active Directory
21. Add the following mappings:

    22. Click Finish

    23. Click OK