Enterprise App Store SSO Authorization

Introduction

Managing user groups within Auth0 provides users and organizations with several benefits. By organizing users into groups, administrators can efficiently manage access permissions for various applications and resources, saving time and effort. Administrators can synchronize Auth0 user groups with Appcircle, allowing for granular access control and group-based permissions. This integration enhances security, simplifies access management, and promotes collaboration within organizations utilizing the Appcircle platform.

Summary of Configuration Steps

This section provides a brief summary of the configuration steps.

1. Perform identity provider-specific configurations, including creating groups, and defining group claims/attributes.
2. In Appcircle, specify the Claim Name (OpenID)/Attribute Name (SAML) according to your Identity Provider configuration.
3. In Appcircle, enable SSO Authentication for Enteprise App Store and Testing Distribution.

Specific Provider Configuration

Auth0

Auth0 (OpenID Connect)

Step 1. Create Organizations

1. In the Auth0 dashboard, navigate to the Organization section.
2. Click Create Organization button to create organizations.

3. Click created organization to navigated Organization Details.
4. On the Organization Details screen, click on the Members tab to manage members of organization.
5. Click the Add Members button. Add users who will become members of your organization.

6. On the Organization Details screen, navigate to the Connections tab.
7. Click the Enable Connections button
8. Select Username-Password-Authentication and click on Enable Connection

9. Select Enable Auto-Membership and Enable Signup on the displayed screen, then click Save.

Step 2. Enable organization for your application

1. In the Auth0 dashboard, navigate to the Applications section.
2. Select the relevant application.
3. On the Application Details screen, navigate to the Organizations tab.

4. Click Disable Grants Now.
5. Choose Business Users for the type of users and select Prompt for Organization for the login flow.
6. Click Save Changes.

Step 3. Define Group Claim Name

1. Navigate to the SSO Login screen in Appcircle.
2. Enter the Claim Name (OpenID)/Attribute Name (SAML) as org_id.

Auth0 (SAML)

Step 1. Create Organizations

1. In the Auth0 dashboard, navigate to the Organization section.
2. Click Create Organization button to create organizations.

3. Click created organization to navigated Organization Details.
4. On the Organization Details screen, click on the Members tab to manage members of organization.
5. Click the Add Members button. Add users who will become members of your organization.

6. On the Organization Details screen, navigate to the Connections tab.
7. Click the Enable Connections button
8. Select Username-Password-Authentication and click on Enable Connection

9. Select Enable Auto-Membership and Enable Signup on the displayed screen, then click Save.

Step 2. Enable organization for your application

1. In the Auth0 dashboard, navigate to the Applications section.
2. Select the relevant application.
3. On the Application Details screen, navigate to the Organizations tab.

4. Click Disable Grants Now.
5. Choose Business Users for the type of users and select Prompt for Organization for the login flow.
6. Click Save Changes.

Step 3. Define Group Attribute Name

1. Navigate to the SSO Login screen in Appcircle.
2. Enter the Claim Name (OpenID)/Attribute Name (SAML) as http://schemas.auth0.com/org_id.

Microsoft Entra ID (formerly Azure Active Directory)

Microsoft Entra ID (SAML)

Step 1. Create Groups in Microsoft Entra ID

1. Log in to Azure as an admin and navigate to Azure Services > Microsoft Entra ID

2. Navigate to the Manage > Groups section from left menu.
3. Click the New Group.

4. Assign a proper name and description to the new group. Designate an owner and members to the group.

Step 3. Assign user and group to application in Microsoft Entra ID

1. Navigate to the Azure Services > Microsoft Entra ID.
2. Navigate to the Manage > Enterprise applications section from left menu.

3. Click your application.

4. Click Assign users and groups.

5. Click Add user/group.

6. Select users, groups and role. This process can be repeated as needed.

Step 4. Define Group Attributes & Claims in Microsoft Entra ID

1. Navigate to the Manage > Single sign-on section from left menu.
2. Click Edit in Attributes & Claims section.

3. Click the Add a Group Claim.
4. Select the Groups assigned to the application
5. Select the Cloud only group display names as source attribute.
6. Then click on the Save button

Step 5. Define Group Role Attributes names in Appcircle

1. Navigate to the SSO Login screen in Appcircle.
2. Enter the Claim Name (OpenID)/Attribute Name (SAML) as http://schemas.microsoft.com/ws/2008/06/identity/claims/groups.

Okta

Okta (OpenID Connect)

Step 1. Create Groups and Define Group Claim

1. Navigate to the Directory > Groups section in the Okta Dashboard
2. Create the groups as needed.

3. Assign users to groups.

4. Navigate to the Applications > Applications section from left navigation menu.
5. Select your application from the list
6. Navigate to the Sign on tab.
7. Click Edit for OpenID Connect ID Token.

8. Enter Groups claim filter as shown in the image below.

9. Navigate to the Applications > Applications section from left navigation menu.
10. Click Refresh Application Data.

Define Group Claim in Appcircle

1. Navigate to the SSO Login screen in Appcircle.
2. Enter the Claim Name (OpenID)/Attribute Name (SAML) as groups.

Okta (SAML)

Step 1. Create Groups and Assign to the Application

1. Navigate to the Directory > Groups section in the Okta Dashboard. Create the groups as needed.

2. Assign users to groups.

3. Navigate to the Applications > Applications section from left navigation menu.
4. Select your application from the list
5. Navigate to the Assignments tab.
6. Assign the previously created groups to the application.

Step 3. Define Group Attributes

1. Navigate to the Applications > Applications section.
2. Select your application from the list and navigate to the General tab.
3. Click on Edit in SAML Settings

4. Enter the Group Attribute statement as as shown in the image below.

Step 4. Define Group and Role Claim in Appcircle

1. Navigate to the SSO Login screen in Appcircle.
2. Enter the Claim Name (OpenID)/Attribute Name (SAML) as groups.

Testing and Troubleshooting

After configuring Authorization with SSO for Enterprise App Store, it is important to test the integration to ensure that users authorization work seamlessly and as expected. Follow Enterprise App Store Documentation to test the integration.