Azure Active Directory

To set up SSO with Azure AD you will need a Microsoft Azure Premium account.

Creating an enterprise app for Beekeeper

1. Go to your Azure Active Directory Portal for Enterprise Applications. 
   
   
2. Click on + New application
   
   
   
   
3. Click on + Create your own application
   
   
   
   
4. Give the app a name, e.g. "Beekeeper SSO". Keep the option Integrate any other application you don't find in the gallery (Non-gallery). Click on Create.
   
   

Managing user assignment for the application

You can either assign specific users and groups to access the application or you can make user / group assignment optional. 

Option 1: Assign users and groups

1. Click on Users and groups
   
   
   
   
2. Click on Add user/group
   
   
   
   
3. Click on None Selected
   
   
   
   
4. Select the user or group you want to assign to the application and click on Select
   
   
   
   
5. Click on Assign
   
   
   

Option 2: Making user / group assignment optional

1. Click on Properties
   
   
   
   
2. For the configuration User assignment required? click on the option No
   
   
   
   
3. Click on Save
   
   
   

Setting up single sign-on

SAML configuration

1. Click on Single sign-on
   
   
   
   
2. Click on SAML
   
   
   
   
3. In the Basic SAML Configuration box click Edit
   
   
   
   
4. Fill in the values for the Identifier and the Reply URL according to the instructions below and click Save:
   
   
   • Identifier: https://yoursubdomain.us.beekeeper.io/saml/sso/metadata.xml
   • Reply URL: https://yoursubdomain.us.beekeeper.io/saml/sso/
   
   Please ensure that the URLs include both your own Beekeeper subdomain as well as your datacenter reference, eg. us, ch, or de (for the European data center, there is no reference).
   
   

User Attributes

You can populate a user’s Beekeeper profile fields during login by defining which information will be sent in the SAML token. For each Beekeeper profile field, you will need the placeholder value, which you can find in the Beekeeper Dashboard under Settings > Profile Fields.

1. In the User Attributes & Claims box click on Edit
   
   
   
   
2. Click on the required Unique User Identifier (Name ID) claim
   
   
   
   
3. Click on the Name identifier format * field and select Persistent
   
   
   
   
   
4. Click on the Source attribute * field and select the attribute that you want to use as the Beekeeper User ID
   
   
   
   
5. Click on Save
   
   
6.  
7. You can edit the additional claims by clicking on them.
   
   
   
   Below you can see an example set of token attributes:
   
   

   Name*	Source Attribute
   firstname	user.givenname
   lastname	user.surname
   email	user.mail
   username**	user.samAccountName
   position	user.jobtitle

   
   * Each attribute needs the corresponding placeholder value of the Profile Field in the Beekeeper Dashboard. 
   
   ** Please note: Only the above mentioned attributes are supported to populate the corresponding Beekeeper profile fields. Additionally, the Beekeeper username does not allow any special characters except for "_", therefore, an attribute needs to be selected with this restriction in mind.
   
   
8. Enter the profile field placeholder value in the Name * field
   
   
   
   
9. The Namespace field may be defaulted with a value such as http://schemas.xmlsoap.org/ws/2005/05/identity/claims. You should clear this field and leave it blank.
   
   
   
   This is necessary because Azure prepends any namespace to the attribute name, so by default it will send an attribute named http://schemas.xmlsoap.org/ws/2005/05/identity/claims/email (which Beekeeper will not recognize) instead of email (which the server expects).
   
   
10. Click on Save

Optional: Create a claim for the attribute user.jobtitle

1. Click on Add new claim
   
   
   
   
2. Enter the profile field placeholder value in the Name * field
   
   
   
   
3. In the field Source attribute *, search for user.jobtitle and select it
   
   
4. Click on Save

After you have edited/added all necessary claims, your claim overview should look similar to the following:

SAML Signing Certificate

1. In the SAML Signing Certificate box click Download for Federation Metadata XML and save the file to your desktop
   
   
   
   
2. Open the downloaded file and copy the content
   
   
3. Go to the Beekeeper Dashboard and navigate to Settings > General > Single Sign-On
   
   
4. Select which authentication option you want enabled for the platform (you can find more information on the differences here)
   
   
   
   
5. Paste the content from the downloaded file into the SAML Metadata box
   
   
   
   
6. Choose whether you want to automatically provision user accounts for new users or not
   
   
   
   
7. Click on Save settings
   
   

Final steps

To test whether the configuration was successful, you can navigate back to the single sign-on configuration window of your SSO enterprise application. In the last box of the configuration overview click on Test.

For any questions, comments, or concerns please reach out to technical.support@beekeeper.io.