Azure Single Sign-On for Web Client

Single Sign-On (SSO) adds more security and convenience when signing on to Nectari using Azure Active Directory (Azure AD).

This topic describes how to set up Azure with Nectari.

Configuring the Azure Domain

You must first configure the Azure Domain, as this is the platform from which we retrieve the data required to correctly set up Nectari.

1. In your Web browser, go to https://portal.azure.com/ and enter your login credentials (if required).

2. In the left menu, click Enterprise Applications.
   

   

3. In the upper bar, click + New application.
   

   

4. Under the Add your own app section, select Non-gallery application.
   

   

5. In the Name field, enter a name for your application and click Add.
   

   

6. Under the Getting Started section, select 2. Set up single sign on.
   

   

7. Select SAML for the single sign-on method.
   

   

Although there are 5 sections for the SAML SSO method, you only need to set the parameters in these sections:

• Basic SAML Configuration
• User Attributes & Claims

Basic SAML Configuration

1. In the upper-right corner, click the pencil to edit the parameters in the Basic SAML Configuration section.
   

   

2. In the Identifier (Entity ID) field, enter your Nectari URL + :port followed by a Unique Identifier for your Azure Domain. The URL and the port should be the same as those entered during the Nectari installation.

   Important

   Only for users who never did the https binding for external access: Take note of URL address used for the Web Client on your certificate to communicate with the Azure Domain. This is explained in further detail in Installing and Configuring the Nectari Server.

   Example

   In this example we have biwebserver.mycompany.com as the URL address with port :444 and biwebclient as Unique Identifier for the Azure Domain.
   

   

   Example

   Example of Nectari installation where we use biwebserver.mycompany.com as the URL address, on port 444.
   

   

3. In the Reply URL (Assertion Consumer Service URL) field, enter your Nectari URL + :port following by /AuthServices/Acs.

4. Click Save to apply changes.

5. In the left menu, under the Manage section, click Users and groups.
   

   

6. In the upper bar, click + Add user to authorize users and groups to use SSO.
   

   

   This completes the basic SAML configuration.

User Attributes & Claims

The installation package for the configuration of the Nectari application automatically fills in the SAML2 answer's Attribute for user name field with the mailnickname attribute by default.

For the Azure Domain, you can replace this value with one of the attributes listed in the User Attributes & Claims section.

If you want to use the mailnickname attribute (because you want to choose the part of the email address before the @ sign), you will have to create it, since this attribute does not exist by default in Azure Domain.

To create the attribute:

1. In the left menu, under the Manage section, click Single Sign-On.
   

   

2. In the upper-right corner, click the pencil to edit the User Attributes & Claims section.
   

   

3. Click + Add new claim.
4. In the Name field, enter mailnickname.
5. For the Source, select Attribute.
6. In the Source Attribute field, enter user.mailnickname.
   
7. Click Save to finish.

Installing and Configuring the Nectari Server

Before starting the Nectari Server Installation / Configuration, you must retrieve the certificate from Azure Domain.

To retrieve the certificate:

1. Scroll to the SAML Signing Certificate section.
   

   

2. Click Download next to the Certificate (Base64) field.

For a First-Time Installation of Nectari

1. Follow the procedure described in Installing the Web Application and Distribution until Step 11.

2. In the App Configuration screen, fill in the fields as described below.

   

   The mapping with Nectari fields in the installation package is based on the Basic SAML Configuration and Set up BI Web Server sections in Azure Domain.

   Field in Nectari Installation Package	=	Field in Azure Domain	Value used as example in this document
   SEI Issuer URI	=	Identifier (Entity ID)	https://biwebserver.mycompany.com:444/biwebclient
   ID Provider Issuer Name	=	Azure AD Identifier	https://sts.windows.net/c2c50f21-66a7-xxxx-xxxx-xxxxxxxxxxxx/
   ID Provider URL	=	Azure Login URL	https://login.microsoftonline.com/c2c50f21-66a7-xxxx-xxxx-xxxxxxxxxxxx/saml2

   For the Full certificate name field, enter the name of the certificate you downloaded from Azure Domain with the .cer extension (for example: AzureBIWebServer.cer).

   You should have a result similar to this:

   

3. Click Next and finish the installation.

Binding the Web Client

By adding an HTTPS binding to your Web Client, external connections will also be secured.

To bind the Web Client:

1. Press the Windows key + R to open the Run window.
2. Enter inetmgr and press the Enter key.
3. On the left pane, click the little arrow to expand the connection tree structure.
4. In the Sites tab, right-click on WebClient and select Edit Bindings...
5. In the Site Bindings window, click Add...

6. In the Type drop-down list, select https. For this HTTPS connection, we are using port number 444 but you can customize it according to your preferences.
   

   

7. Click OK to finish.

   You should have a result similar to this:

   

Editing the web.config file

In order to fully benefit from Azure SSO functionality, you will have to edit the web.config file located in C:\inetpub\wwwroot\WebClient.

• Make sure the entityID attribute from the sustainsys.saml2 tag has the same value you defined in the Identifier (Entity ID) field in the basic SAML configuration. In our example we set "https://biwebserver.mycompany.com:444/biwebclient" as value.
• Change the other values in the Nectari web.config file as described in the table below:

<sessionState cookieSameSite="Lax"/>

<sessionState cookieSameSite="None"/>

<httpCookies httpOnlyCookies="true" requireSSL="false" sameSite="Lax"/>

<httpCookies httpOnlyCookies="true" requireSSL="true" sameSite="None"/>

Expected result for the Web Client

<sustainsys.saml2 entityId="https://biwebserver.mycompany.com:444/biwebclient" returnUrl="https://biwebserver.mycompany.com:444/Account/SSO" modulePath="/AuthServices">
        <identityProviders>
            <add entityId="https://sts.windows.net/c2c50f21-66a7-xxxx-xxxx-xxxxxxxxxxxx/" signOnUrl="https://login.microsoftonline.com/c2c50f21-66a7-xxxx-xxxx-xxxxxxxxxxxx/saml2" allowUnsolicitedAuthnResponse="true" binding="HttpRedirect">
                <signingCertificate fileName="~/App_Data/AzureBIWebServer.cer"/>
            </add>
        </identityProviders>
</sustainsys.saml2>

Expected result for the cookies

<system.web>
        <sessionState cookieSameSite="None"/>
        <compilation targetFramework="4.8">
            <assemblies>
                <add assembly="System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"/>
            </assemblies>
        </compilation>
        <!-- change value of MaxHttpCollectionKeys to max int(2147483644) to webserver support recsive big data-->
        <httpRuntime targetFramework="4.8" maxUrlLength="10999" maxRequestLength="2147483644" executionTimeout="1600" useFullyQualifiedRedirectUrl="false" requestLengthDiskThreshold="2147483647" maxQueryStringLength="2097151"/>
        <httpCookies httpOnlyCookies="true" requireSSL="true" sameSite="None"/>
</system.web>

Steps after the Installation/Configuration

Copying the Azure Domain Certificate

• Copy the certificate you downloaded from Azure Domain and paste it to C:\inetpub\wwwroot\WebClient\App_Data.
  

  

Creating Users and Groups in Nectari

• Refer to Users to create your Web Client user by entering the same value for User Name and SAML2 answer's Attribute for user name you defined during the installation of the package.

Accessing Nectari with Azure SSO enabled

To log in with SSO enabled, use your default Web Client URL:

https://biwebserver.mycompany.com:444

If your Admin account is not set up with SSO and you need to log in, use this URL to log in with your default credentials (without SSO):

https://biwebserver.mycompany.com:444/Account/Login