Birdview PSA
Submit a Ticket Login Sign Up

How can we help?

Articles in this section

See more

Company settings - single sign-on options

Avatar
Helpdesk
  • Updated
Follow

Overview

 

To have access to the Account settings, a user must have the ‘Manage system settings ’ permission enabled in her role. 

 

The option is used only when trying to access Birdview pages other than the login page directly, e.g. a link, bookmark, etc. If you try to access Birdview via the login page you will need to go through standard login procedure, i.e. enter your Birdview login and password.

 

Single sign-on options is a tab on the Account settings screen. Birdview supports Microsoft Azure's Single Sign-On (SSO) using Azure Active Directory (AD). With this feature you can log in to Birdview via the authentication endpoint in Azure ID. To learn more about SSO and Azure AD, click here.

Single sign-on protocol flow

 

  1. Precondition 1: A user exists in Birdview with the same email as a user registered in the Azure Active Directory. On how to use the option of auto-propagating Birdview users at their first login to Birdview, see below.
  2. Precondition 2: Single sign-on is enabled in Birdview. See below on how to enable SSO in Birdview.
    1. The user tries to access a Birdview page, e.g. Time logs.
    2. The user is automatically redirected to the Azure Active Directory authentication endpoint.
    3. After successful sign-in, the user is redirected to Birdview and taken directly to the required page.

Enabling SSO

To enable single sign-on in Birdview:

  1. Go to User menu > Company settings > Account settings > Single sign-on options tab
  2. Click 'Enable single sign-on'.
  3. Click 'Apply' at the bottom of the page. 

SSO type

Two SSO services are supported:

  • Azure AD, and
  • SAML

The Azure AD login is handled by cookies, so you simply login to one Azure AD site, in your network, and you'll be auto-logged in to all the other registered sites.

For SAML you will need either a url to the metadata or provide the metadata as an upload or paste the info.

To get the url you will follow steps similar to the steps, below

  1. Open the ADFS Management on the ADFS server.
  2. Go to Relying Party Trusts and select the target partner.
  3. Click Properties...
  4. Click the Identifiers tab and copy the Relying party identifier.
  5. Using a browser, log in to the web interface of the ADFS server that is provided by Internet Information Services (IIS).
    For example, go to the following URL: https://<host>:<port>/adfs/ls/IdpInitiatedSignOn.aspx?loginToRp=<partnerUrl>, where <partnerUrl> is the value of the Relying party identifier that you copied in the previous step.

Alternatively, you can export the metadata and upload or paste the info - tell EP which mode you want to do this - see this screenshot from the SSO section of the Advanced company settings

Screenshot_1504.png

Session management

Setting Sub-setting Description
Require sign-in at the start of each session   This option requires that you sign in at the beginning of each session.
Use single sign-on as the default authentication method   This sets single sign-on as the default authentication method.
Customize SSO login button text  Textbox This customizes the SSO button you see on the login page. Maximum length is 30 characters.

User provisioning

If you’d like Birdview to automatically create accounts for anyone who has access via Azure SSO at their first login to Birdview, use the following steps:

  1. Go to User menu > Company settings > Account settings > Single sign-on options tab.
  2. With the 'Enable single sign-on' selected, select 'Create users based on SSO automatically.'
  3. Select a default role for the auto-propagated users from the dropdown list.
  4. Specify the email domain to be used with the SSO-provisioned users.
  5. Click 'Apply' at the bottom of the page.
The email domain is used to verify the identity of the user that is received with the security token from Azure AD. Only domains used in the Email domain field are allowed.
As a result, a user with the same name and email as the matching Azure AD user will be created in Birdview.

Related articles