Nectar DXP SSO with Microsoft Azure

Overview

This document provides specific information about configuring Nectar DXP SSO with Microsoft Azure. For more general information about enabling SSO in Nectar DXP, refer to Configure Nectar DXP for SSO. The below procedure is an example only. Your specific requirements for Azure SSO configuration may vary.

Procedure

1. Logon to Nectar DXP with an administrator account, and navigate to ADMIN on the top-bar, then to SSO Configuration on the left-side menu 
2. Click on GENERATE SAML FILE. A window will pop-up asking for the following information:
   1. Beside Service Provider Entity ID, enter a name to be used for the SSO entity ID. This must be unique in your Azure AD tenant and within Nectar DXP. Suggested format is nectar_companyname_sso IE.  nectar_contoso_sso. No spaces, special characters or upper-case characters are allowed.
   2. Beside SSO User Groups Attribute, enter http://schemas.microsoft.com/ws/2008/06/identity/claims/groups
   3. Click GENERATE when done.
3. The screen will show an XML metadata file. Click the Download file button and save the XML file for later. 
4. Logon to portal.azure.com with an account that has rights to manage Azure Active Directory
5. Navigate to Azure Active Directory
6. On the left-side menu, select Enterprise applications

    

7. Click on New application
   

    

8. In the Browse Azure AD Gallery section, select Create your own application
   

    

9. Create a name such as Nectar DXP SSO Integration. The name must be unique in your tenant.
10. Select the radio button beside Integrate any other application you don't find in the gallery (Non-gallery)
    

     

11. Under Getting Started select 2. Set up single sign on. Alternatively, select Single sign-onon the left-side menu.
    

     

12. Under Select a single sign-on method, select SAML.
    

     

13. Click on Upload metadata file, and select the XML metadata file downloaded in step #3
    

     

14. You should see a SAML File upload success notification. Review the settings and click Save.
    

     

15. Close the side window by clicking X. If prompted to test single sign-on, click No, I'll test later.
16. In the Attributes & Claims section, select Edit.
    

     

17. Click on Add a group claim
    

     

18. On the Group Claims window that appears, select the appropriate radio button for your specific needs. At bare minimum, it is suggested to select either All groups or Security groups.
19. Under Source attribute, select the attribute name that will be associated with the SSO application. This will determine how to identify which Azure group is mapped to the appropriate Nectar DXP role. If your Azure AD is not integrated with an on-prem Active Directory implementation, select Group ID. Otherwise, select the option that best suits your needs. Click Save when done.
    

     

20. Close the Attributes & Claims window by clicking the X.
21. Download the federation metadata XML by clicking the Download button beside that option on the SAML Signing Certificate section. Save the file for later.
    

     

22. In Nectar DXP, upload the XML metadata downloaded in the previous step Nectar DXP under the Identity Provider Service Configuration section
    

     

23. Under User Roles Mapping, select a Nectar DXP Tenant User Role on the left. The defaults are Administrator and ReadOnly. Additional roles can be defined if desired.
24. Under External User Role, enter the name of the Azure group that you want to allow members to logon to Nectar DXP using the source attribute format selected in step #19. For example, if Group ID is the selected source attribute, enter the object ID of the desired group. 
    

     

25. Add additional role mappings as required
26. Finally, click the Enable SSO login checkbox and click UPDATE

Validation

1. Log out of Nectar DXP, and return to the login page. 
2. Select SSO Login and enter your domain name. Press NEXT.
3. If all is well, you should be directed to your SSO provider to authenticate.