Live Forms v7.0 is no longer supported. Click here for information about upgrading to our latest GA Release.
Azure SAML Security Manager
supports the creation of a tenant using the Azure SAML (Security Assertion Markup Language) Security Manager. Users in this tenant are redirected to the Microsoft Azure login screen and then to when that login screen is submitted.
The Azure SAML Security manager can be used in cloud and on-premise installations.
- Allows on-premises AD to be exposed to the frevvo cloud via synchronization with Azure AD
- Uses the graph API to access users and groups from AD.
- SAML is used for authentication only, providing single sign on.
- SAML is built into Azure AD. It is not necessary to setup an identity provider.
The Azure SAML Security Manager pulls users/roles from Azure AD. frevvo recommends using the SAML Security Manager for customers who want to manage users/roles from the UI.
On this page:
Prerequisites
- You will need a valid Microsoft Azure subscription.
The frevvo.TenantAdmin and frevvo.Designer groups must be specified on your Active Directory server. The group names must be spelled as shown. Upper/lower case may be a factor for Open LDAP systems. .
Tenant admin users must be assigned to the frevvo.TenantAdmin group.
- Designer users must be assigned to the frevvo.Designer group.
- Users with the frevvo.publishers role must be assigned to the frevvo.Publisher group.
- Users with the frevvo.ReadOnly role must be assigned to frevvo.ReadOnly group.
- Refer to Manage Roles for a description of these roles in .
Authentication Only
When you create an Azure SAML tenant in , the Authentication Only option is checked by default. frevvo assumes that most customers will want to use Active Directory for users and roles. In Authentication Only mode, users and roles have to be defined in your AD.
For example, customers using Azure Active Directory must ensure that the frevvo.TenantAdmin and frevvo.Designer roles are specified for tenant admin and designer users.
The group names for these special roles must be frevvo.TenantAdmin, and frevvo.Designer. Upper/lower case may be a factor for Open LDAP systems.
These groups map to the roles in which are case sensitive. Make sure assigned group names are added in the correct case. Users with these groups may have to be added to the application created in Azure to gain access. See the tips below for more information.
Configuring the Azure SAML Security Manager
Follow these steps listed below to create a tenant using the Azure SAML Security Manager:
- Create an Application for Live Forms in Azure
- Create the Live Forms metadata file
- Create the Azure Tenant Idp metadata file
- Create/edit the Azure SAML tenant
- Log into your Live Forms Azure SAML tenant
Step 1 - Create an Application for Live Forms in Azure
frevvo assumes that customers have someone on staff that can successfully perform this step of the procedure. Information about is listed below to help you with this process.
The Azure global administrator MUST create the application for in Azure.
- Login to the Microsoft Azure Management console: https://manage.windowsazure.com
Click the Azure classic portal panel to switch to the classic view.
- Add a new application under the Active Directory tab.
- In order to complete the single sign-on fields:
- AP ID URI:
Cloud Customers should use https://app.frevvo.com:443/frevvo/web/alias/{t} - replace {t} with the tenant id of your frevvo Azure SAML tenant.
On-premise customers should use http://<server>:<port>/frevvo/web/alias/{t} - replace <server> with the ip of your server, <port> with the port number (if applicable) and t with your frevvo Azure SAML tenant id.
- REPLY URL:
Cloud Customers should use https://app.frevvo.com:443/frevvo/web/saml/SSO/alias/{t} - replace {t} with the tenant id of your frevvo Azure SAML tenant.
On-premise customers should use http://<server>:<port>/frevvo/web/saml/SSO/alias/{t} - replace <server> with the ip of your server, <port> with the port number (if applicable) and t with your frevvo Azure SAML tenant id.
- SIGN-ON URL
Cloud Customers should use https://app.frevvo.com:443/frevvo/web/tn/{t}/login - replace {t} with the tenant id of your frevvo Azure SAML tenant.
On-premise customers should use http://<server>:<port>/frevvo/web/tn/{t}/login - replace <server> with the ip of your server, <port> with the port number (if applicable) and t with your frevvo Azure SAML tenant id.
- AP ID URI:
Step 2 - Create the Live Forms metadata file
Follow these steps to generate the frevvo metadata for your Azure SAML tenant. You can do this even if the tenant has not been created yet.
Paste this URL into your browsr:
Cloud Customers: https://app.frevvo.com:443/frevvo/web/saml/metadata/alias/{t} - replace {t} with the tenant id of your Azure SAML tenant - Ex; azuread
On-premise customers: http://<server>:<port>/frevvo/web/saml/metadata/alias/{t} - replace <server> with the ip of your server, <port> with the port number (if applicable) and t with your tenant id).
When the metadata displays, right click and select the browser option to View the Page source.
- Save the page as an xml file.
- Metadata must be generated for each Azure SAML tenant. Each tenant will have a unique URL.
Step 3 - Create the Azure Tenant Idp metadata file
Follow these steps:
Browse the azure tenant (IdP) metadata at: https://login.microsoftonline.com/{azure-tenant-name}/FederationMetadata/2007-06/FederationMetadata.xml - replace {azure-tenant-name} with the id of your application tenant id in the Azure application. This can be obtained by viewing the endpoint Urls listed when you click View Endpoints in your frevvo Azure application. In this example, fece6b7e-fbc6-4b3a-8287-fc07c29aa2d2 is the Azure tenant id.
https://login.microsoftonline.com/fece6b7e-fbc6-4b3a-8287-fc07c29aa2d2/FederationMetadata/2007-06/FederationMetadata.xml
Copy the source of the IdP metadata XML into an XML editor (do not include the XML prolog)
Remove the Signature and RoleDescriptor sections.
<ds:Signature>…</ds:Signature> <RoleDescriptor xsi:type="fed:SecurityTokenServiceType" protocolSupportEnumeration="http://docs.oasis-open.org/wsfed/federation/200706">…</RoleDescriptor> <RoleDescriptor xsi:type="fed:ApplicationServiceType" protocolSupportEnumeration="http://docs.oasis-open.org/wsfed/federation/200706">…</RoleDescriptor>
Save the remaining metadata as an xml file.
Step 4 - Create/edit the Azure SAML tenant
To successfully create a tenant using the Azure SAML Security manager, you will need the following:
- metadata file
- The Azure SAML tenant Idp metadata file
- Attribute mapping information
- The Azure tenant ID, the client id and client secret key that are created as part of registering the frevvo application.
cloud customers, migrating your tenant to the Azure SAML Security Manager, will make the changes via the Edit Tenant screen. Once accessed, follow these steps beginning with step 3.
- Log onto as the superuser (on-premise) or the tenant admin (cloud).
- Access the Add Tenant (on-premise) or Edit Tenant (cloud) screen.
- Select Azure SAML Security Manager from the Security Manager Class dropdown.
- Copy the Service Provider (frevvo) metadata into the Service Provider field. The xml should be pasted without the prolog. For example, the image shows an example of the frevvo metadata file before pasting:
- Copy the metadata from the Azure tenant IDP file previously created and paste it into the Identity Provider field. Do NOT paste the prolog. Here is an example of the file with the prolog:
- Check the Ignore Case checkbox if you are using LDAP for authentication and you want to ignore the case stored in LDAP systems for users/roles. Refer to the Mixed or Upper case User Names topic for more information.
Check the Authentication Only checkbox to enable SAML to handle authentication only. In this mode, authorization happens based on the roles defined in Azure AD. Authentication Only mode is recommended if you are using the Azure SAML Security Manager. It is checked by default.
When checked, the screen display changes as attribute mapping, other than the mapping for the user id and custom attributes, is no longer necessary.
If the option is not selected, users and roles can be managed via the UI.- Enter the User Id. This should be the User property name that identifies the user. A typical value is userPrincipalName, givenname etc.
- Custom attributes can be mapped by typing the attribute names in the Custom field separated by a comma.
- Enter the following information in the API Access section.
- Enter the Azure tenant identifier into the tenant Id field. This can be obtained by viewing the endpoint Urls listed when you click View Endpoints in your frevvo Azure application.
- Enter the client id and client secret key that were created as part of registering the frevvo application into the respective fields.
- Configure the Business Calendar for your tenant. The escalation feature will use this calendar to calculate deadlines and send notiifcation and reminder emails.
- Enter HTTP Auth credentials if required. Credentials for external secure web services accessed by the forms and flows in your tenant can be specified in this section.
- Click Submit.
Step 5 - Logging into a Live Forms Azure SAML Tenant
- Paste this tenant specific URL into your browser:
Cloud Customers: https://app.frevvo.com:443/frevvo/web/tn/{t}/login - Replace {t} with the name of your Azure SAML tenant.
- On-premise Customers:http://<server>:<port>/frevvo/web/tn/{t}/login. Replace <server> and <port> with your server information and t with the name of your Azure SAML tenant.
The user is redirected to the Azure login screen.
If the user is authenticated, screens display depending on the level of authorization specified for the user. Designer users will see the Application Home Page while non-designer users will be directed to their Task List.
You will see this redirection when logging into a space as well.
- Clicking the logout link in , logs the user out from only.
- When a user logs in to space, the logout link will not be visible in an Azure AD (SSO) tenant.
- When a user user logs in to (non-space mode), the logout link will be visible in an Azure AD (SSO) tenant.
Session Timeout
Session timeouts are configured in and in the Azure SAML IDP. If a user's session ends before the IDP timeout is reached, they will automatically be logged back into if they try to access it again. It is recommended that the session timeout and the IDP session timeout be configured for the same value.
Embedding Forms/Flows in your website
Embedding forms and flows into your website when using the Azure/SAML Security Manager, will work in the following scenarios :
- The visibility of the form is set to Public.
- The visibility of the form is set to Public in Tenant and the user is already authenticated to SAML
Embedding forms and flows into your website is NOT supported if the the visibility of the form is set to Public in Tenant and the user is NOT already authenticated to Azure SAML. This is because frevvo must direct the user to the IDP login screen and the browser will not allow loading the IDP login page in frevvo's form iframe.
Troubleshooting
Logging into a Azure SAML tenant as (user@Azure SAML tenant name)
Logging into a Azure SAML tenant as (user@Azure SAML tenant name) displays an application error message.
On-premise customers using the tomcat bundle will see the following entry in the error log:
Application error processing /frevvo/web/login?null java.lang.UnsupportedOperationException: null
Accessing a Space in a AzureAD tenant on a mobile device will not display a logout button.
Skew error when logging into an Azure tenant
Users logging into a Live Forms Azure SAML tenant may encounter the error "Access Denied. Authorization Required". Examination of the frevvo.log shows the following entry:
Response issue time is either too old or with date in the future, skew 60, time 2016-06-01T05:49:25.330Z
This error is typically caused by a clock synchronization issue between the SP (frevvo) and the Idp (Azure) or a genuine delay in the connection. If you get this error, you can change the value of the context parameter, com.frevvo.security.saml.response.skew, to specify the time in seconds allowed between the SAML request and response to a value greater than the default value of 60 seconds.
Follow the instructions listed in the Installation Tasks chapter to add the parameter.
Retrieving Custom Attributes from Azure Active Directory in an Azure SAML Tenant
The Azure AD Graph API allows access to users, groups etc... in Azure AD. User entity attribute data exposed by the API for the logged in user can be pulled into fields in your form/flow with a business rule. If the attribute that you are looking for is not already exposed, you can:
- Sync Azure AD to your in-house AD via the Microsoft provided connector
- Add an extension property
Once the custom attributes are made available, add them to the Custom section of your Azure SAML tenant.
- Login to your Azure SAML tenant as the as the tenant admin.
- Click the Edit Tenant link
- Add the custom attributes to the Custom section as a comma separated list. The image shows the department and displayName attributes listed in the custom attribute section.
- Design your form/flow with fields to collect the information.
- Write a business rule to populate the controls with the custom attribute information.
Here is an example of a rule that will retrieve the custom attributes, department and displayName, plus the standard attributes, First name, Last Name and Email address.
if (form.load) { FirstName.value = _data.getParameter('subject.first.name'); LastName.value = _data.getParameter('subject.last.name'); EMail.value = _data.getParameter('subject.email'); department.value = _data.getParameter('subject.department'); displayName.value = _data.getParameter('subject.displayName'); }