...

When you create an Azure SAML tenant in , the Authentication Only option is checked by default. frevvo assumes that most customers will want to use Active Directory for users and roles. In Authentication Only mode, users and roles have to be defined in your AD.  

For example, customers using Azure Active Directory must ensure that the frevvo.TenantAdmin and frevvo.Designer roles are specified for tenant admin and designer users.

...

1. Login to the Microsoft Azure Management console: https://manage.windowsazure.com
2. Add a new application under the Active Directory tab.
3. In order to complete the single sign-on fields:
   1. AP ID URI:
      

      1. Cloud Customers should use https://app.frevvo.com:443/frevvo/web/alias/{t} - replace {t} with the tenant id of your frevvo Azure SAML tenant.

      2. On-premise customers should use http://<server>:<port>/frevvo/web/alias/{t} - replace <server> with the ip of your server, <port> with the port number (if applicable) and t with your frevvo Azure SAML tenant id.

   2. REPLY URL:
      

      1. Cloud Customers should use https://app.frevvo.com:443/frevvo/web/saml/SSO/alias/{t} - replace {t} with the tenant id of your frevvo Azure SAML tenant.

      2. On-premise customers should use http://<server>:<port>/frevvo/web/saml/SSO/alias/{t} - replace <server> with the ip of your server, <port> with the port number (if applicable) and t with your frevvo Azure SAML tenant id.

   3. SIGN-ON URL
      

      1. Cloud Customers should use https://app.frevvo.com:443/frevvo/web/tn/{t}/login - replace {t} with the tenant id of your frevvo Azure SAML tenant.

      2. On-premise customers should use http://<server>:<port>/frevvo/web/tn/{t}/login - replace <server> with the ip of your server, <port> with the port number (if applicable) and t with your frevvo Azure SAML tenant id.

4. Expand
   title Click here for some more tips.
   Be sure to set up the application permissions to allow the graph API to read the directory in order to retrieve users and groups. Click here to see an example. You will need the Azure tenant ID, and the client id and client secret key that are created for the frevvo application when configuring your Azure SAML tenant. The client id is displayed on the Confiigure screen of the application for in Azure. An example is shown in the image: The tenant id for application that you created in Azure for can be obtained by viewing the endpoint Urls listed when you click View Endpoints icon at the bottom of the page. See the example in the image: There is only one chance to retrieve the client secret key when you create the application for in Azure. In the keys section on the CONFIGURE screen, select an option for the application duration. Click the SAVE icon on the bottom menu to display the client secret key. Copy the key and save it so you have it available when you create your Azure SAML tenant in . One way to restrict access to for specific Azure AD users only, is to: Make sure the USER ASSIGNMENT REQUIRED TO ACCESS APP is set to YES Add users to the application under the USERS tab. Groups listed under the GROUPS tab in Active Directory map to roles. Refer to Prerequisites for more information.

Step 2 - Create the Live Forms metadata file

Follow these steps to generate the frevvo metadata for your Azure SAML tenant. You can do this even if the tenant has not been created yet.

...

1. Log onto as the superuser (on-premise) or the tenant admin (cloud).
2. Access the Add Tenant (on-premise) or Edit Tenant (cloud) screen.
3. Select Azure SAML Security Manager from the Security Manager Class dropdown.
4. Copy the Service Provider (frevvo) metadata into the Service Provider field. The xml should be pasted without the prolog. For example, the image shows an example of the frevvo metadata file before pasting:
   
   
   
   
5. Copy the metadata from the Azure tenant IDP file previously created and paste it into the Identity Provider field. Do NOT paste the prolog. Here is an example of the file with the prolog:
   
   
6. Check the Ignore Case checkbox if you are using LDAP for authentication and you want to ignore the case stored in LDAP systems for users/roles. Refer to the Mixed or Upper case User Names topic for more information.
   
   

7. Check the Authentication Only checkbox to enable SAML to handle authentication only. In this mode, authorization happens based on the roles defined in Azure AD.  Authentication Only mode is recommended if you are using the Azure SAML Security Manager. It is checked by default.
   
   When checked, the screen display changes as attribute mapping, other than the mapping for the user id and custom attributes, is no longer necessary.
   
   Image Modified
   
   If the option is not selected, users and roles can be managed via the UI.
   
   

8. Enter the User Id. This should be the User property name that identifies the user. A typical value is userPrincipalName, givenname etc.
9. Custom attributes can be mapped by typing the attribute names in the Custom field separated by a comma.
10. Enter the following information in the API Access section.
    1. Enter the Azure  tenant identifier into the tenant Id field. This can be obtained by viewing the endpoint Urls listed when you click View Endpoints in your frevvo Azure application.
    2. Enter the client id and client secret key that were created as part of registering the frevvo application into the respective fields.
11. Configure the Business Calendar for your tenant. The escalation feature will use this calendar to calculate deadlines and send notiifcation and reminder emails.
12. Enter HTTP Auth credentials if required. Credentials for external secure web services accessed by the forms and flows in your tenant can be specified in this section.
13. Click Submit.
    

...

Retrieving Custom Attributes from Azure Active Directory in an Azure SAML Tenant

The Azure AD Graph API allows access to users, groups etc... in Azure AD. User entity attribute data exposed by the API for the logged in user can be pulled into fields in your form/flow with a business rule. If the attribute that you are looking for is not already exposed, you can:

• Sync Azure AD to your in-house AD via the Microsoft provided connector
• Add an extension property

Once the custom attributes are made available, add them to the Custom section of your Azure SAML tenant.

1. Login to your Azure SAML tenant as the as the tenant admin.
2. Click the Edit Tenant link
3. Add the custom attributes to the Custom section as a comma separated list. The image shows the department and displayName attributes listed in the custom attribute section.
   
   Image Added
   
   
4. Design your form/flow with fields to collect the information.
5. Write a business rule to populate the controls with the custom attribute information.
   
   

if (form.load) {
    FirstName.value = _data.getParameter('subject.first.name');
    LastName.value = _data.getParameter('subject.last.name');
    EMail.value = _data.getParameter('subject.email'); 
    department.value = _data.getParameter('subject.department');
    displayName.value = _data.getParameter('subject.displayName');
}