How to configure Single Sign-On (SSO)

What you can do

Connect the CRIBWISE Admin Portal to your own identity provider with SAML single sign-on (SSO), so users log in with their existing company credentials and your own login policies apply.

The steps below use Azure Active Directory. Setting up Azure AD itself is out of scope – see the Microsoft documentation for that.

How SSO works in CRIBWISE

Once SSO is active, opening the Admin Portal address redirects the user to the login screen of the external identity provider. The user completes that authentication flow, including multi-factor authentication if it is required, and is then redirected back to the Admin Portal for authorization.

To pass authorization, the user must exist in the Admin Portal with an email address matching the authenticated user, and must have the privilege to access the Admin Portal – that is, belong to a user group with the role AP users. All restrictions set in Admin Portal user and user group management still apply.

Important: While SSO is active, it is not possible to log in to the Admin Portal with a username and password defined in Admin Portal user management.

SSO covers the Admin Portal only. For the Shop Floor Interface, users defined in the Admin Portal with the role SFI users log in with a login name and password, or with an external accessory – an RFID card, a barcode or a Coges key.

Account administrators can still reach the Admin Portal from the Customer Management Portal while SSO is active. To prevent that, change the access control settings.

Before you start

• Every user in the Admin Portal must have a unique email address. If two users share one, SSO cannot be activated.
• Every user who should log in must already exist in the Admin Portal, with an email address matching their principal name in Azure AD.
• You need rights to create an enterprise application in Azure AD.

The Admin Portal user…

…and the matching Azure AD user.

Important: A user from Azure AD cannot reach the Admin Portal if no matching user exists in the portal.

Quick start

Experienced users – set up SSO in 5 steps:

1. Open System settings → Access control → Setup SSO and note the three CRIBWISE URLs.
2. Create an enterprise application for CRIBWISE in Azure AD.
3. Fill in the basic SAML configuration with those values.
4. Copy the login URL, logout URL and certificate thumbprint back into the Admin Portal.
5. Save and press Set active, then test in a private browser window.

Steps

Step 1 — Collect the CRIBWISE values

1. In the Admin Portal, go to System settings → Access control.
2. Select Setup SSO.
3. Note the Entity ID, Login consumer URL and Logout consumer URL.

The three values that Azure AD needs.

Step 2 — Create the enterprise application in Azure AD

1. In Azure AD, set up a new enterprise application for CRIBWISE.
2. On the application detail, select to manage Single sign-on.

Managing single sign-on for the new application.

Step 3 — Fill in the basic SAML configuration

1. Edit Basic SAML Configuration.
2. Set Identifier (Entity ID) to the Entity ID from the Admin Portal.

Identifier (Entity ID).

1. Set Reply URL (Assertion Consumer Service URL) to the Login consumer URL.

Reply URL.

1. Set Logout URL to the Logout consumer URL.
2. Save the configuration.

Logout URL.

Step 4 — Collect the Azure AD values

1. In the SAML Certificates section, note the certificate Thumbprint.

The certificate thumbprint.

1. In the application setup section, note the Login URL and Logout URL.

Login and logout URLs from Azure AD.

Step 5 — Finish and activate in the Admin Portal

1. Go back to the SSO setup page in the Admin Portal.
2. Set Login URL to the login URL from Azure AD.
3. Set Certificate thumbprint to the thumbprint from Azure AD.
4. Set Logout URL to the logout URL from Azure AD.
5. Save the settings and press Set active.

The portal checks that every user has a unique email address. If not, SSO is not activated.

Success: Opening the portal address redirects to the Azure AD login page.

The completed configuration, ready to be set active.

Step 6 — Test before you log out

Keep the current Admin Portal window open, and open a new browser window in private mode to reach the portal. Perform a test login there. If anything goes wrong, deactivate SSO in the original window.

Warning: Activating SSO while access for account administrators is disabled can leave you unable to log in to the Admin Portal at all.

Troubleshooting

Related articles

• System settings – access control settings, including access for account administrators.
• How to create and manage users – the users that SSO logins are matched against.
• How to create and configure a user group – where the AP users and SFI users roles are granted.
• Admin Portal permissions reference – what each permission allows once a user is authenticated.