Connecting Mosaic with Microsoft Azure
Initial Setup with Microsoft Azure SAML
- On the Welcome to Azure! page, find the Enterprise applications option.
- Click on the Enterprise applications option and click on New application.
- Click on the Create your own application button.
- Input a name that is easily identifiable and select Integrate any other application you don't find in the gallery (Non-gallery).
- Once the app has been created by Azure, navigate to the Single sign-on menu and select SAML.
- Go to Mosaic settings → Security → SAML 2.0 Single Sign On
Please Note:
Only admins are able to access the “Security“ tab on Mosaic settings.
- On Mosaic’s SAML 2.0 Single Sign On menu, fill in:
- Domain:
- Domain associated with Microsoft Azure.
- For example,
[email protected]
has a domain ofthisisdomain.com
.
- For example,
- Domain associated with Microsoft Azure.
Please Note:
The email associated with the admin (who is setting up the SAML) must have the same domain as the one being inputted.
- For example, if the admin uses an email
[email protected]
, the only domain the admin could input isthisisdomain.com
.
-
SSO URL:
- Copy the Login URL under Set up [name of the application] App from Step #4 of the Azure Single sign-on menu.
-
Certificate:
- Download Certificate (Base64) under SAML Signing Certificate in Step #3 of the Azure Single sign-on menu.
- Open downloaded certificate with a text editor of choice.
- Copy the full content of the certificate.
![Screen Shot 2022-08-03 at 3.14.28 PM.png](https://files.readme.io/392870602f70dfdedce67fa2c358567b8dbb31a5ad9f6e8a62612a59e180dbdb-image_12.png)
- Copy and paste ACS URL and Entity ID from Mosaic’s SAML 2.0 Single Sign On menu to Microsoft Azure’s Basic SAML Configuration section; all other fields can remain untouched.
- Add a group to the SAML app through the Users and groups menu.
- Create a group on Azure
- Search for Groups
![](https://files.readme.io/0f07beeb60a7967960701a1314322c9610e6b0f465a59a68724c6465e511c02c-image.png)
- Create a new Group
![](https://files.readme.io/a29cb438cf89188efe2447ea27360935c272cbc34e8aa42b633e9629b14c56f6-image.png)
- Ensure the Group Type is
Security
, then fill out theGroup Name
![](https://files.readme.io/237c13232434e4296aeac5cc3a4da9ac3bae5593bfc6d0b490cb2bd0b693c045-image.png)
-
Assign
Members
you want to be authorized for the Mosaic Team- Note down the
Object ID
of the newGroup
you just created. This will be entered into Mosaic in a new field forSecurity Group ID
- Note down the
-
Then go back to the SAML app and add the Group through the
Users and Groups
Menu.
- You no longer need to add
Users
, instead you should add aGroup
, and theUsers
to theGroup
you added in the SAML app.
-
Next, click on Attributes & Claims and then Add new claim.
- Add the following additional attributes:
a. email
Mapping Source AttributesConfiguring Source Attribute Mapping for Email Aliases
To ensure seamless integration with Single Sign-On (SSO) systems, it's crucial to correctly configure the mapping of source attributes. This configuration allows the use of an email alias instead of the actual mailbox address for SSO authentication.
For instance, consider you're employing [email protected] as the alias and [email protected] as the primary mailbox address. In this scenario, the configuration on the Azure platform should map the source attribute to the alias ([email protected]), not to the mailbox ([email protected]).
For a full list of user profile attributes in Azure Active Directory B2C, refer to the Microsoft documentation here.
This setup is vital for aligning with Azure's user profile configuration requirements for aliases and mailbox addresses.
b. first_name
c. last_name
- Add the following additional attributes:
- Go back to Attributes & Claims and also Add a group claim.
- Select
Groups assigned to the application
and enter a Custom Name likesecurity_group
.
![](https://files.readme.io/3d1e11e6a174a71d7f1fe012bc554630eb28f06bdc6c414df681e46ce280022c-image.png)
![](https://files.readme.io/363b6330caf649797ef4dcbd04bc14d8b6c98da475a742f25bee8892c4278abb-image.png)
- Hit save and then SAML will be all set.
Setting up Multiple Teams with SAML:
- To set up multiple teams with SAML simply create another group and add users to that group. (Users can only be in 1 group!)
- When setting up SAML on the new Mosaic team. Skip the step to copy the
ACS URL
and theEntity ID
.- Then copy the new
Object ID
of the newGroup
and paste it into theSecurity Group ID
box when setting up SAML on the new Mosaic team.
- Next, go back to Mosaic and click Done.
- Upon successful activation, SAML 2.0 Single Sign On will have the following options.
- Next time a user with an email address belonging to the specified domain logs into Mosaic, they will be redirected to authenticate with Microsoft Azure the moment they click Next after inputting their email.
![](https://files.readme.io/2ee12c2-Screenshot_2023-10-23_at_5.49.59_PM.png)
![](https://files.readme.io/0c24142-Screenshot_2023-10-23_at_5.50.32_PM.png)
Updated 2 days ago