Troubleshooting SAML Configuration via Azure Active Directory

This article walks through problems you might encounter after you have set up Single Sign On for your cloud instance following the steps in Legacy SAML Setup Guide for Microsoft Azure Active Directory.

If the Singe Sign On is not working as expected, please review the most common causes below, including how to verify them and how to fix it.

🔧 Problem during Basic SAML Configuration

Symptom

When trying to log in to iGrafx and you see an Azure AD error screen that looks similar to the following message:

Misconfigured application. This could be due to one of the following: the client has not listed any permissions for AAD Graph in the requested permissions in the client's application registration. Or, the admin has not consented in the tenant. Or, check the application identifier in the request to ensure it matches the configured client application identifier. Or, check the certificate in the request to ensure it's valid. Please contact your admin to fix the configuration or consent on behalf of the tenant. Client app ID

Potential Causes

One of the three URLs/Identifiers that make up the Basic SAML Configuration in your Azure Enterprise Application does not match the expected patterns. You can verify this by going to the iGrafx Azure Enterprise Application in your Azure Portal at https://portal.azure.com and opening the Single-Sign-On Tab, then looking at the Basic SAML Configuration section.

Fix

After navigating to the Basic SAML Configuration  section, ensure the three items look as follows, including the https://  protocol prefix as well as the correct capitalization, and replacing %SUBDOMAIN%  with your iGrafx subdomain:

Identifier (Entity ID)

https://%SUBDOMAIN%.igrafxcloud.com/saml/metadata 

Reply URL (ACS URL)

https://%SUBDOMAIN%.igrafxcloud.com/saml/SSO

Sign on URL

https://%SUBDOMAIN%.igrafxcloud.com 

If any of the items does not look correct, click the pencil icon to edit it accordingly and save the changes

🔧 Problem with User and Group scopes

Symptom

When trying to log in to iGrafx and you see an Azure AD error screen that looks similar to the following message, indicating that your user is not in scope for the Azure application:

Your administrator has configured the application iGrafx Platform to block users unless they are specifically granted ("assigned") access to the application. The signed in user "username" is blocked because they are not a direct member of a group with access, nor had access directly assigned by an administrator. Please contact your administrator to assign access to this application.

Potential Causes

This problem is caused by the user not directly or through one of the groups being configured to access the respective Azure Enterprise Application and can be fixed with in the Azure Portal.

Fix

Open your iGrafx Azure Enterprise Application in your Azure Portal at https://portal.azure.com and go to the Users and Groups  blade. On the respective blade, you will see the list of directly assigned users and list of user groups that have access to the application. Make sure the user is a member of at least one of the groups or is directly assigned access to the application by clicking the Ad user/group  button at the top.