Microsoft Entra ID Setup (Formerly Azure AD)

Overview

The below steps will allow you to configure single sign-on with your Azure Active Directory Paid version. This is the recommended way of setting up your Azure AD for SSO with Nucleus.

This will allow you to enable your users to automatically sign-in to Nucleus for their Nucleus accounts. You'll also be able to control in your Active Directory who has access to Nucleus.

Nucleus has two options for setting up your Azure AD based on groups or based on roles. Choose the option below based on which pertains to your organization:

1. Setting up Azure AD with Groups
2. Setting up Azure AD for Roles

You'll need an Azure AD subscription to follow the steps below. Note that these screenshots pertain to the newest Azure Portal.

Option 1: Setting up Azure AD with Groups

Log into your office console and complete the following steps:

1. Click Azure Active Directory on the left side of the console, in the left-hand navigation menu.

2. Click Enterprise Applications in the left-hand navbar OR click Find an enterprise app on the dashboard.

OR

3. Click + New Application.

4. On the "Add an application" page, click Non-gallery application.

5. On the following page, enter in the following information, then click Add:

Name: A name to differentiate the application in your Azure.

6. On the following page, click Single sign-on in the lefthand navigation menu.

7. Click on SAML.

8. On the following page, enter in the following information, then click Save:

9. Once you have saved the Basic SAML Configuration, scroll down the page until you get to Section 3, SAML SIGNING CERTIFICATE

10. Do the following in this section (Section 3):

• Copy the Thumbprint: You will need to send this to your nucleus support representative
• Download the Certificate(Base64): You will need to send this to your Nucleus representative

11. Once you have copied/downloaded the info from step 12, scroll down even further to the Set up Application Name and copy the following

• Copy the Login URL: You will need to send this to your Nucleus representative
• Copy the Azure AD Identifier: You will need to send this to your Nucleus support representative

12. Once you have all of the above, navigate to Users and Groups on the left-hand navbar:

13. Click + Add user

14. Add as many users or groups to the application as you would like.

15. Once you have added your users to the application, collect all your information which you need to send to your Nucleus representative to complete the SSO setup for you. You will need the following, which can all be found in the Single sign-on tab in the lefthand navbar:

• SSO Domain: The domain that user accounts belong to, usually the part after the @ sign.
• Identifier (Entity ID): Needs to be copied
• Thumbprint: Needs to be copied
• Certificate(Base64): Needs to be downloaded
• Login URL: Needs to be copied
• Azure AD Identifier: Needs to be copied
• If you are using token encryption: Affects how your Nucleus representative set ups SSO for you.

16. (For Azure Group Mapping) If you would like to use Azure AD groups to assign and manage Nucleus roles, use the following instructions:

    1. Navigate to All Services, then App registrations.
    2. Select the application you just created, then click the Manifest button.
    3. In the resulting Edit manifest page, modify the "groupMembershipClaims" field to read: "ApplicationGroup". Then click Save. In the manifest this will appear as:

"groupMembershipClaims": "ApplicationGroup",

"groupMembershipClaims": "All",

17. Once you send this info to your Nucleus representative, your SSO setup should be completed within 24 hours by a Nucleus support rep, who will respond to you via email confirming that SSO is complete.

18. If you are using token encryption, you will also need to set up encryption within Azure AD:

    1. Request the .cer certificate file and SSO URL for token encryption from your Nucleus representative.
    2. Log into Azure AD and navigate to your application.
    3. In the navigation bar on the left, under Security, select Token encryption.
    4. Click Import Certificate.
    5. Select the .cer certificate file provided by your Nucleus representative.
    6. Click Add.
       
    7. Click the button with three dots ("...") to the far right of the certificate in the list of certificates.
    8. From the menu, select Activate token encryption certificate.
    9. In the navigation bar on the left, under Manage, select Single sign-on.
    10. Under Basic SAML Configuration, confirm the Reply URL (Assertion Consumer Service URL) includes the parameter "?sso=", which is required for token encryption. If the URL doesn't contain that parameter:
        1. Click the Edit button.
        2. In the Reply URL (Assertion Consumer Service URL) field, enter the new URL provided by your Nucleus representative in step a.
        3. Click Save at the top.
           

Option 2: Setting up Azure AD for Roles

Log into your Office Admin console and complete the following steps:

1. Click Azure Active Directory on the left side of the console, in the left-hand navigation menu.

2. Click Enterprise Applications in the left-hand navbar OR click Find an enterprise app on the dashboard.

OR

3. Click + New Application.

4. On the "Add an application" page, click Non-gallery application.

5. On the following page, enter in the following information, then click Add:

Name: A name to differentiate the application in your Azure.

6. On the following page, click Single sign-on in the lefthand navigation menu.

7. Click on SAML.

8. On the following page, enter in the following information, then click Save:

9. If you would like to use Azure AD roles to assign Nucleus roles, use the following instructions:

10. Navigate to All Services, then App registrations.

11. Select the application you just created, then click the Manifest button.

12. In the resulting Edit manifest page, modify the "groupMembershipClaims" field to read: "All". Then click Save.

13. Create your roles in the manifest for the enterprise app you just created using the following resource, (section 6h): https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-enterprise-app-role-management

    • Once you have completed section h, please click Save on the manifest.
    • Close the Microsoft Help Center Article

An example manifest is shown here (Admin is the role which we created):

14. Once you have successfully created the roles for the enterprise application, navigate to Enterprise Applications > Nucleus Application you just created > Single Sign-on, then scroll down the page until you get to Section 2, User Attributes & Claims.

15. Click on the edit (pencil) icon in Section 2, User Attributes & Claims.

16. Click Add new claim, then enter the following information, and click Save:

• Name: role
• Source attribute: user.assignedroles

17. Once you have saved the Basic SAML Configuration, scroll down the page until you get to Section 3, SAML SIGNING CERTIFICATE

18. Do the following in this section:

• Copy the Thumbprint: You will need to send this to your nucleus support representative
• Download the Certificate(Base64): You will need to send this to your Nucleus representative

19. Once you have copied/downloaded the info from step 12, scroll down even further to the Set up Application Name and copy the following:

• Copy the Login URL: You will need to send this to your Nucleus representative
• Copy the Azure AD Identifier: You will need to send this to your Nucleus support representative

20. Once you have all of the above, navigate to Users and Groups on the left-hand navbar:

21. Click + Add user

22. Add as many users or groups to the application as you would like.

Select the roles for each user that you created in step 9. You can assign each group or user a role in the application from this screen. For the example we gave in step 9, you could assign a user the "Admin" role, which will be passed in the SAML response to Nucleus.

23. Once you have added your users to the application, collect all your information which you need to send to your Nucleus representative to complete the SSO setup for you. You will need the following, which can all be found in the Single sign-on tab in the lefthand navbar:

• Identifier (Entity ID): Needs to be copied
• Thumbprint: Needs to be copied
• Certificate(Base64): Needs to be downloaded
• Login URL: Needs to be copied
• Azure AD Identifier: Needs to be copied
• • If you are using token encryption: Affects how your Nucleus representative set ups SSO for you.

24. Once you send this info to your Nucleus representative, your SSO setup should be completed within 24 hours by a Nucleus support rep, who will respond to you via email confirming that SSO is complete.

25. If you are using token encryption, you will also need to set up encryption within Azure AD:

    1. Request the .cer certificate file and SSO URL for token encryption from your Nucleus representative.
    2. Log into Azure AD and navigate to your application.
    3. In the navigation bar on the left, under Security, select Token encryption.
    4. Click Import Certificate.
    5. Select the .cer certificate file provided by your Nucleus representative.
    6. Click Add.
       
    7. Click the button with three dots ("...") to the far right of the certificate in the list of certificates.
    8. From the menu, select Activate token encryption certificate.
    9. In the navigation bar on the left, under Manage, select Single sign-on.
    10. Under Basic SAML Configuration, confirm the Reply URL (Assertion Consumer Service URL) includes the parameter "?sso=", which is required for token encryption. If the URL doesn't contain that parameter:
        1. Click the Edit button.
        2. In the Reply URL (Assertion Consumer Service URL) field, enter the new URL provided by your Nucleus representative in step a.
        3. Click Save at the top.
           

If you used AD groups or roles within your SSO setup, please refer to the SSO Mapping Page for instructions on how to map your user groups and roles from AD to Nucleus.