Microsoft Office 365 SAML integration

An Acceptto account with a configured Identity Provider and LDAP Agent.

For more information, see the LDAP Agent deployment guide.

A user with administrative privileges for the Acceptto services.

An organization identifier provided by Acceptto (organization slug).

A Microsoft™ Azure Active Directory tenant with custom domain configuration.

An Azure Active Directory tenant administrator account.

Acceptto acts as an identity provider (IdP) for Office 365 and authenticates users against your existing on-premises Active Directory credentials. On the other hand, Office 365 uses Azure AD as its identity store. Then, on-premises AD users should be synchronized to Azure AD through Azure AD Connect application. In addition, all the Azure AD users that will be authenticated via Acceptto SAML must have an immutableID set. To identify which users may not have an immutableID set run the following PowerShell™ command (Make sure you have the MSOnline PowerShell module installed via “Install-Module -Name MSOnline” and connect to your Azure instance via “Connect-MsolService” command):

Get-MsolUser -All | Select-Object UserprincipalName,ImmutableID

UserPrincipalName                  ImmutableId
-----------------                  -----------
User1@example.com      123ABC45-67EF-90GH-12IJ-34KL56MN7890P
User2@example.com

Make sure you have the latest WMF (Windows management framework) installed. You can check the version of your PowerShell with this command:

Get-Host | Select-Object Version

Users that do not show an ImmutableID such as User2@example.com, will not be able to login using SAML. To change the ImmutableID for specific users, run the following PowerShell command (replace UserPrincipalName with the affected user UserPrincipalName, e.g., User2@example.com):

$guid = New-Guid
Set-MSOLUser -UserPrincipalName UserPrincipalname -ImmutableID $guid

Login to the Acceptto Dashboard with an administrative account and go to Applications.

Create a new application by selecting the Create New Application.

In the New Application form, enter the following values under the General tab:

Under the SAML Service Provider Configuration tab, enter the following values (Click on the Microsoft federation metadata url and find the required attributes).

Click Save to create the Application.

Download your SAML IdP X509 certificate. Go to the following website to download the cert.pem file containing your certificate:

http://sso.acceptto.com/[organization identifier]/saml/download/cert

Note: Azure AD requires the certificate in string format. Before you use this certificate, open the file in a text editor and edit the certificate by removing the line breaks and the begin/end certificate directives in such a way to have it as a single line string format (this web utility can do this automatically).

Run PowerShell as an administrator and connect to your Azure instance with the command below. You need to login with your Azure tenant administrator account. Note: this admin account should be in a separate domain than the one that will be federated (e.g. a member of the default domain that is provided by Microsoft).

Connect-MsolService

Retrieve all domains for the company (verified or unverified) to identify the domain should be federated.

Get-MsolDomain

Run the following script in a PowerShell environment (most of the values come from the earlier section “Configure the Acceptto Identity Provider”, update these values where necessary):

# The domain you want to authenticate against SAML(mandatory)
$domain="example.com"
# Identify who your IdP is
$BrandName = "Acceptto SAML IDP"
# Logon URL (mandatory)
$LogOnUrl = "https://sso.acceptto.com/[organization identifier]/saml/auth"
# Logoff URL (mandatory)
$LogOffUrl = "https://sso.acceptto.com/[organization identifier]/saml/logout"
# The IdP Certificate. Note the use of @ to make it a raw text variable.
$SigningCert = "Copy your Acceptto Appliance SAML signing certificate got earlier in one single line, here"
# The issuer URI. 
$uri = "https://sso.acceptto.com/[organization identifier]/saml"
$Protocol = "SAMLP"

After defining the parameters, issue the below command . A successful run of the command should not return any errors.

Set-MsolDomainAuthentication -DomainName $domain -FederationBrandName $BrandName -Authentication federated -PassiveLogOnUri $LogOnUrl -SigningCertificate $SigningCert -IssuerUri $uri -LogOffUri $LogOffUrl -PreferredAuthenticationProtocol $Protocol 

To verify if the domain is configured to use SAML, use the following command:

Get-MsolDomainFederationSettings -domainname example.com | fl *

The output should be similar to the following and must show the same values as used in the script variables above.

ExtensionData                          : System.Runtime.Serialization.ExtensionDataObject
ActiveLogOnUri                         :
DefaultInteractiveAuthenticationMethod :
FederationBrandName                    : acceptto.com
IssuerUri                              : https://sso.acceptto.com/org-id/saml
LogOffUri                              : https://sso.acceptto.com/org-id/saml/logout
MetadataExchangeUri                    :
NextSigningCertificate                 :
OpenIdConnectDiscoveryEndpoint         :
PassiveLogOnUri                        : https://sso.acceptto.com/org-id/saml/auth
PasswordChangeUri                      :
PasswordResetUri                       :
PreferredAuthenticationProtocol        : Samlp
PromptLoginBehavior                    :
SigningCertificate                     : MII 79701424009245946274090644119698913542736738414383197137136495653488597823440743026907540474162173229890086677980241691766203566484177525691391892547529556572165857639252331212281503088199745189921112D=
SigningCertificateUpdateStatus         :
SupportsMfa                            :

Go to the Azure or Office 365 portals. You will be redirected to the Acceptto SAML page.

After successful authentication, you’ll see the Acceptto’s authenticator options. Select the desired method and approve the verification stage.

Finally, you will be redirected to your Azure/Office 365 landing page.