Skip to content

Commit 14b8055

Browse files
v-albemiv-albemi
authored
Merge pull request #105587 from v-hagamp/signalfx
Product Backlog Item 930641: SignalFx Update
2 parents ee53e21 + cb20cfa commit 14b8055

File tree

1 file changed

+86
-98
lines changed

1 file changed

+86
-98
lines changed

‎articles/active-directory/saas-apps/signalfx-tutorial.md

Lines changed: 86 additions & 98 deletions
Original file line numberDiff line numberDiff line change
@@ -12,87 +12,86 @@ ms.service: active-directory
1212
ms.subservice: saas-app-tutorial
1313
ms.workload: identity
1414
ms.tgt_pltfrm: na
15-
ms.devlang: na
1615
ms.topic: tutorial
17-
ms.date: 12/10/2019
16+
ms.date: 02/24/2020
1817
ms.author: jeedes
1918

2019
ms.collection: M365-identity-device-management
2120
---
2221

2322
# Tutorial: Azure Active Directory single sign-on (SSO) integration with SignalFx
2423

25-
In this tutorial, you'll learn how to integrate SignalFx with Azure Active Directory (Azure AD). When you integrate SignalFx with Azure AD, you can:
24+
In this tutorial, you will learn how to integrate SignalFx with Azure Active Directory (Azure AD). When you integrate SignalFx with Azure AD, you can:
2625

27-
* Control in Azure AD who has access to SignalFx.
28-
* Enable your users to be automatically signed-in to SignalFx with their Azure AD accounts.
29-
* Manage your accounts in one central location - the Azure portal.
26+
* Control from Azure AD who has access to SignalFx;
27+
* Enable your users to be automatically signed-in to SignalFx with their Azure AD accounts; and
28+
* Manage your accounts in one location (the Azure portal).
3029

31-
To learn more about SaaS app integration with Azure AD, see [What is application access and single sign-on with Azure Active Directory](https://docs.microsoft.com/azure/active-directory/active-directory-appssoaccess-whatis).
30+
To learn more about SaaS application integration with Azure AD, see [What is application access and single sign-on with Azure Active Directory](https://docs.microsoft.com/azure/active-directory/what-is-single-sign-on).
3231

3332
## Prerequisites
3433

35-
To get started, you need the following items:
34+
Before you begin, you will need:
3635

37-
* An Azure AD subscription. If you don't have a subscription, you can get a [free account](https://azure.microsoft.com/free/).
38-
* SignalFx single sign-on (SSO) enabled subscription.
36+
* An Azure AD subscription
37+
* If you do not have a subscription, you can obtain a [free account here](https://azure.microsoft.com/free/).
38+
* SignalFx single sign-on (SSO) enabled subscription
3939

4040
## Scenario description
4141

42-
In this tutorial, you configure and test Azure AD SSO in a test environment.
42+
In this tutorial, you will configure and test Azure AD SSO in a test environment.
4343

4444
* SignalFx supports **IDP** initiated SSO
4545
* SignalFx supports **Just In Time** user provisioning
46+
* Once you configure SignalFx you can enforce session control, which protects exfiltration and infiltration of your organization’s sensitive data in real time. Session control extends from Conditional Access. [Learn how to enforce session control with Microsoft Cloud App Security](https://docs.microsoft.com/cloud-app-security/proxy-deployment-any-app).
4647

47-
## Adding SignalFx from the gallery
48+
## Step 1: Add the SignalFx application in Azure
4849

49-
To configure the integration of SignalFx into Azure AD, you need to add SignalFx from the gallery to your list of managed SaaS apps.
50+
Use these instructions to add the SignalFx application to your list of managed SaaS apps.
5051

51-
1. Sign in to the [Azure portal](https://portal.azure.com) using either a work or school account, or a personal Microsoft account.
52-
1. On the left navigation pane, select the **Azure Active Directory** service.
53-
1. Navigate to **Enterprise Applications** and then select **All Applications**.
54-
1. To add new application, select **New application**.
55-
1. In the **Add from the gallery** section, type **SignalFx** in the search box.
56-
1. Select **SignalFx** from results panel and then add the app. Wait a few seconds while the app is added to your tenant.
52+
1. Log into the [Azure portal](https://portal.azure.com).
53+
1. On the left-side navigation window, select **Azure Active Directory**.
54+
1. Select **Enterprise applications**, and then select **All applications**.
55+
1. Select **New application**.
56+
1. In the **Add from the gallery** section, in the search box, enter and select **SignalFx**.
57+
* You may need to wait a few minutes for the application to be added to your tenant.
58+
1. Leave the Azure portal open, and then open a new web tab.
5759

58-
## Configure and test Azure AD single sign-on for SignalFx
60+
## Step 2: Begin SignalFx SSO configuration
5961

60-
Configure and test Azure AD SSO with SignalFx using a test user called **B.Simon**. For SSO to work, you need to establish a link relationship between an Azure AD user and the related user in SignalFx.
62+
Use these instructions to begin the configuration process for the SignalFx SSO.
6163

62-
To configure and test Azure AD SSO with SignalFx, complete the following building blocks:
64+
1. In the newly opened tab, access and log into the SignalFx UI.
65+
1. In the top menu, click **Integrations**.
66+
1. In the search field, enter and select **Azure Active Directory**.
67+
1. Click **Create New Integration**.
68+
1. In **Name**, enter an easily recognizable name that your users will understand.
69+
1. Mark **Show on login page**.
70+
* This feature will display a customized button in the login page that your users can click on.
71+
* The information you entered in **Name** will appear on the button. As a result, enter a **Name** that your users will recognize.
72+
* This option will only function if you use a custom subdomain for the SignalFx application, such as **yourcompanyname.signalfx.com**. To obtain a custom subdomain, contact SignalFx support.
73+
1. Copy the **Integration ID**. You will need this information in a later step.
74+
1. Leave the SignalFx UI open.
6375

64-
1. **[Configure Azure AD SSO](#configure-azure-ad-sso)** - to enable your users to use this feature.
65-
* **[Create an Azure AD test user](#create-an-azure-ad-test-user)** - to test Azure AD single sign-on with B.Simon.
66-
* **[Assign the Azure AD test user](#assign-the-azure-ad-test-user)** - to enable B.Simon to use Azure AD single sign-on.
67-
1. **[Configure SignalFx SSO](#configure-signalfx-sso)** - to configure the single sign-on settings on application side.
68-
* **[Create SignalFx test user](#create-signalfx-test-user)** - to have a counterpart of B.Simon in SignalFx that is linked to the Azure AD representation of user.
69-
1. **[Test SSO](#test-sso)** - to verify whether the configuration works.
76+
## Step 3: Configure Azure AD SSO
7077

71-
## Configure Azure AD SSO
78+
Use these instructions to enable Azure AD SSO in the Azure portal.
7279

73-
Follow these steps to enable Azure AD SSO in the Azure portal.
74-
75-
1. In the [Azure portal](https://portal.azure.com/), on the **SignalFx** application integration page, find the **Manage** section and select **single sign-on**.
80+
1. Return to the [Azure portal](https://portal.azure.com/), and on the **SignalFx** application integration page, locate the **Manage** section, and then select **Single sign-on**.
7681
1. On the **Select a single sign-on method** page, select **SAML**.
77-
1. On the **Set up single sign-on with SAML** page, click the edit/pen icon for **Basic SAML Configuration** to edit the settings.
82+
1. On the **Set up single sign-on with SAML** page, click the pen (edit) icon for **Basic SAML Configuration** to edit the settings.
7883

7984
![Edit Basic SAML Configuration](common/edit-urls.png)
8085

81-
1. On the **Set up single sign-on with SAML** page, enter the values for the following fields:
82-
83-
a. In the **Identifier** text box, type a URL: `https://api.signalfx.com/v1/saml/metadata`
84-
85-
b. In the **Reply URL** text box, type a URL using the following pattern:
86-
`https://api.signalfx.com/v1/saml/acs/<integration ID>`
86+
1. On the **Set up single sign-on with SAML** page, complete the following fields:
8787

88-
> [!NOTE]
89-
> The preceding value is not real value. You update the value with the actual Reply URL, which is explained later in the tutorial.
88+
a. In **Identifier**, enter the following URL `https://api.<realm>.signalfx.com/v1/saml/metadata` and replace `<realm>` with your SignalFx realm.
9089

91-
1. SignalFx application expects the SAML assertions in a specific format, which requires you to add custom attribute mappings to your SAML token attributes configuration. The following screenshot shows the list of default attributes.
90+
b. In **Reply URL**, enter the following URL `https://api.<realm>.signalfx.com/v1/saml/acs/<integration ID>` and replace `<realm>` with your SignalFx realm, as well as `<integration ID>` with the **Integration ID** you copied earlier from the SignalFx UI.
9291

93-
![image](common/default-attributes.png)
94-
95-
1. In addition to above, SignalFx application expects few more attributes to be passed back in SAML response which are shown below. These attributes are also pre populated but you can review them as per your requirements.
92+
1. SignalFx application expects the SAML assertions in a specific format, which requires you to add custom attribute mappings to your SAML token attributes configuration.
93+
94+
1. Review and verify that the following claims map to the source attributes that are populated in the Active Directory.
9695

9796
| Name | Source Attribute|
9897
| ------------------- | -------------------- |
@@ -101,93 +100,82 @@ Follow these steps to enable Azure AD SSO in the Azure portal.
101100
| PersonImmutableID | user.userprincipalname |
102101
| User.LastName | user.surname |
103102

104-
1. On the **Set up single sign-on with SAML** page, in the **SAML Signing Certificate** section, find **Certificate (Base64)** and select **Download** to download the certificate and save it on your computer.
103+
> [!NOTE]
104+
> This process requires that your Active Directory is configured with at least one verified custom domain, as well as has access to the email accounts in this domain. If you are unsure or need assistance with this configuration, please contact SignalFx support.
105105

106-
![The Certificate download link](common/certificatebase64.png)
106+
1. On the **Set up single sign-on with SAML** page, in the **SAML Signing Certificate** section, find **Certificate (Base64)**, and then select **Download**. Download the certificate, and save it on your computer. Then, copy the **App Federation Metadata Url** value; you will need this information in a later step in the SignalFx UI.
107107

108-
1. On the **Set up SignalFx** section, copy the appropriate URL(s) based on your requirement.
108+
![The Certificate download link](common/certificatebase64.png)
109109

110-
![Copy configuration URLs](common/copy-configuration-urls.png)
110+
1. On the **Set up SignalFx** section, copy the **Azure AD Identifier** value. You will need this information in a later step in the SignalFx UI.
111111

112-
### Create an Azure AD test user
112+
## Step 4: Create an Azure AD test user
113113

114-
In this section, you'll create a test user in the Azure portal called B.Simon.
114+
Use these instructions to create a test user in the Azure portal called **B.Simon**.
115115

116-
1. From the left pane in the Azure portal, select **Azure Active Directory**, select **Users**, and then select **All users**.
117-
1. Select **New user** at the top of the screen.
118-
1. In the **User** properties, follow these steps:
119-
1. In the **Name** field, enter `B.Simon`.
120-
1. In the **User name** field, enter the [email protected]. For example, `B.Simon@contoso.com`.
121-
1. Select the **Show password** check box, and then write down the value that's displayed in the **Password** box.
116+
1. In the Azure portal, in the left-side navigation window, select **Azure Active Directory**, then select **Users**, and then select **All users**.
117+
1. At the top of the page, select **New user**.
118+
1. In the **User** properties:
119+
1. In **User name**, enter `[email protected]`, such as `[email protected]`.
120+
1. In **Name**, enter `B.Simon`.
121+
1. Mark **Show password**, and then copy the displayed value in **Password**. You will need this information in later step in order to test this integration.
122122
1. Click **Create**.
123123

124-
### Assign the Azure AD test user
124+
## Step 5: Assign the Azure AD test user
125125

126-
In this section, you'll enable B.Simon to use Azure single sign-on by granting access to SignalFx.
126+
Use these instructions to enable the test user to use Azure single sign-on for SignalFx.
127127

128-
1. In the Azure portal, select **Enterprise Applications**, and then select **All applications**.
128+
1. In the Azure portal, select **Enterprise applications**, and then select **All applications**.
129129
1. In the applications list, select **SignalFx**.
130-
1. In the app's overview page, find the **Manage** section and select **Users and groups**.
130+
1. In the app's overview page, find the **Manage** section, and then select **Users and groups**.
131131

132132
![The "Users and groups" link](common/users-groups-blade.png)
133133

134-
1. Select **Add user**, then select **Users and groups** in the **Add Assignment** dialog.
134+
1. Select **Add user**, and then in the **Add Assignment** dialog box, select **Users and groups**.
135135

136136
![The Add User link](common/add-assign-user.png)
137137

138-
1. In the **Users and groups** dialog, select **B.Simon** from the Users list, then click the **Select** button at the bottom of the screen.
139-
1. If you're expecting any role value in the SAML assertion, in the **Select Role** dialog, select the appropriate role for the user from the list and then click the **Select** button at the bottom of the screen.
140-
1. In the **Add Assignment** dialog, click the **Assign** button.
141-
142-
## Configure SignalFx SSO
143-
144-
1. Sign in to your SignalFx company site as administrator.
145-
146-
1. In SignalFx, on the top click **Integrations** to open the Integrations page.
138+
1. In the **Users and groups** dialog box, from the **Users** list, select **B.Simon**, and then at the bottom of the page, click **Select**.
139+
1. If you are expecting any role value in the SAML assertion, then in the **Select Role** dialog box, select the appropriate role for the user from the list, and then click **Select** at the bottom of the page.
140+
1. In the **Add Assignment** dialog box, click the **Assign**.
147141

148-
![SignalFx Integration](./media/signalfx-tutorial/tutorial_signalfx_intg.png)
142+
## Step 6: Complete the SignalFx SSO configuration
149143

150-
1. Click on **Azure Active Directory** tile under **Login Services** section.
144+
1. Open the previous tab, and return to the SignalFx UI to view the current Azure Active Directory integration page.
145+
1. Next to **Certificate (Base64)**, click **Upload File**, and then locate the **Base64 encoded certificate** file that you previously downloaded from Azure portal.
146+
1. Next to **Azure AD Identifier**, paste the **Azure AD Identifier** value that you copied earlier from the Azure portal.
147+
1. Next to **Federation Metadata URL**, paste the **App Federation Metadata Url** value that you copied earlier from the Azure portal.
148+
1. Click **Save**.
151149

152-
![SignalFx saml](./media/signalfx-tutorial/tutorial_signalfx_saml.png)
150+
## Step 7: Test SSO
153151

154-
1. Click on **NEW INTEGRATION** and under the **INSTALL** tab perform the following steps:
152+
Review the following information regarding how to test SSO, as well as expectations for logging into SignalFx for the first time.
155153

156-
![SignalFx samlintgpage](./media/signalfx-tutorial/tutorial_signalfx_azure.png)
154+
### Test logins
157155

158-
a. In the **Name** textbox type, a new integration name, like **OurOrgName SAML SSO**.
156+
* To test the login, you should use a private / incognito window, or you can log out of the Azure portal. If not, cookies for the user who configured the application will interfere and prevent a successful login with the test user.
159157

160-
b. Copy the **Integration ID** value and append to the **Reply URL** in the place of `<integration ID>` in the **Reply URL** textbox of **Basic SAML Configuration** section in Azure portal.
158+
* When a new test user logs in for the first time, Azure will force a password change. When this occurs, the SSO login process will not be completed; the test user will be directed to the Azure portal. To troubleshoot, the test user should change their password, and navigate to the SignalFx login page or to the Access Panel and try again.
159+
* When you click the SignalFx tile in the Access Panel, you should be automatically logged into the SignalFx.
160+
* For more information about the Access Panel, see [Introduction to the Access Panel](https://docs.microsoft.com/azure/active-directory/active-directory-saas-access-panel-introduction).
161161

162-
c. Click on **Upload File** to upload the **Base64 encoded certificate** downloaded from Azure portal in the **Certificate** textbox.
162+
* SignalFx application can be accessed from the Access Panel or via a custom login page assigned to the organization. The test user should test the integration starting from either of these location.
163+
* The test user can use the credentials created earlier in this process for **[email protected]**.
163164

164-
d. In the **Issuer URL** textbox, paste the value of **Azure AD Identifier**, which you have copied from the Azure portal.
165+
### First-time logins
165166

166-
e. In the **Metadata URL** textbox, paste the **Login URL** which you have copied from the Azure portal.
167+
* When a user logs into SignalFx from the SAML SSO for the first time, the user will receive a SignalFx email with a link. The user must click the link for authentication purposes. This email validation will only take place for first-time users.
167168

168-
f. Click **Save**.
169-
170-
### Create SignalFx test user
171-
172-
The objective of this section is to create a user called Britta Simon in SignalFx. SignalFx supports just-in-time provisioning, which is by default enabled. There is no action item for you in this section. A new user is created during an attempt to access SignalFx if it doesn't exist yet.
173-
174-
When a user signs in to SignalFx from the SAML SSO for the first time, [SignalFx support team](mailto:[email protected]) sends them an email containing a link that they must click through to authenticate. This will only happen the first time the user signs in; subsequent login attempts will not require email validation.
175-
176-
> [!Note]
177-
> If you need to create a user manually, contact [SignalFx support team](mailto:[email protected])
178-
179-
## Test SSO
180-
181-
In this section, you test your Azure AD single sign-on configuration using the Access Panel.
182-
183-
When you click the SignalFx tile in the Access Panel, you should be automatically signed in to the SignalFx for which you set up SSO. For more information about the Access Panel, see [Introduction to the Access Panel](https://docs.microsoft.com/azure/active-directory/active-directory-saas-access-panel-introduction).
169+
* SignalFx supports **Just In Time** user creation, which means that if a user does not exist in SignalFx, then the user's account will be created upon first login attempt.
184170

185171
## Additional resources
186172

187173
- [ List of Tutorials on How to Integrate SaaS Apps with Azure Active Directory ](https://docs.microsoft.com/azure/active-directory/active-directory-saas-tutorial-list)
188174

189-
- [What is application access and single sign-on with Azure Active Directory? ](https://docs.microsoft.com/azure/active-directory/active-directory-appssoaccess-whatis)
175+
- [What is application access and single sign-on with Azure Active Directory? ](https://docs.microsoft.com/azure/active-directory/what-is-single-sign-on)
190176

191177
- [What is conditional access in Azure Active Directory?](https://docs.microsoft.com/azure/active-directory/conditional-access/overview)
192178

179+
- [What is session control in Microsoft Cloud App Security?](https://docs.microsoft.com/cloud-app-security/proxy-intro-aad)
180+
193181
- [Try SignalFx with Azure AD](https://aad.portal.azure.com/)

0 commit comments

Comments
 (0)