Skip to main content

How to: Set up Single Sign-On (Microsoft Azure)

Updated

This guide explains how to set up Single Sign-On (SSO) on the Karat platform using the SAML 2.0-compliant identity provider (IdP) Microsoft Azure. Follow the steps below to configure your IdP, enable SSO in Karat, and manage user provisioning and permissions.

Prerequisites

Before configuring SSO for your organization, ensure the following prerequisites are met:

  • You have an admin user account on the Karat platform.
  • You have access to a SAML 2.0-compliant identity provider IdP available with Karat.

User provisioning and permissions

The Karat platform supports Just-In-Time (JIT) provisioning of users from the IdP. When a new user authenticates with SAML for the first time, an account is automatically created for them. By default, they are assigned the 'Team Member' user type with the standard role access permissions for their group. See How To: Manage Karat Users (RBAC) to learn about user types and role access permissions.

If the user already has an account in Karat, their existing permissions remain unchanged when logging in via SSO.

If a client wants to set a new team member's user type or role access permissions, they can either wait until the new team member has logged in with SSO and their user has been JIT provisioned, or they can create a user account with the desired permissions manually in Karat before adding the user in their IdP.

Warning: Karat does not support Single Logout (SLO) or user deprovisioning via the IdP. Users signed out of the IdP will remain logged into Karat until their session has been idle for 8 hours. If a user is removed from the IdP, they will be unable to log in to Karat if the organization's SAML policy is set to "Required". To fully disable a user, see How To: Manage Karat Users (RBAC) guide.

Karat includes a setting for its 'Organization' called "SAML New User Type." This determines the default user type assigned to new accounts created via SSO. By default, the setting is configured to "Team Member," but it can be adjusted to "Admin," "Limited Team Member," or "External Team Member" based on your preferences.

We recommend utilizing this setting to ensure newly created users do not automatically gain access to sensitive areas of the Karat platform, providing an additional layer of control and security. To modify this setting, contact the Karat support team.

Karat doesn't support System for Cross-domain Identity Management (SCIM).

Note:  If your organization has enabled Single Sign-On (SSO) on the Karat platform using SAML 2.0-compliant identity providers (IdPs), avoid setting up Two-Factor Authentication (2FA). Users authenticated through SSO will not require 2FA.

Setting up SSO

To set up SSO, configure your identity provider (IdP) using the details below. Terminology may vary across IdPs—refer to IdP-specific instructions in this guide for additional help.

Enter the following configuration details into your IdP:

  • ACS URL (replace client-name with your subdomain): https://client-name.karat.io/users/auth/saml/callback
  • Entity ID: Karat
  • Metadata document (replace client-name with your subdomain): https://client-name.karat.io/users/auth/saml/metadata
  • The email attribute is required. 
  • Additionally, you must provide either full_name or both first_name and last_name. If full_name is provided, it will take precedence. Some IdPs only support first_name and last_name.
  • Attribute mappings:

<md:RequestedAttribute FriendlyName="Email address" Name="email" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"/>

<md:RequestedAttribute FriendlyName="Full name" Name="name" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"/>

<md:RequestedAttribute FriendlyName="Given name" Name="first_name" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"/>

<md:RequestedAttribute FriendlyName="Family name" Name="last_name" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"/>

After the identity provider is set up, email the following details to a Karat internal user to enter into Central, Karat's platform:

  • IdP URL
  • IdP certificate in PEM format

Create a New App

  1. Log in to the Azure portal.
  2. In the left-hand menu, click Azure Active Directory.
  3. Click Enterprise applications.

  1. Click + New application.

  1. Click Non-gallery application.

  1. Give the new application a name.
  2. Click Add at the bottom of the screen. This will add a custom application to your Azure Active Directory.

  1. Once the application loads, click Users and groups in the left-hand menu. 
  2. Click + Add user to assign users or user groups to this application.

  1. Click Single sign-on in the left-hand menu.
  2. Click SAML.

Configure SAML

  1. In the setup screen, click the pencil icon in the Basic SAML Configuration box.

  1. Enter the following URLs in the fields provided, replacing subdomain with your subdomain:
    • Identifier (Entity ID): Karat
    • Reply URL (Assertion Consumer Service URL):  https://client-name.karat.io/users/auth/saml/callback
    • Sign on URL 
    • Relay State - Skip. This is an optional parameter used to tell the application where to redirect the user after authentication is completed.
    • Logout URL 

  1. Make sure to fill in your subdomain where it says subdomain. Note that there's no trailing slash at the end of the URL. 
  2. Click Save at the top of the form when finished.

User Attributes & Claims

  1. Return to the setup screen.
  2. Click the pencil icon on the User Attributes & Claims box.

  1. Click Unique User Identifier (Name ID). 

  1. Enter a name and select user.mail in the Source attribute drop-down menu.
  2. Click Save at the top of the form.

SAML Signing Certificate

  1. Return to the setup screen.
  2. Click the pencil icon in the SAML Signing Certificate box.

  1. Enter a notification email for the certificate expiry reminders.
  2. Click Save at the top of the form.

  1. Back in the setup screen, click to download the Certificate (Base64) to save the certificate file on your computer and copy the Thumbprint.

Setup Karat SSO

  1. Return to the setup screen.
  2. Click the View step-by-step instructions link in the Setup <Karat> box.

  1. Review the documentation that will guide you through filling out the:
    • Login URL ( SAML Single Sign-On Service URL)
    • Azure AD Identifier (SAML Entity ID), and
    • Logout URL (Sign-out URL) fields.

Test Single Sign-on with <Karat>

  1. Return to the setup screen.
  2. Click Test in the Test Single Sign-on with <Karat> box to check if single sign-on is working.

Was this article helpful?

0 out of 0 found this helpful
Return to top