Litmos Training Operations: SAML 2.0 Setup with Microsoft Azure
How to configure LTO with Azure AD uisng SAML 2.0
https://go.microsoft.com/fwLink/?LinkID=717349#configuring-and-testing-azure-ad-single-sign-on
LTO Domain and URLs
Identifier (Entity ID):
(This value must be unique across all applications in your (Azure Active Directory) tenant. It should follow one of the patterns provided below the textbox.)
https://sso.viewcentral.com/ServiceProvider
Reply URL:
(The reply URL is where the application expects to receive the authentication token. This is also referred to as the “Assertion Consumer Service” (ACS) in SAML. It should follow one of the patterns provided below the textbox.)
https://sso.viewcentral.com/serviceprovider/Attendee.asmx/ReceiveAuthResponse?cid=&pid=1
SAML TOKEN ATTRIBUTES
- FirstName : user.givenname
- LastName: user.surname
- Email: user.mail
- Required Base 64 ASCII certificate with .cer extension
- Download and edit the certificate in notepad and ensure the below format.
From the Azure please click on the LTO configuration to get access to Login and Logout URL
Changes needs to be done at LTO
For users to be able to sign in using their organization account, LTO must be manually configured to use your Azure Active Directory as a SAML identity provider. LTO cannot prompt or otherwise allow users to sign in using Azure Active Directory if it has not been configured to do so.
To configure LTO for single sign-on:
- Review the process for configuring SAML identity providers in LTO. To determine the correct process, view the documentation for LTO or contact your LTO representative for more information.
- Note: Some guidance on how to configure LTO can be found on Azure.com, and we are in the process of migrating the application-specific steps to this guide. The older article on how to configure LTO can be found here, where only the steps related to uploading the Azure AD files and URLs to LTO need to be followed.
- During this process, you will be prompted to provide files and URLs that correspond to Azure Active Directory. When prompted, use the files and URLs shown below:
- SAML Single Sign-On Service URL: https://login.microsoftonline.com/cefa654e-f29e-4fb1-987a-9e714cb849e4/saml2
- SAML Entity ID: https://sts.windows.net/cefa654e-f29e-4fb1-987a-9e714cb849e4/
- Sign-Out URL: https://login.microsoftonline.com/common/wsfederation?wa=wsignout1.0
- SAML Signing Certificate – Base64 encoded
- SAML Signing Certificate – Raw
- SAML XML Metadata
- Once this information has been provided and configured in LTO, LTO will begin to require or otherwise allow users to sign in using your instance of Azure Active Directory.
Next steps
To ensure users can sign-in to LTO after it has been configured to use Azure Active Directory, review the following tasks and topics:
- User accounts must be pre-provisioned into LTO prior to sign-in. To set this up, see Provisioning.
- Users must be assigned access to LTO in Azure AD to sign-in. To assign users, see Users.
- To configure access polices for LTO users, see Access Policies.
SAML Single Sign-On Service URL: https://login.microsoftonline.com/cefa654e-f29e-4fb1-987a-9e714cb849e4/saml2
SignOut URL: https://login.microsoftonline.com/common/wsfederation?wa=wsignout1.0