Microsoft Entra ID OnPrem (SAML)

This guide will walk you through the steps required to configure Microsoft Entra ID as a Single Sign-On (SSO) provider in On Premise deployment of Observo using SAML 2.0.

Prerequisites

  • Active Entra ID.

  • A running Observo On Premise deployment.

  • Admin access to both Entra ID and Observo.

Steps to Set Up Entra ID as a SAML Identity Provider in Observo

1. Create an Enterprise Application in Entra ID

You need to create an Enterprise Application in Entra ID to enable On Premise Observo to authenticate users via SAML.

  1. Log into Azure Portal and Go to Entra ID Service.

  2. Go to Enterprise applications under Manage tab in left Menu.

  3. Click on New application.

  4. Click Create your own application.

  5. Provide a user facing display name for the application (e.g., "Observo SAML").

  6. Select Integrate any other application you don't find in the gallery.

  7. Click Create button to create the Enterprise Application.

2. Download SAML Metadata

Download the SAML metadata file that will be used in Observo configuration.

  1. In the Enterprise application's Overview section, go to Manage > Single sign-on.

  2. Select SAML as the single sign-on method.

  3. Skip the Basic SAML Configuration for now (we'll configure this after setting up Keycloak).

  4. In the SAML Certificates section, note the App Federation Metadata Url for alternative configuration method.

3. Configure Observo to Use Entra ID as a SAML Identity Provider

Now, configure Entra ID as a SAML Identity Provider in Observo keycloak.

  1. Log into Observo keycloak with Observo Admin users credential. Observo keycloak is hosted in this URL:

    https://<ObservoOnPremURL>/observo-auth

  2. Select the realm of your Observo deployment to configure Entra ID SSO. master is the default realm.

  3. In the left-hand menu, click Identity Providers.

  4. From the Add provider dropdown, select SAML.

  5. Fill in the following details:

    • Alias: entra-saml

    • Display name: (Optional) The name that users will see on the login screen (e.g., "Entra ID")

  6. Import SAML Configuration:

    • URL Import: Use the App Federation Metadata Url from step 2.

7Click Save.

4. Configure Basic SAML Settings in Entra ID

After creating the Identity Provider in Keycloak, you need to provide the SAML configuration in Entra ID.

Observo Keycloak

  1. Go to the identity provider you just created in keycloak for Entra ID and note the following URLs from the top of the page:

    • Redirect URI: It will look something like this: https://<ObservoOnPremURL>/observo-auth/realms/master/broker/entra-saml/endpoint

Entra ID

  1. Open the Enterprise Application you created in Entra ID.

  2. Go to Manage > Single sign-on > SAML.

  3. In Basic SAML Configuration, click Edit and configure:

    • Identifier (Entity ID): https://<ObservoOnPremURL>/observo-auth/realms/master

    • Reply URL (Assertion Consumer Service URL): Use the Redirect URI from Keycloak (from previous step)

    • Sign on URL: https://<ObservoOnPremURL>/observo-auth/realms/master/account

    • Logout Url: Use the Redirect URI from Keycloak (from previous step)

  4. Click Save.

5. Configure User Attributes & Claims

Now configure the claims that Entra ID will send to Observo.

  1. In the SAML configuration, go to Attributes & Claims section and click Edit.

  2. Ensure the following claims are configured:

    • Email:

      • Name: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress

      • Source attribute: user.mail

    • First Name:

      • Name: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname

      • Source attribute: user.givenname

    • Last Name:

      • Name: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname

      • Source attribute: user.surname

    • Groups (Optional for role mapping):

      • Name: http://schemas.microsoft.com/ws/2008/06/identity/claims/groups

      • Source attribute: user.groups [All]

  3. Click Save.

6. Configure Attribute Mappers

Create mappers to import user attributes from Entra ID into Observo.

  1. Log into keycloak and Go to the entra-saml identity provider you just created.

  2. Click on the Mappers tab.

  3. Create the following mappers by clicking Add mapper → Attribute Importer:

    Email Mapper:

    • Name: Email

    • Attribute Name: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress

    • User Attribute Name: email

    First Name Mapper:

    • Name: First Name

    • Attribute Name: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname

    • User Attribute Name: firstName

    Last Name Mapper:

    • Name: Last Name

    • Attribute Name: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname

    • User Attribute Name: lastName

    User Name Mapper:

    • Name: User Name

    • Attribute Name: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

    • User Attribute Name: username

  4. Click Save for each mapper.

7. Create SSO Object in Observo

Observo UI needs to know about the domains name for which it will use SSO.

  1. Log in Observo UI and Go to Settings > SSO

  2. Configure SSO of type SAML and provide the required details

  3. In the Domain Aliases section, provide email domains that will use SSO.

  4. Next page, Configure Role Mapping (Optional)

    • Default User Role: Default role for those users with no explicit role assigned

    • Filed Path: realm_access.roles

    • Role Mapping: Map the roles you created in keycloak with Observo roles.

8. Add Role Mapper (Optional)

For using role mapping with Entra ID groups, follow these steps:

  1. Go to Realm roles in keycloak and create the roles you want to use.

  2. In the entra-saml identity provider, go to Mappers tab.

  3. Click Add mapper → Advanced Role:

    • Name: Groups Role Mapper

    • Sync Mode Override: Force

    • Mapper type: SAML Attribute to Role

    • Attribute Name: http://schemas.microsoft.com/ws/2008/06/identity/claims/groups

    • Attribute Value: Use the groups Object ID that you want to use for role mapping.

    • Role: Select the keycloak realm role to assign. If you don't find the role you created, try using Filter by realm roles.

9. Test the Integration

Once the configuration is complete, test the Entra ID SAML integration.

  1. Access Observo UI.

  2. Select the Entra ID SSO option on the login page.

  3. Log in with your Entra ID credentials.

  4. After successful authentication, you should be redirected back to Observo UI and logged in.

By following these steps, you should have Entra ID successfully integrated with Observo On Premise deployment using SAML 2.0.

PreviousMicrosoft Entra ID OnPremNextAzure Active Directory

Last updated

Was this helpful?