> ## Knowledge Base Index
> Fetch the complete knowledge base index at: https://help.xap.rocks/sitemap.xml
> Use this file to discover available pages before exploring further.
> Pure-Markdown content can be obtained by appending a '.md' suffix to the content URLs listed in the sitemap (without the trailing slash).

# How To: Setup SSO Configs

### Pre-requisites to configure SSO on AD

To configure SSO, customers need:

* An Azure AD user account. If customer don't already have one, they can [Create an account for free](https://azure.microsoft.com/free/?WT.mc_id=A261C142F).
* One of the following roles: Global Administrator, Cloud Application Administrator, Application Administrator, or owner of the service principal.
* Completion of the steps in [Quickstart: Create and assign a user account](https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/add-application-portal-assign-users).

### Enable single sign-on

To enable SSO for an application:

1. Go to the [Azure Active Directory Admin Centre](https://aad.portal.azure.com/) and sign in using one of the roles listed in the prerequisites.
2. In the left menu, select **Enterprise applications**. The **All applications** pane opens and displays a list of the applications in your Azure AD tenant. 
3. Click on add New Application button and complete the following details.

![](https://storage.crisp.chat/users/helpdesk/website/5dcba586b1ba9400/d5123b5b-a27e-406e-8823-002f0b_nj6os4.png)

![](https://storage.crisp.chat/users/helpdesk/website/5dcba586b1ba9400/0dba89ed-c181-4ec1-8864-a0b5a1_1mul02h.png)

![](https://storage.crisp.chat/users/helpdesk/website/5dcba586b1ba9400/1bca0f00-09d8-4f55-902b-974fef_1tbb0et.png)

4. In the **Manage** section of the left menu, select **Single sign-on** to open the **Single sign-on** pane for editing.
5. Select SAML to open the SSO configuration page. After the application is configured, users can sign in to it by using their credentials from the Azure AD tenant.

![](https://storage.crisp.chat/users/helpdesk/website/5dcba586b1ba9400/de7fbfee-2ca2-4b09-a310-795a9d_1bogd88.png)

![](https://storage.crisp.chat/users/helpdesk/website/5dcba586b1ba9400/5fcabea2-13f3-49d7-9df4-8816a6_1s0z6r3.png)

6. Click on the **Edit** option In the **Basic SAML Configuration** section and record the values of the **Identifier**, **Reply URL**, and **Logout URL**.

![](https://storage.crisp.chat/users/helpdesk/website/5dcba586b1ba9400/204f4589-5cdb-4c3a-8bff-b7f864_xt7hpe.png)

* Best practice when entering the Identifier is to enter it in the format “api://{{application_id}}“ or “spn:{{aplication_name}}“
* For Reply URL (Assertion Consumer Service URL), enter; 

**Production**
XAP - https://id.xap.rocks/External/Callback

**Test**
XAP - https://id.qa.kidsxap.com.au/External/Callback

If you intend to configure Single Log Out it is required to add the following URL as a Reply URL as well.

**Production**
XAP - https://id.xap.rocks/External/LoggedOut

**Test**
XAP - https://id.qa.kidsxap.com.au/External/LoggedOut

![](https://storage.crisp.chat/users/helpdesk/website/5dcba586b1ba9400/9593f85a-fa7e-4a57-a385-7a1a44_b1db93.png)

7. Click on Edit button in **Attributes & Claims** section and obtain the **user.mail** claim name. This value is required when setting up SSO in **Xap.**

![](https://storage.crisp.chat/users/helpdesk/website/5dcba586b1ba9400/07bf8dbf-308e-4ca8-96e0-4ca7a4_1xeqz9w.png)

![](https://storage.crisp.chat/users/helpdesk/website/5dcba586b1ba9400/54cef327-ce66-469b-bcce-ebed2f_14up6yr.png)

8. Obtain the **App Federation Metadata URL** from the **SAML Signing Certificate Section**. This value is required when setting up SSO in **Xap**.

![](https://storage.crisp.chat/users/helpdesk/website/5dcba586b1ba9400/06364ae7-6b74-4932-bcb0-85f957_1j2thr8.png)

9. Obtain the **Logout URL** from the **Set up SSO Test** section. This value is optional when setting up SSO in **Xap**. If not provided, **Single Logout** function will not be available.

![](https://storage.crisp.chat/users/helpdesk/website/5dcba586b1ba9400/e59b3393-06eb-4d58-b8ca-995857_1pfyctk.png)

10. Configure **Users and Groups** for the SSO app.

![](https://storage.crisp.chat/users/helpdesk/website/5dcba586b1ba9400/b4927a5c-b151-458b-9ee4-c87aa9_vwxz5a.png)

### Configure single sign-on in the Xap/SPM portal

When setting up SSO for a specific organisation it is crucial that the SSO settings that we enter for the organisation from System Admin login is accurate. Following details required when setting up SSO; 

* Single Sign-On URL
* WtRealm
* Metadata URL
* ID Claim Type
* Log Out Url (Optional)

###### Single Sign-On URL

* Must be unique across Xap,
* Must be in lower case.
* Must be easy to remember.

For an example:

![](https://storage.crisp.chat/users/helpdesk/website/5dcba586b1ba9400/a9051f58-b389-499d-a702-81b11c_1tmmedp.png)

### WtRealm

* Provided by the customer. 
* If SSO is from Azure Directory, following formats are currently known. 
* spn:{{application_name}}, for an example spn:XapSSO
* api://{{application_id}}, for an example api://a6c78da4-bf5c-4569-90fa-e0918d1e27cc

* Once the SSO application is created with the steps mentioned above, access the app overview page,

![](https://storage.crisp.chat/users/helpdesk/website/5dcba586b1ba9400/f3be5cec-66f2-435d-b999-2cd33a_u6pawd.png)

### Metadata URL 
* **App Federation Metadata URL** provided by the customer. 

### ID Claim Type
* Claim name of **user.mail** attribute provided by the customer. 

### Logout URL
* Optional, if not provided single logout function will not be available.
* Provided by the customer.