Skip to main content

Troubleshooting SAML configuration via Azure Active Directory

After setting up SSOSSO An authentication scheme that lets users sign in once with an identity provider and access Process360 Live without re-entering credentials. with the Legacy SAML setup guide for Microsoft Azure Active Directory, these are the two most common failures, with how to verify and fix each.

Symptom​

Misconfigured Basic SAMLSAML An XML-based standard for exchanging authentication and authorization data between an identity provider and a service provider. Process360 Live supports SAML 2.0 for SSO. Configuration — signing in shows an Azure AD error like:

Misconfigured application. This could be due to one of the following: the client has not listed any permissions for AAD Graph in the requested permissions in the client's application registration. Or, the admin has not consented in the tenant. Or, check the application identifier in the request to ensure it matches the configured client application identifier. …

User or group not in scope — signing in shows an Azure AD error like:

Your administrator has configured the application iGrafx Platform to block users unless they are specifically granted ("assigned") access to the application. The signed in user "username" is blocked because they are not a direct member of a group with access, nor had access directly assigned by an administrator. …

Cause​

  • Misconfigured Basic SAMLSAML An XML-based standard for exchanging authentication and authorization data between an identity provider and a service provider. Process360 Live supports SAML 2.0 for SSO. Configuration — one of the three URLs/identifiers in the Basic SAMLSAML An XML-based standard for exchanging authentication and authorization data between an identity provider and a service provider. Process360 Live supports SAML 2.0 for SSO. Configuration of your Azure enterprise application doesn't match the expected pattern.
  • User or group not in scope — the user isn't assigned to the enterprise application directly or through a group.

Resolution​

Fix the Basic SAML Configuration​

In the Azure portal, open the iGrafx enterprise application's Single sign-on tab and confirm the Basic SAMLSAML An XML-based standard for exchanging authentication and authorization data between an identity provider and a service provider. Process360 Live supports SAML 2.0 for SSO. Configuration values, including the https:// prefix and correct capitalization, replacing %SUBDOMAIN% with your iGrafx subdomain:

  • Identifier (Entity ID): https://%SUBDOMAIN%.igrafxcloud.com/saml/metadata
  • Reply URL (ACS URL): https://%SUBDOMAIN%.igrafxcloud.com/saml/SSO
  • Sign on URL: https://%SUBDOMAIN%.igrafxcloud.com

If any value is wrong, click the pencil icon to edit it and save.

Put the user in scope​

In the Azure portal, open the iGrafx enterprise application's Users and groups blade. Make sure the user is a member of at least one assigned group, or assign them directly with Add user/group.