Create an Azure Enterprise Application for Simplelists
- Login to your Microsoft Azure Tenant https://portal.azure.com
###
img src="saml/azure/01-saml-azure-welcome.png" alt="Microsoft Azure Dashboard" title="Microsoft Azure Dashboard" class="blog-border"
- Click View on Manage Microsoft Entra ID or click Microsoft Entra ID
Manage Azure Active Directory
- Click Enterprise applications from the left hand menu
###
img src="saml/azure/02-saml-azure-entra-id.png" alt="Manage Entra ID" title="Manage Entra ID" class="blog-border"
Create a new Enterprise Application
- Click New application
###
img src="saml/azure/03-saml-azure-enterprise-applications.png" alt="Enterprise Applications" title="Enterprise Applications" class="blog-border"
Create your own application
- Click Create your own application
###
img src="saml/azure/05-saml-azure-create-your-own-application.png" alt="Create your own Application" title="Create your own Application" class="blog-border"
- Enter Application Details
- Enter the name of your app (Simplelists or other unique name)
- Select Integrate any other application you don’t find in the gallery (Non-gallery)
- Click Create
###
img src="saml/azure/04-saml-azure-new-application.png" alt="Create new application" title="Create new application" class="blog-border"
Setup single sign on
- Click Get started under Set-up single sign on
###
img src="saml/azure/06-saml-azure-configure-simplelists-application.png" alt="Configure Enterprise Application" title="Configure Enterprise Application" class="blog-border"
Select a single sign-on method
- Click SAML
###
img src="saml/azure/07-saml-azure-select-signon-method.png" alt="Select Signon Method" title="Select Signon Method" class="blog-border"
Set up Single Sign-On with SAML
The metadata file referenced below is the saml.xml file that you can download from the Simplelists Authentication provider that is created using Configuring a SAML2 Authentication Provider
The metadata file will include most of the settings required. The RelayState value is also located on the Authentication Provider created as per Configuring a SAML2 Authentication Provider
- Click Upload metadata file
###
img src="saml/azure/09-saml-azure-upload-metadata.png" alt="Upload Metadata" title="Upload Metadata" class="blog-border"
- Click Add
###
img src="saml/azure/08-saml-azure-setup-single-signon-with-saml.png" alt="Setup single signon with SAML" title="Setup single signon with SAML" class="blog-border"
Verify Basic SAML Configuration that was uploaded
- Enter the RelayState from the Simplelists settings
- Click Save
###
img src="saml/azure/10-saml-azure-basic-saml-configuration.png" alt="Basic SAML Configuration" title="Basic SAML Configuration" class="blog-border"
The RelayState is a value that Azure will pass to Simplelists when authentication is initiated from the Azure applications page. It must match the value in Simplelists, and can be found on the Authentication Provider created in Simplelists.
Download the Metadata and Certificate for Simplelists
Save each of these files to a location to upload the the Authentication Provider Settings of Simplelists.
- Click Download to the right of Certificate (Base64)
- Click Download to the right of Federation Metadata XML
###
img src="saml/azure/11-saml-azure-download-cer-and-metadata.png" alt="Download certificate and metadata.xml" title="Download certificate and metadata.xml" class="blog-border"
Azure - Enable User Login
Depending on your Azure settings you may need to enable user log in for the Simplelists application in Azure.
- Click Users and Groups
###
img src="saml/azure/12-saml-azure-click-user-and-groups.png" alt="Simplelist Enterprise Application" title="Click user or group" class="blog-border"
Users and Groups
- Click Add user/group
###
img src="saml/azure/13-saml-azure-users-and-groups.png" alt="Azure Users and Groups" title="Azure Users and Groups" class="blog-border"
Add Assignment
- Click None Selected under Users
###
img src="saml/azure/14-saml-azure-add-assignment.png" alt="Azure Add Assignment" title="Azure Add Assignment" class="blog-border"
Users
- Click on each user (or group) that you wish to add
- Click Select
###
img src="saml/azure/15-saml-azure-select-user.png" alt="Azure Select User" title="Azure Select User" class="blog-border"
Add Assignment
- Click Assign
###
img src="saml/azure/16-saml-azure-add-assignment.png" alt="Azure Add Assignment" title="Azure Add Assignment" class="blog-border"
Testing Login
Access the Simplelists page and click Login
- Click login
###
img src="saml/07-simplelists-login.png" alt="Simplelists login page" title="Simplelists login page" class="blog-border"
- Enter your Azure enabled email address and click submit.
###
img src="saml/06-simplelists-main-page.png" alt="Simplelists Main Login page" title="Simplelists Main Login Page" class="blog-border"
If everything is correctly configured you will be presented with the Azure login page.
- Enter the "Email address, phone number or Skype" or pick the account from the list
- Click Next
###
img src="saml/azure/18-saml-azure-login-enter-password.png" alt="Azure enter password" title="Azure enter password" class="blog-border"
- Enter your password
- Click Sign In
###
img src="saml/azure/19-saml-azure-login-enter-2fa-code.png" alt="Azure enter 2FA code" title="Azure enter 2FA code" class="blog-border"
- You may need to enter your two factor authentication code (2FA)
- Click Verify
###
img src="saml/azure/20-saml-azure-login-stay-logged-in.png" alt="Azure Stay Logged In" title="Azure Stay Logged In" class="blog-border"
- Choose whether you want to stay logged in
- Click Yes or No
###
img src="saml/azure/17-saml-azure-login-pick-account-a.png" alt="Azure Enter Account ID" title="Azure Enter Account ID" class="blog-border"
###
img src="saml/azure/17-saml-azure-login-pick-account.png" alt="Pick Azure Account ID" title="Pick Azure Account ID" class="blog-border"
Azure Optional Configuration
Azure Verification certificate
Configuring a verification certificate requires Microsoft Entra (Azure) to verify that the SAML AuthnRequest was properly signed by Simplelists with the expected certificate.
This provides your application with a little additional security as only Simplelists can correctly authenticate but it does mean that login can ONLY be initiated from the Simplelists page. You cannot initiate login from the Microsoft Entra (Azure) application list.
- Click Edit in the Verification certificates (optional) section
###
img src="saml/azure/21-saml-azure-verification-certs.png" alt="Shows the Enterprise Application and Certficate Verification settings" title="azure-verification-certs" class="blog-border"
Verification Certificates
###
img src="saml/azure/22-saml-azure-verification-certs-upload.png" alt="Verification Certificate upload settings" title="saml-azure-verification-cert-upload" class="blog-border"
- Click Require verification certificates
- Click Upload certificate
###
img src="saml/azure/23-saml-azure-upload-verification-cert.png" alt="Select a Verification Certificate to upload" title="saml-azure-verification-upload" class="blog-border"
- Select the Simplelists signing certificate
###
img src="saml/azure/24-saml-azure-upload-verification-cert-save.png" alt="Close the Verification Certificate page" title="saml-azure-verification-upload" class="blog-border"
- Click Save
- Close the settings with the X.
Azure - Enable SAML Token Encryption (Optional)
SAML token encryption increases the security by fully encrypting the data sent from Azure to the web Application. The user will be unable to determine what data is in the Assertion. However, it also makes it difficult to troubleshoot because you cannot view the Assertion in the browser. Get everything else working first then decide if you want to implement this.
- Click Security from the left hand menu
###
img src="saml/azure/25-saml-azure-click-token-encryption.png" alt="Enterprise Application - Security - Token Encryption" title="25-saml-azure-click-token-encryption" class="blog-border"
- Click Token Encryption
###
img src="saml/azure/26-saml-azure-import-certificate.png" alt="Token Encryption - Import Certificate" title="26-saml-azure-import-certificate" class="blog-border"
- Click Import Certificate
###
img src="saml/azure/27-saml-azure-select-certificate.png" alt="Ipmort the encryption certificate" title="27-saml-azure-select-certificate" class="blog-border"
- Select the simplelists.cer file that you can download from the Authentication Settings in Simplelists
Activate the Encryption Certificate
- Click on the three dot at the right side of the certificate
###
img src="saml/azure/28-saml-azure-activate-encryption-certificate.png" alt="Activate Encryption Certificate" title="28-saml-azure-activate-encryption-certificate" class="blog-border"
- Click Activate Token Encryption Certificate
Encrypted Assertions are now enabled. However you will need to complete the next step to make it work correctly.
Sign the SAML response and Assertion (Optional)
This step is only required if you enabled token encryption.
Get everything else working first then decide if you want to implement this (and token encryption).
- Click Edit to the right of Token signing certificate
- Select Sign SAML response and assertion from the Signing Option drop-down
- Click Save