Use Single Sign-On with Microsoft Entra ID

Overview¶

This page describes the setup procedure for using single sign-on with Microsoft Entra ID.

Limitations¶

1. SAML authentication cannot be used in the Pleasanter.net shared environment.
2. Pleasanter does not have a function to issue SP metadata. You cannot register the SP metadata with the IdP.
3. Use https in production environments. Use http only for local verification and development.

Prerequisites¶

1. A Microsoft Entra ID tenant exists, and you have permission to create enterprise applications.

Operation Procedure¶

1. Create an Enterprise Application in Entra ID¶

1. Sign in to the Microsoft Entra admin center.
2. Open "Enterprise applications" from the menu on the left of the screen, and click "New application".
3. Select "Create your own application", enter an app name (e.g., Pleasanter), and click "Create".
4. Open the created application, and select "Single sign-on" → SAML.

2. Register the SP Information in Entra ID¶

1. Click "Edit" in the "Basic SAML Configuration" section, and enter the following values.
   Replace {ServerName} with the URL of the server on which Pleasanter is running.

   Item	Value
   Identifier (Entity ID)	{ServerName}/Saml2
   Reply URL (Assertion Consumer Service URL)	{ServerName}/Saml2/Acs

2. After entering the values, click "Save".

3. Get the Metadata URL and Tenant Information¶

Get the values required for the settings of Authentication.json with the following procedure.

1. On the same single sign-on settings screen, note the "App Federation Metadata Url" in the "SAML Signing Certificate" section. This is the value to set in MetadataLocation.
2. Open the "Attributes & Claims" section, and note the value of "Microsoft Entra Identifier" (in the format https://sts.windows.net/{TenantId}/). This is the value to set in EntityId.
3. Note the "Application ID" in the "Properties" of the application. This is the value of the appid parameter included in the MetadataLocation URL.

4. Edit Authentication.json¶

Open Authentication.json on the Pleasanter server, and edit it with reference to the following setting example.

1. Make {ServerName} in SPOptions.EntityId and SPOptions.ReturnUrl match the "Identifier (Entity ID)" and "Reply URL" registered in Entra ID in step 2.

2. Replace {TenantId} and {AppId} with the values obtained in step 3.

   {
       "Provider": "SAML",
       "SamlParameters": {
           "Attributes": {
               "Name": "Name",
               "UserCode": "UserCode",
               "Birthday": "Birthday",
               "Gender": "Gender",
               "Language": "Language",
               "TimeZone": "TimeZone",
               "TenantManager": "TenantManager",
               "DeptCode": "DeptCode",
               "Dept": "Dept",
               "Body": "Body",
               "MailAddress": "{NameId}"
           },
           "SamlTenantId": 1,
           "DisableOverwriteName": false,
           "NotCreatePersistentCookie": false,
           "SPOptions": {
               "EntityId": "https://{ServerName}/Saml2",
               "ReturnUrl": "https://{ServerName}/Users/SamlLogin",
               "AuthenticateRequestSigningBehavior": "IfIdpWantAuthnRequestsSigned",
               "OutboundSigningAlgorithm": "https://www.w3.org/2001/04/xmldsig-more#rsa-sha256",
               "MinIncomingSigningAlgorithm": "https://www.w3.org/2001/04/xmldsig-more#rsa-sha256",
               "IgnoreMissingInResponseTo": false,
               "PublicOrigin": null,
               "ServiceCertificates": []
           },
           "IdentityProviders": [
               {
                   "EntityId": "https://sts.windows.net/{TenantId}/",
                   "SignOnUrl": "https://login.microsoftonline.com/{TenantId}/saml2",
                   "LogoutUrl": null,
                   "AllowUnsolicitedAuthnResponse": true,
                   "Binding": "HttpPost",
                   "WantAuthnRequestsSigned": false,
                   "DisableOutboundLogoutRequests": true,
                   "LoadMetadata": true,
                   "MetadataLocation": "https://login.microsoftonline.com/{TenantId}/FederationMetadata/2007-06/FederationMetadata.xml?appid={AppId}",
                   "SigningCertificate": null
               }
           ]
       }
   }
   

5. Restart IIS and Check the Operation¶

1. Restart IIS.
2. Access Pleasanter in a browser.
3. Confirm that the "SSO Login" button is displayed on the login screen, click it, and check that you can log in with Entra ID.

Supported Versions¶

Related Information¶

• Microsoft Entra admin center
• Use SAML authentication in Pleasanter