Page Comparison

How to Configure Azure Active Directory for OneList

Redirect URI: https://<OneList hostname>/rolemananger/signin-azure

Delegated API permissions:

• Microsoft Graph
  • Mail.Read
  • openid
  • profile
  • User.Read

• Azure tenant id
• Application id
• Client secret

{
"clientid": "<Application id>",
"clientsecret": "<Client secret>",
"Authority": "https://login.microsoftonline.com/<Azure tenant id>/v2.0",
"CallbackPath": "/signin-azure",

"UserNameClaim": "preferred_username",
"SaveTokens": false
}

Select this option when Windows AD log in is used as OneList UserName. The prerequisite is Azure AD Premium license.

Azure SAML configuration: https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/configure-single-sign-on-non-gallery-applications

Identifier (Entity ID): https://<OneList hostname>

Reply URL (Assertion Consumer Service URL): https://<OneList hostname/saml-azure

Required claim:

• User Unique Identifier (Name ID) - maps to AD login or UPNselect the claim organization for your organization:
  • user.onpremisessamaccount - this is user's Windows AD login
  • user.userprincipalname - this is user's UPN
  • user.email - this is user's email address

Additional claims:

• http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname
• http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname
• http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress

• App Federation Metadata Url

Registration steps: https://docs.microsoft.com/en-us/aspnet/core/security/authentication/ws-federation?view=aspnetcore-2.2

Rely Party: https://<OneList hostname>/ 

Map the SAMAccount-Name to the Name ID claim. 

Hint: use the Windows event log on the ADFS server to investigate errors, and the rely party above must end with '/'.

Add rules to map claims:

• sAMAccountName => Name ID
• sn => Surname
• givenname => GivenName
• mail => Email

• Meta data address, e.g. 

Registration steps: https://developers.google.com/identity/protocols/OpenIDConnect

Redirect URL: https://<OneList hostname>/rolemanager/signin-google

• client id
• client secret

Create a connected app: https://developer.salesforce.com/docs/atlas.en-us.api_streaming.meta/api_streaming/code_sample_auth_oauth.htm

Callback URL: https://<onelist hostname>/rolemanager/signin-salesforce

• consumer key
• consumer secret

From the "XML metadata" file of the Duo Access Gateway admin console:

• SSO URL;
• Entity ID;
• Signing X509Certificate.

OpenID Connect registration: https://help.sap.com/viewer/6d6d63354d1242d185ab4830fc04feb1/Cloud/en-US/8a0aa2ea5a0744879a7ec2be0bc023cf.html

Callback URL: https://<onelist hostname>/rolemanager/signin-sap

• Client ID
• Secret