SSO Configuration

Azure SAML 2.0 Setup

Step 1: Create an Enterprise Application

1. Open the Azure Portal and navigate to Enterprise Applications.
2. Click New Application, then select Create your own application.
3. Enter an App Name, select Integrate any other application you don't find in the gallery (Non-gallery), and click Create.

Step 2: Configure Single Sign-On

1. Go to your newly created app and select Single Sign-On from the left menu.
2. Click Edit under Basic SAML Configuration and enter the following URLs, replacing name.domain.com with your actual domain:
   • Identifier (Entity ID): https://name.domain.com
   • Reply URL (Assertion Consumer Service URL): https://name.domain.com/saml.aspx
   • Logout URL (optional): https://name.domain.com/hdnLogOff.aspx
3. Click Save.

Note: Make sure to replace every instance of name.domain.com with your actual domain before saving. Leaving placeholder values in place is a common source of configuration errors.

Step 3: Share Required Information with Frontline

After saving your configuration, collect the following and send them to the Frontline team:

• SAML Certificate – Download from the SAML Signing Certificate section of your app.
• Login URL – Copy from the Set up section of the Single Sign-On page.
• SAML Request XML File – Captured using the SAML Tracer Chrome extension (see below).

To capture the SAML Request XML file:

1. Install the SAML Tracer Chrome extension.
2. Open the extension and navigate to the URL from which you need the SAML request.
3. Click the URL in SAML Tracer, go to the SAML tab, and save the file as SAML Request.XML.
4. Send this file to the Frontline team.

Once Frontline receives the SAML Certificate, Login URL, and SAML Request XML file, they will begin testing and confirm the setup is complete.

Step 4: Add Users to the Application

Users must be added to the Enterprise Application in Azure Active Directory before they can log in. If a user attempts to log in before being added, they will receive an error.

Note: Users can be added individually or via Azure AD security groups. If your organization manages access through security groups, confirm with the Frontline team that group-based assignment is supported for your configuration.

Azure OpenID Connect Setup

Step 1: Log In and Navigate to Azure Active Directory

Log in to the Azure Portal and select Azure Active Directory from the side menu.

Step 2: Register the Application

1. Go to Manage > App Registrations > New Application Registration.
2. In the registration window:
   • Enter an Application Name.
   • Set the account type to Any Azure AD directory – Multitenant.
   • Click Register.

Note: Multitenant is required for Frontline's integration. If your organization has security policies restricting multitenant configurations, consult your IT team before proceeding.

Step 3: Create a Client Secret

1. Go to your new app and navigate to Manage > Certificates and Secrets.
2. Click New Client Secret.
3. Fill in the Description field and set an expiration date, then click Add.

Important: Make a note of the secret's expiration date. An expired client secret will break SSO for all users without warning. Plan to renew it before expiration and update the Frontline team when a new secret is generated.

Step 4: Add an Authentication URL

1. Go to Manage > Authentication and click Add URL.
2. Enter your platform URL: https://name.domainname.com/
3. At the bottom of the Authentication screen, check the box to issue ID tokens.

Step 5: Add Optional Claims

Go to Manage > Token Configuration and click Add Optional Claims to configure any required claim values.

Step 6: Expose an API and Add a Scope

1. Go to Manage > Expose an API and click Add a Scope.
2. Fill out the required fields and save the scope.
3. Return to Expose an API and click Add a Client Application to link your app.

Step 7: Set Up API Permissions

1. Go to Manage > API Permissions and click Add a Permission.
2. Navigate to the My APIs tab and select your application.
3. Select Application and check the box for AllowApi.
4. Click Add Permissions.

Step 8: Share Required Information with Frontline

To complete the integration, provide the Frontline team with the following from your Azure account:

• Client ID
• Tenant ID
• App Secret Value

Note: If your organization uses Conditional Access policies or MFA requirements in Azure AD, share this information with the Frontline team as well, as these settings can affect the SSO flow.