Setting up SSO with Microsoft Azure AD

Topics included in this article:

• Common Questions
• Recovery Users
• Just-In-Time User Creation
• Setting up SSO
• SCIM Setup with Azure
• Helpful Links
• Contact Support or Sales

Notes:

• Azure Active Directory Subscription is required for this feature. To view the Microsoft documentation, click the links for Provision users and groups using SCIM  or  Configuring SCIM provisioning for Azure AD.
• Single Sign-On, or SSO, is a way to sync sign-on across multiple applications allowing you to log into all applications with one user account and password. 

Common Questions

 

What do I need to do on the Rhombus side before the integration?

You will need to create the user Roles in Rhombus. The group or role on the IDP side (Azure AD, Okta ..) and the Role name in Rhombus need to match. As an example, Users assigned to matching groups in AD will automatically get assigned to the matching Role with the matching name. 

 

Recovery Users

A Recovery User is a user account in your organization that bypasses SAML once enabled. 

Note: It is recommended to have at least two Super User Accounts as Recovery Users when enabling SSO to ensure you have a method of logging and disabling SSO in the event SAML encounters errors.

Enabling a user account as a Recovery User is done during the SSO configuration process. Click the dropdown menu next to SSO Recovery Users that says "Select Users". Click on every user you wish to have selected. A Blue Checkmark will indicate a Recovery User. When finished, selection OK.

 

Just-In-Time User Creation

When you set up Microsoft Azure SSO, you can choose to enable Just-In-Time Creation. This automatically creates user accounts with assigned roles on the Azure platform.

Additional setup is required on the Microsoft side, which is detailed in the "How to configure SCIM 2.0 with Azure" article. For Just-In-Time creation, you don't need to activate SCIM for role synchronization, but you do need to follow the setup steps outlined in the article.

Please note: You do not need to enable SCIM to follow the steps shown in the article, but without the ability to test with provisioning on demand, you may need to wait 30 minutes or longer for Rhombus and Azure AD to sync up.

Setting up SSO

Rhombus currently has an enterprise application denoted by our logo on the Azure enterprise application market. Below are the steps documenting how to set it up.

 

1) Access the Azure Active Directory Portal (https://aad.portal.azure.com/) and go to

" Enterprise Applications" -> "New Application".

Type in Rhombus Systems then press "Create"

 

2) Go to the Rhombus Console and download the  Metadata file on the SSO settings page inside the Rhombus Console. 

3) Click the Single sign-on tab, and upload your SP Metadata file.

4) Click the explore button on the far right to open the Library folder, locate the file, and once selected hit add.

5) Next, edit the "Basic SAML Configuration" by copying and pasting the information from the SSO page on the Rhombus web console. 

This is how the page should look like for Basic SAML Configuration, Attributes & Claims, and SAML Certificates:

6) Next, download the MetaData XML and paste it into the "IDP MetaData XML" field on the Rhombus Single Sign-On Settings page.

7) Edit The Metadata XML by adding the NameIDFormat Attribute as shown below:

Add the following line in the XML within the IDPSSODescriptor as shown below

 <NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</NameIDFormat>

If you are using a SAML 2.0, you may need to add the appropriate "md" prefixes to the XML tags to match the format.

<md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</md:NameIDFormat>

8) Click "Save" on the Rhombus web console SSO page, top right of the page.

9) Now when users try to log in to Rhombus, they will be redirected to log in through AD. If JIT is not enabled, each user will need to be created in Rhombus before logging in. 

SCIM Setup with Azure

If you also want to set up SCIM provisioning with Azure, we have you covered. Checkout our step by step for setting this up in our other article: How to configure SCIM 2.0 with Azure

Helpful Links

• Frequently Asked Questions About SSO with Rhombus
• Role Creation and Management
• How to configure SCIM 2.0 with Azure

Contact Support or Sales

Have more questions? Contact Rhombus Support at +1 (877) 746-6797 option 2 or support@rhombus.com.

Interested in learning more? Contact Rhombus Sales at +1 (877) 746-6797 option 1 or sales@rhombus.com.