Create a new application in Azure AD

  1. Go to Azure Portal

  2. Enter to your Active Directory managing page

  3. Click on "Enterprise Applications"

  4. Click on "New Application"

  5. Click on "Create your own application"

  6. Give it a name and choose the "Integrate any other application you don't find in the gallery (Non-gallery)" option

Set up SSO

<aside> ℹ️ In this manual <baseURL> should be replaced with your instance URL (the one you use when accessing the application from a web-browser)

</aside>

  1. Go to the application overview page and click on "Single sign-on" in the left menu and than click on "SAML"

  2. Set the following values in the "Basic SAML Configuration":

    1. Identifier (Entity ID): NextPlus
    2. Reply URL: <baseURL>/api/UserModels/replayFromAuthProvider
    3. Logout URL: <baseURL>

  3. Next, create a new User Claim for groups using the Group ID as the source attribute click on the "Add a group claim" button

Configure user provisioning

<aside> ℹ️

If Next Plus is installed on an on-premise server and Azure cannot access it, please refer to How to configure on-premise provisioning for Azure AD

</aside>

  1. Navigate to the Provisioning page and click on the "Get started" button

  2. Set "Provisioning Mode" to "Automatic" and set the following values in the "Admin Credentials" section

    1. Tenant URL: <baseURL>/api/scim

    2. Secret Token: Generated when set up in Next Plus

<aside> ⚠️ Note that the recommended way to assign users to the application is only by assigning them to an assigned group

</aside>

Known Limitation

  1. Due to the nature of SAML, when running a workflow that has a multi-signature step, SAML users will not be able to sign unless they are running the workflow while they are logged in.

Troubleshooting