Logging in via Azure AD
Once an integration with Azure AD has been set up, the following option will appear on the login screen:
Setup steps
Login to the azure portal
Navigate to Azure Active Directory
Create a new app registration
Insert a name and press register
Select your newly created app registration, click through to authentication and press add a platform
Next, select Web and enter the following redirect URI: https://identity.dscribe.cloud/sso/callback
After that you should navigate to the API Permissions and grant the following rights:GroupMember.Read.All and User.Read.All
The priviliges should be of type Application (with admin consent).
Navigate back to your application via Azure Active Directory > App Registrations > Select your newly created App and copy the Application (client) ID and Directory (tenant) ID somewhere safe. You will need it later.
In your application, navigate to 'Certificates & secrets' and create a new client secret and copy value:
Last step is to get the open metadata endpoint. Navigate to App Registration > Endpoints
Copy the URL and open it in a new tab in your browser. It will open a screen with important urls (token_endpoint, issuer, userinfo_endpoint and authorization_endpoint). You will need these to setup a SSO integration in dScribe.
Open the dScribe app settings via below icon (App picker) in the top right and click on 'Explore all apps'. This will take you to the identity setup page.
From here, navigate to the 'Organisations Settings' tab where SSO Providers can be configured (see also dScribe Authentication for more information).
Below additional settings can be configured
Dynamic user creation: if the user is known in AD, a dScribe user will be created with a default team assigned.
Allow Login via Magic Link: allows password less login via e-mail link
Sync security groups from SSO provider (Azure/Entra ID only): allows to automatically map your AD security group with your dScribe teams. Upon active selection, the mapping can be configure in the app of choice. E.g below the example of the catalog mapping
In order for a user to be able to perform the SSO setup, the user needs to be tenant owner of the application. This is feasible in below screen after the user has been created in dScribe Catalog.
Please note:
Depending on your Azure Active Directory setup it can be necessary to have admin consent. This will be a one time pop-up in the login flow to authorise the dScribe application. Once the admin approved, every user should be able to login.
Only tenant owners will see the "Organizations Settings" tab and thus will be the only ones authorised to do the SSO setup.