View source for 5.19:Saml2-single-sign-on-integration-guide/MicrosoftAzureAD

= Microsoft Azure Active Directory SSO Configuration = 
Microsoft Azure Active Directory (AD) single sign-on (SSO) enables users to sign in just one time to applications in the Microsoft Azure AD in order to access integrated applications.

With Azure AD SSO, users can sign in with one account to launch applications from the Office 365 portal, Dynamics 365, or the Azure AD MyApps access panel. Moreover, administrators can control user account management, and automatically add or remove user access to applications based on group membership. Without SSO, users have to remember passwords and sign in to each application separately.

Bright Pattern supports Azure AD SSO using the SAML (Security Assertion Markup Language) SSO method, which works for applications that authenticate using a SAML protocol like SAML 2.0 or WS-Federation.

With SAML SSO, Azure AD authenticates to the application by using the user's Azure AD account. Azure AD communicates the credentials to the application through a connection protocol. With SAML-based SSO, you can map users to specific application roles based on rules defined in your SAML claims.

This article will show you how to configure Azure AD SSO for your organization.

You will learn how to:
* Create an enterprise application 
* Assign owner, users, and user groups to the application
* Configure the application for SAML-based SSO
* Configure application-specific domain and URLs
* Configure user attributes
* Get a SAML signing certificate
* Validate settings
* Add an SSO integration account in Bright Pattern
* Use Azure AD credentials in integration account properties

== Prerequisites == 
Before configuring Azure AD SSO, you will need the following:
* [https://www.office.com Microsoft Office 365 account]. If you are unable to log into Microsoft directly, please contact your Microsoft system administrator to review permission and access level settings.

* [https://azure.microsoft.com/en-us/free/ Microsoft Azure account/subscription] (free trial OK). Without this, you will have no directory and will not be able to access any data in Azure AD.

* Bright Pattern Contact Center version 5.3 or later

== Configuration in Azure Portal == 
This procedure generally follows Microsoft’s tutorial, [https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/configure-single-sign-on-portal Configure SAML-based single sign-on for an application with Azure Active Directory]. For more information on SSO, see [https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/what-is-single-sign-on Microsoft Azure documentation].

=== Step 1: Add the Bright Pattern application from the Gallery === 
# Sign in to the Microsoft Azure portal.<br /><br />
# Go to ''Azure Active Directory > Enterprise applications'' and click '''+ New application'''.<br /><br />[[File:ADSSO1b.png|thumb|800px|center|Create new enterprise application]]<br /><br />
# In the ''Add from the gallery'' section, type "Bright Pattern" in the search box.<br /><br />
# Select '''Bright Pattern Omnichannel Contact Center''' from the results panel and then add the app.<br /><br />[[File:MSSSO-Gallery-b-5312.png|thumb|800px|center|Application properties]]<br /><br />

Then you will see the overview page for the application.<br /><br />

=== Step 2: Add owner and users === 
Adding yourself, the admin, as a user allows you to configure and test the Bright Pattern Omnichannel Contact Center application. Adding other users allows others to use it as well.

# On the overview page for the application, go to ''Manage > Owners'' and then click '''add'''.<br /><br />[[File:MSSSO-Add-Owners-b-5312.png|thumb|800px|center|Add owners]]<br /><br />
# In ''Select Owners'', add yourself as the owner of the application so that you can modify the application. Then click '''Select'''.<br /><br />
# Then go to ''Manage > Users'' and groups and click '''Add user'''.<br /><br />[[File:MSSSO-Add-User-b-5312.png|thumb|800px|center|Add users]]<br /><br />
# Click '''Users and groups''', select the users with rights to use this application, and click '''Assign'''. Assigning allows the user to use Azure AD SSO.<br /><br />
# After you add the users, you can repeat these steps to add the group, if desired.

=== Step 3: Configure Azure AD SSO === 
# On the ''Bright Pattern Omnichannel Contact Center'' application integration page, go to ''Manage > Single sign-on'' and select '''SAML''' as the single sign-on method.<br /><br />
# The ''Set up SSO with SAML Preview'' page will open with the following boxes.<br /><br />[[File:MSSSO-SAML-ID-b-5312.png|thumb|800px|center|SSO configuration page]]<br /><br />

==== Basic SAML Configuration ==== 
In ''Basic SAML Configuration'', you will name the application being configured for SSO and specify the source of the SAML token.


[[File:MSSSO-Basic-SAML-b-5312.png|thumb|800px|center|Basic SAML Configuration]]


In this section, if you wish to configure the application in IDP initiated mode, enter the values for the following fields:
# '''Identifier (Entity ID)''' - Identifies the application for which SSO is being configured. This is also known as the Entity ID. Set the Identifier in the following pattern: '''<subdomain>_sso''' (e.g., "mycompany.brightpattern.com_sso").<br /><br />
# '''Reply URL''' - Specifies where the application expects to receive the SAML token. Set '''https://<subdomain>.brightpattern.com/agentdesktop/sso/redirect''' and be sure to replace “<subdomain>” with your contact center name.<br /><br />For example:<br />'''https://mycompany.brightpattern.com/agentdesktop/sso/redirect'''<br /><br />
# Click '''Save'''.<br /><br />


Click '''Set additional URLs''' and perform the following step if you wish to configure the application in SP initiated mode:
# In the '''Sign-on URL''' text box, set a URL using the following pattern: '''https://<subdomain>.brightpattern.com/'''<br /><br />
# Click '''Save'''.<br /><br />

==== User Attributes & Claims ==== 
In ''User Attributes & Claims'', you will specify what information (e.g., user's name, email, etc.) Azure AD sends to the application in the SAML token when a user signs in.

# Click '''Edit''' to set attributes for the identity provider to identify your system. You will see the following list of claims and values.<br /><br />[[File:ADSSO10.PNG|thumb|800px|center|User Attributes & Claims]]<br /><br />
# Edit the following attributes for Just-in-time (JIT) user provisioning:<br /><br />
## '''user.mail''' - Delete this from the list because it is unnecessary<br /><br />
## '''user.givenname''' - Click '''Edit''' and change ''Name'' to ''FirstName''<br /><br />
## '''user.userprincipalname''' - (Note there are two--choose the one with claim name that ends with “/nameidentifier”.) Leave this attribute as-is. This attribute is the username of the user in Bright Pattern Contact Center.<br /><br />
## '''User.userprincipalname''' - (Note there are two--choose the one with claim name that ends with “/name”.) Click '''Edit''' and change ''Name'' to ''Email''<br /><br />
## '''User.surname''' - Click '''Edit''' and change ''Name'' to ''LastName''<br /><br />
When done, your list should look like this:<br /><br />[[File:ADSSO11.PNG|thumb|800px|center|Edited attributes]]<br /><br />

'''Note:''' Bright Pattern does not map claims to email; Bright Pattern maps claims to the same user account name only. This means that existing users logging in with their username will be logged in only if their username matches an existing user account in Bright Pattern Contact Center. If JIT is enabled, if a user logs in, and if their username does not match an existing account name, a new user account will be created.


==== SAML Signing Certificate ==== 
In the ''SAML Signing Certificate'' section, you will create and download a SAML certificate, which Azure AD uses to sign the SAML tokens that it sends to the application.

# Click '''Edit''' and select '''New Certificate'''.<br /><br />[[File:ADSSO12b.png|thumb|800px|center|Create new certificate]]<br /><br />
# In the new certificate row that appears, set the desired Signing Option and Signing Algorithm, and then click '''Save'''. In this example, we selected “Sign SAML response and assertion” and “SHA-256”.<br /><br />[[File:ADSSO13b.png|thumb|800px|center|Signing Option and Signing Algorithm]]<br /><br />
# Click '''download''' for the Certificate (Base64). The contents of this certificate will pasted into our configuration in later steps.<br /><br />
# After it downloads, open it and '''Install Certificate'''.


==== Set up ==== 
Next you will set up the application to use Azure AD as a SAML identity provider. This is needed for your app to connect to Azure AD.

Copy the '''Log in URL''' value and paste it into a separate text doc. When configuring your SSO integration account in later steps, you will paste this into the ''Identity Provider Single Sign-On URL'' property in your Bright Pattern SSO integration account.<br /><br />

==== Validate single sign-on ==== 
After configuration is done on the Azure portal, you should validate the settings to make sure that sign-in works correctly.

# Click '''Test'''.<br /><br />
# Click '''Sign in as current user'''. This lets you see if SSO works for you.<br /><br />[[File:MSSSO-Validate-c-5312.png|thumb|800px|center|Validate SSO]]<br /><br />
# If it works, you should see the Bright Pattern Agent Desktop login page. If it doesn't work, you will see an error message (see next section, ''Errors'').<br /><br />[[File:MSSO-AD-Login-5312.png|thumb|800px|center|Agent Desktop login]]<br /><br />

=== Errors and How to Fix Them === 
==== Application with identifier was not found ====
This error means that you are unable to sign in because the application for which SSO is being configured cannot be identified; that is, the Identifier (Entity ID) that you set in Basic SAML configuration is incorrect. Go back to Step 3 of this procedure and make sure that your Identifier is set in the following pattern: '''<subdomain>_sso''' (e.g., "mycompany.brightpattern.com_sso").


[[File:MSSSO-Identifier-Error-5312.png|thumb|800px|center|Application with identifier was not found]]<br /><br />


==== HTTP Error 404 ==== 
This likely means that the Reply URL is incorrect, and your tenant’s Agent Desktop cannot be found. Go back to ''Basic SAML Configuration'' and check that the Reply URL is '''https://<subdomain>.brightpattern.com/agentdesktop/sso/redirect'''


[[File:ADSSO-Error1.png|thumb|800px|center|404, Page Not Found]]<br /><br />


==== Redirects to Microsoftonline with HTTP Error 404 ==== 
This error could mean one of the following:

# In ''Basic SAML Configuration'', you tried to set a value for Relay State, which is unsupported. Go back and leave all optional URLs blank, and '''Save'''.<br /><br />
# More than one Azure AD application has a Reply URL that is pointing to the same tenant. Try checking other registered applications and enterprise applications in your Active Directory. Check their Reply URLs and remove any extraneous app Reply URLs that have a callback to your tenant.


[[File:ADSSO-Error-Relay.PNG|thumb|800px|center|404, Page Not Found]]


== Configuration in Bright Pattern == 
Next you will set up the integration account that enables your contact center to work with Azure AD.

=== Step 1: In Bright Pattern, add SSO integration account === 
In the Bright Pattern Contact Center Administrator application, go to ''Call Center Configuration > Integration Accounts'' and add a new [[Contact-center-administrator-guide/CallCenterConfiguration/IntegrationAccounts/SingleSign-On |  Single Sign-On integration account]]. This is a general type of SSO account that Bright Pattern uses for various integrations.<br /><br />[[File: Add-SSO-Integration-53.PNG|thumb|800px|center|Add SSO integration account]]

=== Step 2: Edit properties with your Azure AD app credentials === 
You will see an empty SSO integration account:<br /><br />[[File:CCA-Integration-Accounts-Single-Sign-On-Settings-2-531.png|thumb|600px|center|Add SSO integration account]]<br />
==== Properties ==== 
Set the account properties as indicated:<br />
* '''Name''' - Any descriptive name that conveniently identifies the account, such as "Azure SSO Integration"<br /><br />
* '''Enable Single Sign-On''' - Select the checkbox to enable SSO<br /><br />
* '''Use SSO for administrator portal login''' - Select the checkbox in order to enable SSO for users of the Contact Center Administrator application (i.e., the "administrator portal") who have the admin role.<br /><br />
* '''Identity Provider Single Sign-On URL''' - The “Login URL”, which is taken from Setup in Azure AD SAML SSO configuration (e.g., “https://login.microsoftonline.com/1f2b3d04-a056-7dfd-8dbd-d910e111c2a0/saml2")<br /><br />[[File:Azure-Saml-Setup2-5312.PNG|thumb|800px|center|Where to find Login URL]]<br /><br />
* '''Identity Provider Single Sign-On Logout URL''' - The “Logout URL”, is also taken from the Setup in Azure AD SAML SSO configuration. <br /><br /> [[File:Azure-Saml-Setup2-5312-logout-url.png|center|thumb|771x771px|Where to find Logout URL]]<br /><br />
* '''Identity Provider Issuer''' - The “Identifier (Entity ID)”, as set in the Basic SAML Configuration section of Azure AD SAML SSO configuration (e.g., “<subdomain>_sso”). The Identifier (Entity ID) set in Azure must match the Identity Provider Issuer in the Bright Pattern Configuration.<br /><br />[[File:Azure-Basic-Saml-5312.PNG|thumb|800px|center|Where to find the Identifier (Entity ID)]]<br /><br />
* '''Identity Provider Certificate''' - The Base 64 certificate that you downloaded from Azure AD. Copy and paste the entire contents, '''including''' the “BEGIN” and “END” tags.<br /><br />[[File:Azure-ADSSO-Cert-5312.PNG|thumb|800px|center|Copy certificate contents]]<br /><br />
* '''Enable Just-in-time user provisioning''' - Select the checkbox to enable just-in-time (JIT) user provisioning. JIT user provisioning automatically creates call center users on the first SSO login attempt authorized by the identity provider. If you enable JIT, you must also use a template (see next property).<br /><br />
* '''Use Template''' - Select this checkbox to copy assignments (e.g., username format, email, roles, teams, skills, etc.) from a specific user with the agent role, and apply them to new call center users created by JIT user provisioning.


Lastly, click '''Apply''' to save your changes.


This completes Azure AD SSO configuration.