Versions Compared

Old Version 38

changes.mady.by.user Megan Ellis

Saved on

compared with

New Version Current

changes.mady.by.user Megan Ellis

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.
Section
Column

Live Forms frevvo supports the Azure Security Manager for Single Sign On. Users/roles are automatically pulled from Azure AD into Live Forms frevvo cloud tenants and on-premise installations. Users are redirected to the Microsoft Azure login screen for authentication.

frevvo recommends using the SAML Security Manager for customers who want to manage users/roles from the  UI.

Column
width450px

On this page:

Table of Contents
maxLevel2

...

  • You will need a valid Microsoft Azure subscription

  • The frevvo.TenantAdmin and frevvo.Designer groups must be specified on your Active Directory server. The group names must be spelled as shown. Upper/lower case may be a factor for Open LDAP systems. These groups are required.

    • Tenant admin users must be assigned to the frevvo.TenantAdmin group.
    • Designer users must be assigned to the frevvo.Designer group
Warning
  • Contact the frevvo Customer Success team to schedule your Security Manager configuration.
  • frevvo Best Practice recommends that you create a user account in your Active Directory that will house all of your deployed Production forms/flows. This user can be named anything i.e.frevvoProduction but it must be a member of the frevvo.Designer group
  • If you want to preserve Applications/Forms/Flows developed in your trial/starter tenant to your desktop, perform these steps BEFORE changing the Security Manager. :
    1. Download the Applications/Forms/Flows that you want to preserve to your desktop as a backup. Do this for all user accounts that have Applications/Forms/flows that you want to keep.
    2. When the backup of all Applications/Forms/flows is completed, delete the user accounts in your Default Security Manager tenant.
  • There are two additional roles in - frevvo.Publisher and frevvo.ReadOnly.  These roles are optional.
    • In order to give a user the frevvo.publishers role, create the  frevvo.Publisher  group in your AD and assign users to it. Refer to the Administrator Best Practices for an explanation of this role.
    • In order to give a user the frevvo.ReadOnly role, create the frevvo.ReadOnly group in your AD and assign users to it. Following frevvo Best Practice eliminates the need for this role.
  • frevvo only supports the Azure Security Manager when is running in the tomcat container. Refer to our Supported Platforms for the list of supported/certified Application Servers.

...

  1. Create an Application for Live Forms frevvo in Azure
  2. Create the Live Forms frevvo metadata file
  3. Create the Azure Tenant IDP metadata file
  4. Create/edit the Live Forms frevvo tenant
  5. Log into your Live Forms frevvo tenant

Step 1 - Create an Application for

...

frevvo in Azure

frevvo assumes that customers have someone on staff that can successfully perform this step of the procedure. Information about is listed below to help you with this process.

...

Expand
titleClick here for some more tips....
Info

Do not include the curly braces in the URLs discussed below.

  1. Login to the Microsoft Azure Management console: https://manage.windowsazure.com or https://portal.azure.com with your Azure global administrator account.
  2. Click on the Azure Active directory link on the left side of the screen.
  3. Click on the App Registrations link.
  4. Click on the New application registration link for creating a new application.
  5. Enter the following details:
    1. Name:- Name of your frevvo Azure application
    2. Select who can use this application or access this API
  6. Configure the Redirect URL:

    1. Cloud Customers should use https://app.frevvo.com:443/frevvo/web/saml/SSO/alias/{t} - replace {t} with name of your frevvo tenant.

      Info

      For example, if you were changing the Security Manager from the Default Security Manager to the Azure SAML Security Manager for a frevvo Cloud tenant named mycompany.com, the REPLY URL would be:

      https://app.frevvo.com:443/frevvo/web/saml/SSO/alias/mycompany.com 

    2. On-premise customers should use http://<server>:<port>/frevvo/web/saml/SSO/alias/{t} - replace <server> with the ip of your server, <port> with the port number (if applicable) and t with the name of your frevvo in-house tenant.

      Info

      For example, if you were changing the Security Manager from the Default Security Manager to the Azure SAML Security Manager for a frevvo in-house tenant named mycompany.com, the REPLY URL would be:

      https://<server:port>/frevvo/web/saml/SSO/alias/mycompany.com 

    3. Click Register.
  7. Select the frevvo application from the list.
  8. Click the Branding tab
  9. Configure the Home Page URL:

    1. Cloud Customers should use https://app.frevvo.com:443/frevvo/web/tn/{t}/login - replace {t} with the name of your frevvo Cloud tenant.

      Info

      For example, if you were changing the Security Manager from the Default Security Manager to the Azure SAML Security Manager for a frevvo Cloud tenant named mycompany.com, the SIGN-ON URL would be:

      https://app.frevvo.com:443/frevvo/web/tn/mycompany.com/login

    2. On-premise customers should use http://<server>:<port>/frevvo/web/tn/{t}/login - replace <server> with the ip of your server, <port> with the port number (if applicable) and t with the name of your frevvo in-house tenant.

      Info

      For example, if you were changing the Security Manager from the Default Security Manager to the Azure SAML Security Manager for a frevvo in-house tenant named mycompany.com, the SIGN-ON URL would be:

      https://<server:port>frevvo/web/tn/mycompany.com/login


    3. Click Save.
  10. Click on the API Permissions tab.
    1. Click Add a Permission.
    2. Select Azure Active Directory Graph from the Supported legacy APIs section.
    3. For Application Permissions, select Read and write directory data (under Directory).
    4. For Delegated Permissions, select Sign in and read user profile (under User) AND Read directory data under (under Directory).
    5. Click on the Grant Permissions button select "Yes" option  and click on the Save button.
  11. Click on the Expose an API tab.
    1. Configure the Application ID URI:

      1. Cloud Customers should use https://app.frevvo.com:443/frevvo/web/alias/{t} - replace {t} with the name of your frevvo Cloud tenant.

        Info

        For example, if you were changing the Security Manager from the Default Security Manager to the Azure SAML Security Manager for a frevvo Cloud tenant named mycompany.com,the AP ID URL would be:

        https://app.frevvo.com:443/frevvo/web/alias/mycompany.com 

      2. On-premise customers should use http://<server>:<port>/frevvo/web/alias/{t} - replace <server> with the ip of your server, <port> with the port number (if applicable) and {t} with the name of your frevvo in-house tenant.

        Info

        For example, if you were changing the Security Manager from the Default Security Manager to the Azure SAML Security Manager for a frevvo in-house tenant named mycompany.com, the AP ID URL would be:

        https://<server:port>/frevvo/web/alias/mycompany.com

      3. Click Save.

  12. Click the Certificates & secrets tab.
    1. Generate the Client Secret. COPY/SAVE the VALUE in a notepad - you will need this for the frevvo tenant screen.  
      There is only one chance to retrieve the client secret key when you create the application for in Azure. Once you leave this screen the value will be hidden.
  13. Click the Overview tab.
    1. Copy the Application ID into your notepad. This is the value of the Client ID on the frevvo configuration screen.

    2. Copy the Directory ID into your notepad. This is the value of the Tenant ID on the frevvo configuration screen.
      Click Endpoints at the top of the screen. Copy the Federation Metadata Document URL from the list to your notepad. This is the URL that you will use to generate the Azure metadata

      Code Block
      titleExample of the Federation Metadata Document URL
      https://login.microsoftonline.com/3d532ac1-a43c-45c7-b0e9-cc814400ca11/federationmetadata/2007-06/federationmetadata.xml

       

  14. Proceed to Step 2 - Create the Live Forms frevvo metadata file
Warning

Just a reminder - you will need the Azure tenant ID, the client id and client secret for the frevvo application when configuring your Azure SAML tenant.

Step 2 - Create the

...

frevvo metadata file

Follow these steps to generate the frevvo metadata for your Azure SAML tenant. You can do this even if the tenant has not been created yet.

...

  1. Log onto as the superuser (on-premise) or the tenant admin (cloud).
  2. Access the Add Tenant (on-premise) or Edit Tenant (cloud) screen.
  3. Select Azure SAML Security Manager from the Security Manager Class dropdown.
  4. Copy the Service Provider (frevvo) metadata into the Service Provider field. You can include the xml prolog when you paste the Service Provider (frevvo) metadata.



  5. Copy the metadata from the Azure tenant IDP file previously created and paste it into the Identity Provider field.



  6. Enter the Federation Metadata Document URL that you copied from Endpoints in your frevvo Azure application. The URL is needed to handle Signing key rollover in Azure Active Directory. This URL is polled and refreshes the Azure IDP metadata every 3 hours. The new metadata is stored and automatically used as backup in case the URL is not accessible.

    Code Block
    titleExample of Federation Metadata Document URL
    https://login.microsoftonline.com/fece6b7e-fbc6-4b3a-8287-fc07c29aa2d2/FederationMetadata/2007-06/FederationMetadata.xml

  7. Check the Ignore Case checkbox if you are using LDAP for authentication and you want to ignore the case stored in LDAP systems for users/roles. The field is checked by default. Refer to the Mixed or Upper case User Names topic for more information.

  8. Enter the User Id. This should be the User property name that identifies the user. A typical value is userPrincipalName, givenname etc.

  9. Custom attributes can be mapped by typing the attribute names in the Custom field separated by a comma.
  10. Enter the following information in the API Access section.
    1. Enter the Azure tenant identifier into the tenant Id field. This can be obtained by viewing the endpoint Urls listed when you click View Endpoints in your frevvo Azure application.
    2. Enter the client id and client secret key that were created as part of registering the frevvo application into the respective fields.

  11. Configure a tenant admin account. This account  does not require Azure SAML authentication. This tenant admin can log directly into providing a default security manager built-in.
    1. The tenant admin id, password and email fields are required. The Change password on next login is optional. It is checked by default.
    2. When this tenant admin performs a form based login i.e. /frevvo/web/login, the password entered on this screen is used for authentication. This is also the URL used by the API. For cloud customers the <base> is always https://app.frevvo.com.
    3. If the tenant based login url is used i.e. /frevvo/web/tn/{t}/login then the Azure SAML login is used.



    The forgot password function works for an Azure SAML tenant admin user. For all others, it will display the error message about not being supported for the tenant.

  12. Configure the Business Calendar for your tenant. The escalation feature will use this calendar to calculate deadlines and send notification and reminder emails.
  13. Enter HTTP Auth credentials if required. Credentials for external secure web services accessed by the forms and flows in your tenant can be specified in this section.
  14. Click Submit.


Step 5 - Logging into a

...

frevvo Azure SAML Tenant

  1. Paste this tenant specific URL into your browser:

    1. Cloud Customers: https://app.frevvo.com:443/frevvo/web/tn/{t}/login - Replace {t} with the name of your Azure SAML tenant.

    2. On-premise Customers:http://<server>:<port>/frevvo/web/tn/{t}/login. Replace <server> and <port> with your server information and t with the name of your Azure SAML tenant.

    3. The user is redirected to the Azure login screen.



    4. If the user is authenticated,  screens display depending on the level of authorization specified for the user. Designer users will see the Projects Home Page while non-designer users will be directed to their Task List. You will see this redirection when logging into a space as well.

Note
  • Clicking the logout link in , logs the user out from only.
  • When a user logs in to space, the logout link will not be visible in an Azure AD (SSO) tenant.
  • When a user logs in to (non-space mode), the logout link will be visible in an Azure AD (SSO) tenant.
  • Cloud customers browsing app.frevvo.com or in-house customers browsing  http://<servername>:<port>/frevvo/web/login attempting to log into an Azure tenant directly (user@saml tenant name) will automatically be redirected to the Azure IDP login page.

Logged in User Display in Azure SAML

...

frevvo tenant

If your Azure SAML userIds are in the format <username>@<domain name>, when you login to  the tenant name is appended to the userId . This is as designed. You will see <username@domain name@frevvo tenant name> as the logged in user at the top of the screen. If your domain name is the same as your tenant name, it will appear as if the domain name is listed twice.

Image Modified

Azure SAML Tenant Built-in Admin User

Just a reminder that the tenant admin account can login directly into Live Forms frevvo or use the Azure SAML login.

When you create/edit a new tenant you are prompted to set up/modify a tenant admin user id, password and email address. This tenant admin does not authenticate via your Azure SAML IDP. It only exists in Live Forms frevvo. If you experience an issue with your Azure SAML configuration such that you can't login as an Azure SAML authenticated user, use this account to login to your tenant as a tenant admin in order to fix your Azure SAML configuration issue. Only one built-in tenant admin account is supported.

Image Modified

Browse this URL to login as the built-in admin: <base_URL>/frevvo/web/admin/login. When specified, will prepend the base URL to the URLs in your Form/Document Actions. The <base_URL> is typically http(s)://<your servername>:<port>.  For cloud customers the <base> is always https://app.frevvo.com.

  • You must use the admin specific URL - <base-url>/frevvo/web/admin/login - to login as the built-in admin. 
  • Non admin users can also login using the admin specific URL.

If your tenant originally used the Default Security Manager and then you changed to the Azure SAML Security Manager, this tenant admin account has already been setup. If you have forgotten the password, you can change it by :

  • Browsing the admin specific URL - <base-url>/frevvo/web/admin/login. Enter the built-in admin userid. Click  Forgot Password? This error message displays if any other user clicks on the Forgot Password? link after browsing the admin specific URL:

    Image Modified

  • Logging in as a Azure SAML authenticated tenant admin and changing the password via Manage Users.

Tip

The frevvo superuser admin (Cloud customers) and the in-house superuser can change the password for the built-in admin userid from the Edit Tenant page.

What if you do not remember the userid of your original tenant admin? Follow these steps:

  1. Login as your authenticated Azure SAML tenant admin
  2. Click Manage Users and click the edit admin icon.

Tip

The frevvo (Cloud customers) and in-house superuser can see the built-in admin tenant userid from the Edit Tenant page.

Session Timeout

Session timeouts are configured in and in your Azure SAML IDP. If a user's session ends before the IDP timeout is reached, they will automatically be logged back into if they try to access it again. It is recommended that the session timeout and the IDP session timeout be configured for the same value.

...

Code Block
Application error processing /frevvo/web/login?null java.lang.UnsupportedOperationException: null

Accessing a Space in a AzureAD tenant on a mobile device will not display a logout button.

Skew error when logging into an Azure tenant

Users logging into a Live Forms frevvo Azure SAML tenant may encounter the error "Access Denied.  Authorization Required". Examination of the frevvo.log shows the following entry:

Code Block
Response issue time is either too old or with date in the future, skew 60, time 2016-06-01T05:49:25.330Z


This error is typically caused by a clock synchronization issue between the SP (frevvo) and the Idp (Azure) or a genuine delay in the connection. If you get this error, you can change the value of the context parameter, com.frevvo.security.saml.response.skew, to specify the time in seconds allowed between the SAML request and response to a value greater than the default value of 60 seconds.

Follow the instructions listed in the Installation Tasks chapter to add the parameter.

...

The table below lists errors you may encounter when configuring your tenant with the Azure SAML Security Manager. Verify the recommended values to resolve.

ParameterValue to VerifyError on Edit Tenant PageError While Accessing Tenant
SP metadataUse a domain for which an application is not added in AzureNo issue updating tenantLogin will redirect to Microsoft login.
After entering credentials, following appears on the page:

Sorry, but we’re having trouble signing you in.
We received a bad request.

Additional technical information:
Correlation ID: 4a94d6f0-fcab-4953-8a4b-252cc18e938a
Timestamp: 2017-11-03 10:03:44Z
AADSTS70001: Application with identifier 'http://example.com:8082/frevvo/web/alias/testlink' was not found in the directory fece6b7e-fbc6-4b3a-8287-fc07c29aa2d2

No logs in frevvo

Invalid XMLorg.opensaml.xml.parse.XMLParserException: Invalid XML

Removed contents from metadata:

<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" ID="http___localhost_8082_frevvo_web_alias_testplan" entityID="http://localhost:8082/frevvo/web/alias/testlink">
</md:EntityDescriptor>		No issue updating tenantApplication Error

javax.servlet.ServletException: org.opensaml.saml2.metadata.provider.MetadataProviderException: No local entity found for alias testlink, verify your configuration.

Logs : same exception with stack
IdP metadataDo not remove Signature and RoleDescriptor sectionsTenant added successfullyNo errors but we should not use it (https://www.identityguy.com/articles/2013/6/4/a-look-at-azure-ads-web-sign-in-endpoints.html)

Removed certificates(<X509Certificate>) from IdP metadata xmlTenant added successfullyNo errors as we are providing the URL for IdP
Tenant IdWrong valueUI : Group access failure: HttpClientErrorException: 400 Bad Request

Logs : Same exception with stack		NA
Client IdWrong valueUI : Group access failure: HttpClientErrorException: 400 Bad Request

Logs : Same exception with stack		NA
Client SecretWrong valueUI : Group access failure: HttpClientErrorException: 401 Unauthorized
Logs: Same exception with stack		NA
User IdWrong valueUI : User access failure: HttpClientErrorException: 400 Bad Request
Logs :  same with stack		NA
Tenant ID in frevvoA value for which metadata was not generated and app was not created in Azure ADTenant updated successfullyUI : Access Denied. Authentication required.

Logs: 2017-11-03 16:36:50.152  WARN diff a416e8eb-d7d2-4d30-a7cc-fb7ceb7a5814 776 --- [http-nio-8082-exec-10] com.frevvo.forms.web.LoginResource       : Login failure

org.springframework.security.authentication.AuthenticationServiceException: Error determining metadata contracts

log contains stack trace
Admin user idA value not present in ADTenant updated successfullyNo errors. users can login and use frevvo. admin@frevvo.com still has tenant admin properties.