Azure Active Directory Specific Implementation for ArcSite SSO
ArcSite provides a generic auth provider for SAML2 based authentication, which allows Admins of an ArcSite company account to manually configure any SAML2-enabled IdP system.
However when configuring Azure Active Directory (AD) as your Identity Provider (IdP) for ArcSite’s SSO, there are a few Azure-specific differences you should be aware of. These mainly involve how Azure handles metadata uploads and user attribute mapping. Here’s what’s unique for the Azure AD setup:
Uploading ArcSite Metadata to Azure AD
Creating a New Enterprise Application in Azure AD:
In the Azure AD portal, navigate to Enterprise Applications and select New Application.
Choose the option to add a Non-Gallery Application. Name the application (e.g., "ArcSite SSO").
Uploading the Service Provider Metadata:
After creating the application, go to the Single Sign-On settings for the app.
Select SAML as the SSO method.
You will now need to upload the ArcSite metadata file. This file can be downloaded from the ArcSite SSO settings.
In Azure AD, under the Basic SAML Configuration, click Edit and enter the required details manually or upload the metadata XML file from ArcSite.
Configuring URLs:
Ensure that the Identifier (Entity ID), Reply URL (Assertion Consumer Service URL), and Sign-On URL fields are correctly populated. These values can be found in the ArcSite metadata file or within ArcSite’s SSO configuration screen.
Mapping User Attributes in Azure AD
In Azure AD, mapping user attributes to ArcSite differs slightly from other providers. Here’s how you map the necessary fields:
Default Attribute Mapping:
Azure AD requires mapping ArcSite’s required fields (IdP User ID and User Email) to Azure’s user attributes.
Go to the User Attributes & Claims section under Single Sign-On in Azure AD.
Map Required Attributes:
By default, Azure AD provides a list of claims. You’ll need to map:
User Identifier (Name ID): This should be mapped to the userPrincipalName or email attribute, depending on how your organization handles user logins.
User Email: Map this to the mail attribute or another attribute that holds the user's email address.
Map Optional Attributes:
If you wish to pull in additional attributes like First Name and Last Name into ArcSite, add new claims in Azure AD:
First Name: Map to the givenName attribute.
Last Name: Map to the surname attribute.
These fields can be added by clicking Add new claim in Azure AD and selecting the appropriate user attributes.
Testing and Finalizing
Once your Azure AD setup is complete, Test Single Sign-On Test to see if single sign-on is working. Testing users must be added to your Identity Provider before they can sign in.
NOTE - Please open the test link in a new window to avoid your account being logged out enforced.