Microsoft Azure single sign-on with Mercell
Contents
| Table of Contents |
|---|
...
Configure single sign-
...
on Azure
...
To configure single sign-on for with Azure, you need to have an Azure AD subscription and a Mercell SSO product.
In the Azure portal, on the left navigation panel, click Azure Active Directory icon.
...
On the SAML Signing Certificate section, click the copy button to copy App Federation Metadata URL and paste it into notepad.
...
Click Save button.
...
| Anchor | ||||
|---|---|---|---|---|
|
Select Mercell application from Azure and select Users and groups.
...
Guide from Microsoft https://docs.microsoft.com/da-dk/azure/active-directory/saas-apps/media/mercell-tutorial/tutorial_general_203.png
...
...
Note to PowerShell on Azure
If you need to extract AD user information, you can do it with PowerShell. Methods can be found on Microsoft Azure documentation.
https://docs.microsoft.com/en-us/powershell/module/azuread/get-azureaduser?view=azureadps-2.0
...
Configure single sign-on Mercell website
Login to Mercell website as customer admin
Click on company name
Click on Single sign-on icon
...
The result should look something like this
Click save
Your SSO setup is now completed. (SSO enforcement is optional, but recommended)
SSO - The SSO Enforcement consequence
...
If you usually use your corporate intranet for SSO login, then do as before.If you use an URL from Mercell, or connect directly to https://my.mercell.com, then you only need to click on the button called: «SSO login».
You will then have to enter your e-mail address as used in your company and click «Login». You will then be redirected to your own local SSO server, for a password. "Remember me" checkbox can be used to ensure that when accessing Mercell.com user is redirected directly to your own local SSO server. If login fails at local SSO server, user can access this page again and make changes.
After you entered your password inside your local corporate SSO server, then you will be redirected back to Mercell again, but you are now automatically logged into our portal.
You arrive either at your usual starting homepage, or at the specific Mercell URL you originally clicked on the first time.
...
...
For the customer's IT-department. Map own users
Script for extracting user's that need to be mapped to Mercell.Script:
get-aduser -filter * | ft Name,UserPrincipalName > c:\test\test.txt (or preferably a CSV-file)
The result should look like this
Rabattavtale NO rabattavtale@mercell.com
IUSR_web1 IUSR_web1@mercell.com
PdfADev pdfadev@mercell.com
Test VPN tv@mercell.com
This script is used to do an AD BIND, which ensures that your existing users inside our portal are not asked to register as new users in our portal, when they start using the SSO. You can import this as Customer administrator by first "Export users". This will export an Excel file where only "User ID" is editable.
| Anchor | ||||
|---|---|---|---|---|
|
| Anchor | ||||
|---|---|---|---|---|
|
| Anchor | ||||
|---|---|---|---|---|
|
| Anchor | ||||
|---|---|---|---|---|
|
Before starting the implementation, it is advisable to first do a startup meeting with Mercell, as there is some planning involved, and some steps to understand to not get duplicate problems or problems with users.
There is also a large impact on how the processes for creating new users are, both before, during and after the production. The success of the implementation will be determined on good control of the monitoring of this, as well as good communication with all relevant users involved.
...
...
New Users
...
Default action is to create a new contact. User will be created and will now be able to be found on customer contacts. Note user does not have an order so uncheck "Only users on order" and user can be found on the contacts list.
...
Second option is to decline unknown (in Mercell portal) users. If you want to add users, an administrator can create the user manually and map them manually as described in section 4.
Third option is to let unknown (in Mercell portal) users in as semi anonymous users (this is an alternative to IP restricted access). This allows these users to see agreements that are marked with: Show to intern IP/SSO restricted users.
...
Ver.no
...
Date
...
Changed by (Doc.owner)
...
Page
...
Change
...
Status
...
Approved by
...
Approved date
...
V4
...
22.06.2018
...
KE
...
All
...
Updated with option for several customers on one connection, option to map user on contact. Updated screenshots and description for better user understanding.
...
Approved
...
CTO
...
26.06.2018
...
V 4.1
...
02.11.2018
...
KE
...
...
Enhanced sections 2 and 4
...
Approved
...
CTO
...
02.11.2018
...
17.06.2019
...
KE
...
10
...
Added section about semi anon user
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...