MindManager Deployment Help Help | Set up Microsoft Azure SSO

Set up Microsoft Azure SSO

To create and configure the enterprise application (OpenID)

To create and configure the enterprise application (SAML)

To submit setup details using the MindManager Customer Admin Portal

You can use OpenID or SAML to set up Microsoft Azure SSO. You must create and configure the enterprise application. Then, you must submit your setup details in the MindManager Customer Admin Portal.

To create and configure the enterprise application (OpenID)

1 Go to the Azure Active portal.

2 Click Azure Active Directory.

3 In the Manage area of the Azure Active Directory Admin center, click App registrations.

4 Click New registration.

5 On the Register an application page, type the name that the user will see for this application in the Name box.

6 In the Supported account types area, enable the Accounts in this organizational directory only option.

7 In the Redirect URI box, enter the redirect URI, which you access by clicking:

https://cloud.mindmanager.com/api/v1/current-userpool-domains

There will be 2 different URIs displayed at the top of the page.

Copy the first URI from the current user pool page, and paste it in the Redirect URI box.

Then type https:// at the beginning of the URL.

For example, if the current user pool page shows user-pool/oauth2/idpresponse, change it to https://user-pool/oauth2/idpresponse after you paste it into the Redirect URI box.

8 Click Register.

9 In the Manage area, click Authentication.

10 In the Platform Configurations area, you must enter the second redirect URI, which you access by clicking:

https://cloud.mindmanager.com/api/v1/current-userpool-domains

There will be 2 different URIs displayed at the top of the page.

Copy the second URI from the current user pool page.

In the Web section, click Add URI and paste it in the Redirect URI box.

Then type https:// at the beginning of the URL.

For example, if the current user pool page shows user-pool/oauth2/idpresponse, change it to https://user-pool/oauth2/idpresponse after you paste it into the Redirect URI box.

11 In the Platform Configurations area, click Save.

12 In the Manage area, click Certificates & secrets.

13 On the Certificates & secrets page, click New client secret.

14 In the Add a client secret window, type a descriptive name for the secret (optional) and select an expiry option.

Note: Due to requirements of the Microsoft Azure system, the SSO connection with MindManager requires a secret token that has an expiration date. MindManager requires choosing an expiration date of 24 months or greater to minimize the frequency of updating your secret token with our team.

If your secret token expires before you provide a new one to the MindManager team, your users and Admins won’t be able to access the MindManager Customer Admin Portal or MindManager products.

To avoid this scenario, your organization must do the following:

1) Add a new client secret token to the existing app in Microsoft Azure that you are using for MindManager SSO.

2) Submit the new secret token through the SSO setup process in the MindManager Customer Admin Portal at least 4 weeks prior to the expiration date of your previous secret token to allow time for our team to update without service interruption.

15 Click Add.

16 In the Client secrets area, click the Copy to clipboard button

in the Value column corresponding to the secret that you created.

Paste this information in a text file, which you’ll provide in the MindManager Customer Admin Portal SSO setup form.

17 In the Manage area, click API permissions.

18 On the API permissions page, click Add a permission.

19 In the Request API permissions pane, click Microsoft Graph.

20 Click Delegated permissions.

21 In the Openid permissions area, enable the email, offline_access, openid, and profile check boxes.

email, offline_access, openid are the minimum permissions required for SSO to work with MindManager.

22 Click Add permissions.

23 On the API permissions page, click Grant admin consent.

24 Click Yes to confirm.

The OpenID Connect configuration is complete.

Now, you must submit the setup details. For more information, see To submit setup details using the MindManager Customer Admin Portal.

To create and configure the enterprise application (SAML)

1 Go to the Azure Active portal.

2 Click Azure Active Directory.

3 In the Manage area of the Azure Active Directory Admin center, click Enterprise applications.

4 Click New Application, then click Create your own application.

5 In the Create your own application pane, type a name for the app (for example, MindManager SSO).

6 Choose Integrate any other application you don't find in the gallery (Non-gallery).

7 Click Create.

8 In the Manage area, click Single sign-on, then click SAML.

9 In the Basic SAML Configuration area, click Edit.

10 Copy and paste the following Identifier (Entity ID) into the field:

urn:amazon:cognito:sp:eu-central-1_Yl6Ea8Vvt

11 In the Reply URL (Assertion Consumer Service URL) area, you must enter two reply URLs, which you access by clicking:

• https://cloud.mindmanager.com/api/v1/current-userpool-domains

There will be 2 different URLs displayed at the top of the page.

Copy the first URI from the current user pool page.

In the Reply URL section, paste the first URL into the in the first field.

Then type https:// at the beginning of the URL, and change the text oauth2 to saml2.

For example, if the current user pool page displays user-pool/oauth2/idpresponse, change it to https://user-pool/saml2/idpresponse

Copy the second URI from the current user pool page.

In the Reply URL section, paste the second URL into the in the second field.

Then type https:// at the beginning of the URL, and change the text oauth2 to saml2.

12 Click Save.

Note: Entity ID and URI shown are examples only. Ensure that you’re using the entity ID from step 10 get the latest URIs from the current user pool page. If you are updating an older MindManager SSO setup, use the entity ID from your current configuration.

13 In the Attributes & Claims area, click Edit.

14 Then click Add New Claim.

15 Enter the following information:

• Name — Email

• Namespace — http://schemas.xmlsoap.org/ws/2005/05/identity/claims

• Source — Attribute

• Source attribute — Use the field that includes your member email address

16 In the SAML Signing Certificate area, click the Copy to clipboard button

in the App Federation Metadata Url field.

Paste this information in a text file, which you’ll provide in the MindManager Customer Admin Portal SSO setup form.

The SAML configuration is complete. Now, you must submit the setup details. For more information, see To submit setup details using the MindManager Customer Admin Portal.

To submit setup details using the MindManager Customer Admin Portal

1 Sign in to your MindManager Customer Admin Portal.

2 Click Setup SSO.

3 On the Setup SSO page, select one of the following from the Choose Your Single Sign-on Provider drop-down menu.

• Microsoft Azure AD (OpenID)

• Microsoft Azure AD (SAML)

4 On the Setup SSO page, input the list of domains that you want to be redirected to use your organization’s Active Directory to sign in. This usually is the company domain, and you can include additional domains that fall under the same active directory. For example, Corel’s is corel.com, as well as mindmanager.com. Anyone with @corel.com or @mindmanager.com email address will be redirected to Corel’s Azure AD for sign-in.

5 In the Input Required Information, fill in the following fields:

• In OpenID configurations, input:

• ClientID — found on the Overview page in Microsoft Azure

• Client Secret — value found on the Certificates & secrets page in the Value column in Microsoft Azure, the information copied in step 19 of To create and configure the enterprise application (OpenID).

• Directory (Tenant) ID — found on the Overview page in Microsoft Azure

• In SAML configurations, input:

• App Federation Metadata Url — data copied in step 16 of To create and configure the enterprise application (SAML).

6 Click Submit.

You will receive an email confirmation from noreply@mindmanager.com that we have successfully received your setup request has been successfully submitted. Check your spam or junkmail folders if you haven’t received the confirmation eamil.

There are three more stages before the setup is complete:

• Domain Verification — for more information, see Domain verification.

• Security Review — usually takes 3 to 5 business days.

• Ready for Testing — once your submission is reviewed and approved, you will get another email notification that your setup is ready for testing. The status in the MindManager Customer Admin Portal is displayed as Ready for Testing. Follow the instructions in the MindManager Customer Admin Portal to test your setup. If everything is working as intended, setup is complete.

If you encounter issues with your setup, use the MindManager Customer Admin Portal to submit a support ticket.