Skip to main content

How to configure SAML authentication and provisioning for Azure AD

Written by Ben Asraf

Create a new application in Azure AD

  1. Go to Azure Portal

  2. Enter to your Active Directory managing page

  3. Click on "Enterprise Applications"

  4. Click on "New Application"

  5. Click on "Create your own application"

  6. Give it a name and choose the "Integrate any other application you don't find in the gallery (Non-gallery)" option

Set up SSO

ℹ️ In this manual <baseURL> should be replaced with your instance URL (the one you use when accessing the application from a web-browser)

  1. Go to the application overview page and click on "Single sign-on" in the left menu and than click on "SAML"

  2. Set the following values in the "Basic SAML Configuration":

    1. Identifier (Entity ID): NextPlus

    2. Reply URL: <baseURL>/api/UserModels/replayFromAuthProvider

    3. Logout URL: <baseURL>

  3. Next, create a new User Claim for groups using the Group ID as the source attribute click on the "Add a group claim" button

Optional job title claim

This section applies to Next Plus versions that include the Job title field in SAML Attribute Mapping. Job title is optional profile information, such as Production Manager, and does not grant application permissions.

  1. In Microsoft Entra ID, open the enterprise application, select Single sign-on > SAML, and edit Attributes & Claims.

  2. Add a new claim. For example, use jobTitle as the claim name, leave the namespace empty, select Attribute as the source, and select user.jobtitle as the source attribute. Save the claim.

  3. In Next Plus, open Settings > Authentication > SAML. Under Attribute Mapping, click Add new attribute. Select Job title as the Next plus field name and enter jobTitle as the Auth provider field. If you used a different claim name or a namespace, enter the exact full attribute name emitted in the SAML assertion. Save the settings.

  4. Sign in with a user whose Entra profile has a job title. Open the user profile in Next Plus and verify that Job title contains the expected value. The mapped value is saved on SAML sign-in for newly created and existing users. If SCIM provisioning is enabled, the user must already be provisioned; this mapping reads the SAML sign-in claim.

If the mapping is omitted or the claim is absent, the existing job title is preserved. An explicitly empty string clears the title. Users without a job title can still be created and edited. Role and group mappings continue to control permissions separately.

For a direct LDAP connection, Next Plus reads the standard AD title attribute automatically; no job title mapping is required in the LDAP settings.

Roles and Azure AD Group Mapping

In Next Plus, roles determine what users can do within the application. When configuring your Azure AD integration, you can map these roles to corresponding Azure AD groups:

  1. Sysadmin

    • Description: Has unrestricted access to every aspect of Next Plus.

    • Typical Users: IT or IS teams who need full permissions for configuration, data integration, and advanced system oversight.

  2. Admin

    • Description: Responsible for managing Next Plus settings, user accounts, and high-level administration tasks.

    • Typical Users: IT or IS teams with a focus on setting up and maintaining user permissions, backups, and core system policies.

  3. Editor

    • Description: Maintains and creates instructional content, forms, workflows, and dashboards.

    • Typical Users: Engineering, R&D teams, technical writers, and anyone overseeing the creation or revision of SOPs, forms, and data reports.

  4. Operator

    • Description: Performs daily tasks using Next Plus, such as completing work orders, filling forms, and following SOPs on the shop floor.

    • Typical Users: Front-line workers, team leaders, production managers, quality control staff, or subcontractors who need to report progress.

  5. Viewer

    • Description: Limited to viewing or reading SOPs, reports, and audits; cannot edit or submit new data.

    • Typical Users: Audit personnel, managers, or executives who need read-only access to dashboards and instructions.

For more information about roles and permissions please refer to the User Permission Levels Guide.

Configure Certificate Validation

Azure Entra ID requires certificate validation for secure SAML exchanges. Next Plus automatically generates and manages these certificates:

1. In the Azure AD SAML configuration, scroll to the "SAML Signing Certificate" section

2. Under "Verification Certificates," click "Upload Certificate"

3. Download the NextPlus certificate from <baseURL>/api/saml/certificate

4. Upload this certificate to Azure

5. Set "Require verification certificates" to "Yes"

6. For more options, you can also use:

- SAML Metadata: <baseURL>/api/saml/metadata

- Certificate for download: <baseURL>/api/saml/certificate

ℹ️ The certificate is automatically generated with a 10-year validity period to minimize maintenance. If you need to regenerate certificates, delete the existing certificate files from your Next Plus storage directory.

Configure user provisioning

ℹ️ If Next Plus is installed on an on-premise server and Azure cannot access it, please refer to How to configure on-premise provisioning for Azure AD

  1. Navigate to the Provisioning page and click on the "Get started" button

  2. Set "Provisioning Mode" to "Automatic" and set the following values in the "Admin Credentials" section

    1. Tenant URL: <baseURL>/api/scim

    2. Secret Token: Generated when set up in Next Plus

⚠️ Note that the recommended way to assign users to the application is only by assigning them to an assigned group

Known Limitation

  1. Due to the nature of SAML, when running a workflow that has a multi-signature step, SAML users will not be able to sign unless they are running the workflow while they are logged in.

Troubleshooting

Errors:

⛔ AADSTS7500511: XML attribute 'AssertionConsumerServiceURL' in the SAML message must be a URI.

✅ Please make sure that NEXTPLUS_SITE_URL environment variable is set correctly and matches the baseURL of the Azure Application

Did this answer your question?