Group Email Manager

login signup

Configuring Azure for Simplelists SAML2 Authentication

Create an Azure Enterprise Application for Simplelists

  1. Login to your Microsoft Azure Tenant https://portal.azure.com

    ###

    img src="saml/azure/01-saml-azure-welcome.png" alt="Microsoft Azure Dashboard" title="Microsoft Azure Dashboard" class="blog-border"

  2. Click View on Manage Microsoft Entra ID or click Microsoft Entra ID

Manage Azure Active Directory

    ###

    img src="saml/azure/02-saml-azure-entra-id.png" alt="Manage Entra ID" title="Manage Entra ID" class="blog-border"

  1. Click Enterprise applications from the left hand menu

Create a new Enterprise Application

    ###

    img src="saml/azure/03-saml-azure-enterprise-applications.png" alt="Enterprise Applications" title="Enterprise Applications" class="blog-border"

  1. Click New application

Create your own application

    ###

    img src="saml/azure/04-saml-azure-new-application.png" alt="Create new application" title="Create new application" class="blog-border"

  1. Click Create your own application

    ###

    img src="saml/azure/05-saml-azure-create-your-own-application.png" alt="Create your own Application" title="Create your own Application" class="blog-border"

  2. Enter Application Details
    1. Enter the name of your app (Simplelists or other unique name)
    2. Select Integrate any other application you don’t find in the gallery (Non-gallery)
    3. Click Create

Setup single sign on

    ###

    img src="saml/azure/06-saml-azure-configure-simplelists-application.png" alt="Configure Enterprise Application" title="Configure Enterprise Application" class="blog-border"

  1. Click Get started under Set-up single sign on

Select a single sign-on method

    ###

    img src="saml/azure/07-saml-azure-select-signon-method.png" alt="Select Signon Method" title="Select Signon Method" class="blog-border"

  1. Click SAML

Set up Single Sign-On with SAML

The metadata file referenced below is the saml.xml file that you can download from the Simplelists Authentication provider that is created using Configuring a SAML2 Authentication Provider

The metadata file will include most of the settings required. The RelayState value is also located on the Authentication Provider created as per Configuring a SAML2 Authentication Provider

    ###

    img src="saml/azure/08-saml-azure-setup-single-signon-with-saml.png" alt="Setup single signon with SAML" title="Setup single signon with SAML" class="blog-border"

  1. Click Upload metadata file

    ###

    img src="saml/azure/09-saml-azure-upload-metadata.png" alt="Upload Metadata" title="Upload Metadata" class="blog-border"

  2. Click Add

Verify Basic SAML Configuration that was uploaded

    ###

    img src="saml/azure/10-saml-azure-basic-saml-configuration.png" alt="Basic SAML Configuration" title="Basic SAML Configuration" class="blog-border"

  1. Enter the RelayState from the Simplelists settings
  2. Click Save

The RelayState is a value that Azure will pass to Simplelists when authentication is initiated from the Azure applications page. It must match the value in Simplelists, and can be found on the Authentication Provider created in Simplelists.

Download the Metadata and Certificate for Simplelists

Save each of these files to a location to upload the the Authentication Provider Settings of Simplelists.

    ###

    img src="saml/azure/11-saml-azure-download-cer-and-metadata.png" alt="Download certificate and metadata.xml" title="Download certificate and metadata.xml" class="blog-border"

  1. Click Download to the right of Certificate (Base64)
  2. Click Download to the right of Federation Metadata XML

Azure - Enable User Login

Depending on your Azure settings you may need to enable user log in for the Simplelists application in Azure.

    ###

    img src="saml/azure/12-saml-azure-click-user-and-groups.png" alt="Simplelist Enterprise Application" title="Click user or group" class="blog-border"

  1. Click Users and Groups

Users and Groups

    ###

    img src="saml/azure/13-saml-azure-users-and-groups.png" alt="Azure Users and Groups" title="Azure Users and Groups" class="blog-border"

  1. Click Add user/group

Add Assignment

    ###

    img src="saml/azure/14-saml-azure-add-assignment.png" alt="Azure Add Assignment" title="Azure Add Assignment" class="blog-border"

  1. Click None Selected under Users

Users

    ###

    img src="saml/azure/15-saml-azure-select-user.png" alt="Azure Select User" title="Azure Select User" class="blog-border"

  1. Click on each user (or group) that you wish to add
  2. Click Select

Add Assignment

    ###

    img src="saml/azure/16-saml-azure-add-assignment.png" alt="Azure Add Assignment" title="Azure Add Assignment" class="blog-border"

  1. Click Assign

Testing Login

Access the Simplelists page and click Login

    ###

    img src="saml/06-simplelists-main-page.png" alt="Simplelists Main Login page" title="Simplelists Main Login Page" class="blog-border"

  1. Click login

    ###

    img src="saml/07-simplelists-login.png" alt="Simplelists login page" title="Simplelists login page" class="blog-border"

  2. Enter your Azure enabled email address and click submit.

If everything is correctly configured you will be presented with the Azure login page.

    ###

    img src="saml/azure/17-saml-azure-login-pick-account-a.png" alt="Azure Enter Account ID" title="Azure Enter Account ID" class="blog-border"

    ###

    img src="saml/azure/17-saml-azure-login-pick-account.png" alt="Pick Azure Account ID" title="Pick Azure Account ID" class="blog-border"

  1. Enter the "Email address, phone number or Skype" or pick the account from the list
  2. Click Next

    ###

    img src="saml/azure/18-saml-azure-login-enter-password.png" alt="Azure enter password" title="Azure enter password" class="blog-border"

  3. Enter your password
  4. Click Sign In

    ###

    img src="saml/azure/19-saml-azure-login-enter-2fa-code.png" alt="Azure enter 2FA code" title="Azure enter 2FA code" class="blog-border"

  5. You may need to enter your two factor authentication code (2FA)
  6. Click Verify

    ###

    img src="saml/azure/20-saml-azure-login-stay-logged-in.png" alt="Azure Stay Logged In" title="Azure Stay Logged In" class="blog-border"

  7. Choose whether you want to stay logged in
  8. Click Yes or No

Azure Optional Configuration

Azure Verification certificate

Configuring a verification certificate requires Microsoft Entra (Azure) to verify that the SAML AuthnRequest was properly signed by Simplelists with the expected certificate.

This provides your application with a little additional security as only Simplelists can correctly authenticate but it does mean that login can ONLY be initiated from the Simplelists page. You cannot initiate login from the Microsoft Entra (Azure) application list.

    ###

    img src="saml/azure/21-saml-azure-verification-certs.png" alt="Shows the Enterprise Application and Certficate Verification settings" title="azure-verification-certs" class="blog-border"

  1. Click Edit in the Verification certificates (optional) section

Verification Certificates

###

img src="saml/azure/22-saml-azure-verification-certs-upload.png" alt="Verification Certificate upload settings" title="saml-azure-verification-cert-upload" class="blog-border"

  1. Click Require verification certificates
  2. Click Upload certificate

    ###

    img src="saml/azure/23-saml-azure-upload-verification-cert.png" alt="Select a Verification Certificate to upload" title="saml-azure-verification-upload" class="blog-border"

  3. Select the Simplelists signing certificate

    ###

    img src="saml/azure/24-saml-azure-upload-verification-cert-save.png" alt="Close the Verification Certificate page" title="saml-azure-verification-upload" class="blog-border"

  4. Click Save
  5. Close the settings with the X.

Azure - Enable SAML Token Encryption (Optional)

SAML token encryption increases the security by fully encrypting the data sent from Azure to the web Application. The user will be unable to determine what data is in the Assertion. However, it also makes it difficult to troubleshoot because you cannot view the Assertion in the browser. Get everything else working first then decide if you want to implement this.

  1. Click Security from the left hand menu

    ###

    img src="saml/azure/25-saml-azure-click-token-encryption.png" alt="Enterprise Application - Security - Token Encryption" title="25-saml-azure-click-token-encryption" class="blog-border"

  2. Click Token Encryption

    ###

    img src="saml/azure/26-saml-azure-import-certificate.png" alt="Token Encryption - Import Certificate" title="26-saml-azure-import-certificate" class="blog-border"

  3. Click Import Certificate

    ###

    img src="saml/azure/27-saml-azure-select-certificate.png" alt="Ipmort the encryption certificate" title="27-saml-azure-select-certificate" class="blog-border"

  4. Select the simplelists.cer file that you can download from the Authentication Settings in Simplelists

Activate the Encryption Certificate

  1. Click on the three dot at the right side of the certificate

    ###

    img src="saml/azure/28-saml-azure-activate-encryption-certificate.png" alt="Activate Encryption Certificate" title="28-saml-azure-activate-encryption-certificate" class="blog-border"

  2. Click Activate Token Encryption Certificate

Encrypted Assertions are now enabled. However you will need to complete the next step to make it work correctly.

Sign the SAML response and Assertion (Optional)

This step is only required if you enabled token encryption.

Get everything else working first then decide if you want to implement this (and token encryption).

  1. Click Edit to the right of Token signing certificate Click Edit on Token Signing Certificate
  2. Select Sign SAML response and assertion from the Signing Option drop-down
  3. Click Save

Sign Response and Assertion