Configuring a SAML Domain with an Entra Identity Provider
Entrinsik does not support identity providers. This article helps you configure the most common identity provider, Microsoft Entra (Azure AD). It should not replace official Microsoft SAML 2.0 documentation or your internal procedures.
Microsoft updates the Enterprise Application screens frequently, so the exact layout in Entra may differ from what is described here.
Creating a custom application in Microsoft Entra
- Create a custom enterprise application. It is recommended to call it "Informer" or "Informer5." This article uses "Informer."
- After creating the application, the Overview screen opens.
- Assign users to the application. These users can access Informer (the service provider in this context).
- Return to the Overview screen and click 2. Set up single sign on.
- Enter the following values into their matching field in Informer.
| Microsoft Entra | Informer | Description |
|---|---|---|
| Identifier (Entity ID) | Issuer | Any text string, as long as it is unique and both entries match. Using the URL to access Informer (or the application name, such as "Informer5") is recommended. |
| Reply URL (Assertion Consumer Service URL) | Callback URL | A URL generated by Informer after the initial save on the SAML Domain configuration screen. Enter this URL into Entra. You may need to update it if the DNS to Informer is not configured as the Host value in the Informer server-side configuration. Ensure the Callback URL starts with the base access URL (DNS) to Informer. |
| Certificate (Base64) | Identity Provider Cert | The IdP certificate from Entra. Download the file, open it with a text editor, copy the body of the certificate, and paste it into the Identity Provider Cert field in Informer. |
| Login URL | Entrypoint URL | Copy the Login URL to the Entrypoint URL. |
Note: The Entra certificate body may change after the initial download for an unknown reason; this does not happen every time. If a SAML login test fails with an error like login: statusCode":401,"error":"Unauthorized","message":"Unable to log in", re-download the certificate from Entra and check that its body matches what is in Informer as the Identity Provider Cert. If they do not match, update the Identity Provider Cert value.
A Service Provider Cert and key are also needed to finish configuring the SAML Domain. See Configuring a SAML Domain for more information on creating these certificates and keys.
Attributes and claims
When a User profile is created from a token response, the mapped attributes and claims determine what values populate the user's profile in Informer. These options in Microsoft Entra vary and are mapped to the Informer SAML Domain attributes in the Fields tab.
Required claim
The Unique User Identifier (Name ID) matches the username field in the SAML configuration panel. This claim is commonly sAMAccountName, userPrincipalName, or onPremisesSamAccountName. The default is emailAddress, but it should be changed to meet the needs of the Informer configuration. This results in the username in Informer.
Additional claims
Entra preloads all other claims except displayName. The claim name value shown under the Claim name column in Entra populates the respective Field in the Domain Attributes.
After completing the configuration, test a SAML login from Informer and inspect the generated User profile to ensure the correct values for username, email address, first name, last name, and display name.