EBO SAML Single Sign On Integration Guide with Azure

[StephenYang]

Warning

Potential for Data Loss: The steps detailed in the resolution of this article may result in a loss of critical data if not performed properly. Before beginning these steps, make sure all important data is backed up in the event of data loss. If you are unsure or unfamiliar with any complex steps detailed in this article, please contact Product Support for assistance.

Issue

Need to setup SAML SSO with Azure EntraID

Product Line

EcoStruxure Building Operation

Environment

• Building Operation Workstation
• Azure

Cause

The SAML configuration requires details setup

Resolution

Part 1: EBO configuration

Creating and Configuring the SAML Configuration Object

To create and configure a SAML configuration object.

1. In WorkStation, in the System Tree pane, expand the System folder.
2. Expand the Federated Authentication folder.
3. Select the SAML Authenticator object.
4. On the File menu, click New object.
5. Select SAML Configuration.
6. Enter a name, path, and description on the object you want to create.
7. Click Create.
8. Configure the settings.
   

Enabling Federated Authentication

To enable federated authentication

1. In WorkStation, in the System Tree pane, select the EcoStruxure BMS server you want to configure.
2. Click the Control Panel tab.
3. Click Security Settings.
4. Select Enable federated authentication.
5. Click the Save button.
   

Configure SAML Configuration object

Service Provider
To configure the service provider.

1. In WorkStation, in the System Tree pane, click the SAML Configuration object.
2. Click the Service Provider Settings tab.
3. Configure the settings.
   

Identity Provider

To configure the identity provider.

1. In WorkStation, in the System Tree panel, click the SAML Configuration object.
2. Click the Identity Provider Settings tab.
3. Configure the settings.
   

Configuring the Security
To configure the security.

1. In WorkStation, in the System Tree pane, click the SAML Configuration object.
2. Click the Security Settings tab.
3. Configure the settings.
   

Create and configure domains
Create and configure a domain to be used for Federated Authentication.

1. Create a Domains
   
2. Create a group
   
3. Configure the permission for the group
   

Part 2: Azure Configuration

Login to https://azure.microsoft.com/

Create SAML application under Entra ID

1. Click Microsoft Entra ID
   

2. Click Enterprise Application
   
3. Select Create your down application
   Enter the name of the App
   Select “Integrate any other application you don’t find in the gallery (Non-gallery)”
4. An Enterprise Application is created with the name

Create a group

1. Select Groups
   
2. Click New Group
   
3. Select “Microsoft 365” for the Group type
   Enter the name of the group, the “Group name” must match the Domains Groups name in EBO.
   

4. Add Owners and Members to the group
   
   
   

Configure Entra ID

1. Select Assign users and groups in the Enterprise Application Overview
2. Select Add user/group then click Assign
   
3. The selected group is under the application
4. Select Set up single sign on in the Enterprise Application Overview
5. Under Basic SAML configuration
   Enter the information from EBO SAML Authenticator Basic Tab
   The Sign on URL is Base URL
   The Identifier is Entity ID
   The Reply URL is AAssertion Consumer Service URL
   
6. Click on Edit from Attributes & Claims
   
7. Click on “Add a group claim”
   Select Groups assigned to the application
   Select Cloud-only group display names under Source attribute
   update the “Unique User Identifier” Value to user.displayname
   
8. Download the “Federation Metadata XML” certificate
9. Open the XML file and find the line with certificate, it will start with <XXXXCertificate>

10. Copy the string between the two brackets and paste it in Public key certificate under Identity Provider Settings
    
11. Copy the Entity id and Single Sign On Service URL from Azure to EBO.
    The Entity Id is Microsoft Entra Identifier.
    The Single Sign On Service URL is Login URL.

Part 3: Testing

Test Single Sign On

1. Go to Webstation by entering the SmartX Server network address.
2. Click on Log on with SSO
   

3. Select the account within the Azure Group
   

4. Successful login screen