Azure Active Directory configuration: How to configure Kiuwan as a Service Provider – Kiuwan

Note: The downloaded XML file needs to be imported into your Kiuwan account, as shown before. After importing AAD metadata into Kiuwan, your Kiuwan account will be ready to generate its metadata that you will import into AAD.

You must configure your IDP (Azure AD) so it recognizes Kiuwan as an SP (Service Provider).

In Azure AD, create an Enterprise Application (Kiuwan SSO, in this example).

Select Azure Active Directory >> Enterprise applications
Click on New application.
Select the Non-gallery application and fill in the app name (Kiuwan SSO in our example) and click Add.
When created, you will see a page similar to the following:
Next, add users that will be allowed to log in to the Kiuwan SSO application.
Select the users from your Azure Active Directory that will be allowed to log in to the Kiuwan SSO application.
Now that one or more users have been added, configure the Single sign-on.
Export the Azure Active Directory metadata and import it to Kiuwan.
To export AAD metadata, click on the Download link at Federation Metadata XML.

Note: The downloaded XML file needs to be imported into your Kiuwan account, as shown before.
After importing AAD metadata into Kiuwan, your Kiuwan account will be ready to generate its metadata that you will import into AAD.

1. To export Kiuwan metadata, go to Account Management > Organization, and you will see the URL to download Kiuwan metadata.

2. Type the URL in a browser and save the content as an XML file.

3. Now, import (upload) the Kiuwan metadata XML file into AAD.

4. Once uploaded, click Save.

5. Once done, click on User Attributes & Claims to set your Claims policy.

6. Select the Name identifier value and set up the policy on how to manage your ADA usernames to Kiuwan usernames.

7. In this example, we take the first part of the email.

For example, an AAD user with email john.doe@domain.com will be mapped to john.doe when sent to Kiuwan.

8. Now, click Test to test Single Sign-On with the Kiuwan SSO app.

9. Select the user (the current one or someone else)

10. Because you are already logged in ADD (and therefore authenticated) you will be forwarded directly to the Kiuwan app.

11. Log in from the Kiuwan site

To log in from the Kiuwan site, you must go to SSO URL (remember to set sso=on and set the domain)

For example https://www.kiuwan.com/saas/web/login.html?sso=on&domain=f0e9c230b1caecc231a6aa636a7400315c6a02fac03a68a01864bc7c5452a5

You will be presented with the login page (without the need to write your credentials)

When you click on the Login button, you will be forwarded to the Azure login page:

Type your credentials (AAD will authenticate you), and (if successful) you will be logged in at Kiuwan site

You need to authenticate even if you are logged in at AAD, because the second authentication has been forced by Kiuwan. Very often, IdPs (AAD, ADFS, etc) send to Kiuwan old auth tokens, making SSO fail.

To prevent these situations, Kiuwan forces IdP to perform the auth process and send Kiuwan a fresh token.

Related to

Login to the Kiuwan site