Microsoft Azure single sign-on with Mercell

Contents
1 Configure single sign-on Azure
1.1 Configure Azure users
1.2 Note to PowerShell on Azure
2 Configure single sign-on Mercell website
3 For the customer's IT-department. Map own users
4 New Users
5 Change History Record

Anchor
_Toc347131863 _Toc347131863

Anchor
_Toc528928955 _Toc528928955

Configure single sign-on Azure

1. To configure single sign-on for with Azure, you need to have an Azure AD subscription and a Mercell SSO product.
2. In the Azure portal, on the left navigation panel, click Azure Active Directory icon.

Image Added

1. Navigate to Enterprise applications. Then go to All applications. Image Added
2. To add new application, click New application button on the top of dialog.

Image Added

1. In the search box, type Mercell, select Mercell from result panel then click Add button to add the application.

Image Added

1. In the Azure portal, on the Mercell application integration page, click Single sign-on.

Image Added

1. On the Single sign-on dialog, select Mode as SAML-based Sign-on to enable single sign-on. Image Added
2. On the Mercell Domain and URLs section, perform the following steps:

Image Added
In the Identifier textbox, type the URL: https://my.mercell.com

1. On the SAML Signing Certificate section, click the copy button to copy App Federation Metadata URL and paste it into notepad.

Image Added

1. Click Save button.

Image Added

Anchor
_Toc528928956 _Toc528928956

Configure Azure users

1. Select Mercell application from Azure and select Users and groups. 

Image Added

1. Click Add button. Then select Users and groups on Add Assignment dialog.

Image Added

1. On Users and groups dialog, select wanted user in the Users list.
2. Click Select button on Users and groups dialog.
3. Click Assign button on Add Assignment dialog.

Guide from Microsoft https://docs.microsoft.com/da-dk/azure/active-directory/saas-apps/media/mercell-tutorial/tutorial_general_203.png

Anchor
_Toc528928957 _Toc528928957

Note to PowerShell on Azure

If you need to extract AD user information, you can do it with PowerShell. Methods can be found on Microsoft Azure documentation.
https://docs.microsoft.com/en-us/powershell/module/azuread/get-azureaduser?view=azureadps-2.0

Anchor
_Toc528928958 _Toc528928958

Configure single sign-on Mercell website

1. Login to Mercell website as customer admin
2. Click on company name
3. Click on Single sign-on icon

Image Added

1. Click add new
2. Type name, use company and set domain to company domain and save

3. Anchor
   _Hlk517681041 _Hlk517681041

   Anchor
   _Hlk517679511 _Hlk517679511

   If you have several email domains that should be linked with different customers in Mercell, set "Email domain" to users' primary mail (SMTP) and check "Match e-mail to domain". This will enable the option to have a shared SSO connection that directs users from a shared AD to several customers in Mercell.

Image Added

1. Click Update to insert SAML Entity ID URL from Azure. Insert value (See section 1. number 9) and press "Update".

Image Added

1. The result should look something like this Image Added
2. Click save
3. Your SSO setup is now completed. (SSO enforcement is optional, but recommended) Image Added
4. SSO - The SSO Enforcement consequence

SSO Enforcement notice!
Please secure that all your user has been informed of the «SSO-Only» switchover, or they will see the screen below when they try to login manually without any success. (That is why it should be a planned date for going into production for all.)The same alert also happens, if you remove them from your local MS ADFS server.
Image Added

1. SSO: How to login?

If you usually use your corporate intranet for SSO login, then do as before.If you use an URL from Mercell, or connect directly to https://my.mercell.com, then you only need to click on the button called: «SSO login».
Image Added
You will then have to enter your e-mail address as used in your company and click «Login». You will then be redirected to your own local SSO server, for a password. "Remember me" checkbox can be used to ensure that when accessing Mercell.com user is redirected directly to your own local SSO server. If login fails at local SSO server, user can access this page again and make changes.
Image Added
After you entered your password inside your local corporate SSO server, then you will be redirected back to Mercell again, but you are now automatically logged into our portal.
You arrive either at your usual starting homepage, or at the specific Mercell URL you originally clicked on the first time.

Anchor
_Toc499708350 _Toc499708350

Anchor
_Toc528928959 _Toc528928959

For the customer's IT-department. Map own users

Script for extracting user's that need to be mapped to Mercell.Script:
get-aduser -filter * | ft Name,UserPrincipalName > c:\test\test.txt (or preferably a CSV-file)
The result should look like this
Rabattavtale NO       rabattavtale@mercell.com            
IUSR_web1               IUSR_web1@mercell.com               
PdfADev                pdfadev@mercell.com                     
Test VPN               tv@mercell.com   
This script is used to do an AD BIND, which ensures that your existing users inside our portal are not asked to register as new users in our portal, when they start using the SSO. You can import this as Customer administrator by first "Export users". This will export an Excel file where only "User ID" is editable.

Image Added

Image Added

Anchor
_Toc528928960 _Toc528928960

Anchor
_Hlk508704872 _Hlk508704872

New Users

When an unknown user (in the Mercell portal) logs in using SSO there are 3 possible settings. This setting applies for all users that are accessing through this connection as unknown users.
Image Added

1. Default action is to create a new contact. User will be created and will now be able to be found on customer contacts. Note user does not have an order so uncheck "Only users on order" and user can be found on the contacts list.

Image Added

1. Second option is to decline unknown (in Mercell portal) users. If you want to add users, an administrator can create the user manually and map them manually as described in section 4.

1. Third option is to let unknown (in Mercell portal) users in as semi anonymous users (this is an alternative to IP restricted access). This allows these users to see agreements that are marked with: Show to intern IP/SSO restricted users.

One of the above options must be chosen and will apply for all unknown users.

Anchor
_Toc528928961 _Toc528928961

Change History Record