How To Integrate N2W with Azure Active Directory SSO

Summary

This document provides details about the configuration required to integrate N2W with Azure Active Directory SSO

It shows an example of how to create and configure Enterprise application in Azure and what configurations are required in N2W.

• Please check the following link if ldP integration is supported for your version pricing & feature
• For additional information about IdP integration, read our user guide, section 19, N2W IdP Integration 

Description

Configuration

For this guide we have created a test Azure AD account and have created one user & group in it.

1. We will start with the configuration on the Azure AD side.  
   First you need users & group, once you have a user/group next steps is to create "Enterprise application" (you should see link to create at the bottom)  
        
2. Next select “Non-gallery application” and insert a name  
3. Now click on "Assign users and groups"  
4. Add your user

5. Now that we have assigned a user, go back to overview and then click on “Set up a single sign on” -> SAML 
6. You will reach the setup page which has multiple sections, Fill in the parameters as follows:
   section 1: Basic SAML Configuration 

Attribute	Value
Identifier (Entity ID)	https://<N2W_Address>/remote_auth/metadata
Reply URL (Assertion Consumer Service URL)	https://<N2W_Address>/remote_auth/complete_login/
Logout Url	https://<N2W_Address>/remote_auth/complete_logout/

Section 2: User Attributes & Claims

1. In Azure Portal: Enterprise Applications > [your app] > Single sign-on > User Attributes & Claims > Edit

2. 

3. If there is an existing group claim — delete it

4. Click "Add a group claim" (this is a separate dedicated button, not "Add new claim")

   

5. 

   Select which groups to include (recommended: "Groups assigned to the application") 

6. Expand Advanced options

7. Check "Customize the name of the group claim"

8. Enter relevant group name in the Name field (leave Namespace empty)

9. Save

Note: An IdP user logging onto N2W can belong to only one N2W group

Section 3: SAML Signing Certificate
Check that "Signing Algorithm" = SHA-256 and download the Certificate(Base64) 

We will upload the certificate later to N2W server 

Section 4: Set up N2W
We will use this information for the N2W configuration later.

7. Switch to the N2W console and login with the  Admin user
8. Click on setting icon  -> Open "Identity provider" area.
   
   Go to Settings tab:  

Parameter	value
N2W IP or DNS	This should point to the public IP or DNS
Entity ID	Copy from Azure SSO setup - section 4
Sign in URL	Copy from Azure SSO setup - section 4
Sign Out URL	Copy from Azure SSO setup - section 4
X509 cert	Upload the certificate from Azure AD

Note: Use IdP’s login url for both sign in & sign out.

9. Add a group, Switch to group tab and add new group 
   The name of the group should match the group ID in Azure AD, for example:  

When creating the group, select the user type for users in that groups and the limitations/permissions, for example:       

Troubleshooting

1. Issue: Application identifier was not found     
   
   Possible resolutions: 
   Make sure the "N2W IP or DNS" in N2W config is set to the public ip and matches the URL in Azure AD configuration
    
2. Issue: Redirected to logout     
   
   Possible resolution: 
   Claim name is case sensitive - make sure it is cpm_user_groups and not Cpm_user_groups for example.
    
3. You can find additional SAML login issues here: SAML Identity Provider user log in issues