Configure single sign-on with Microsoft Entra ID as identity provider

Global Administrator role in Microsoft Entra ID Microsoft’s cloud-based identity and access management service, which helps your employees sign in and access resources in: External resources, such as Microsoft Office 365, the portal, and other SaaS applications. Internal resources, such as apps on your corporate network and intranet, along with any cloud apps developed by your own organisation. (formerly Microsoft Azure Active Directory) required. Promaster A Nintex Promapp system administrator who administers a Nintex Promapp site and has rights to view and edit all areas of a Nintex Promapp site. privilege in Nintex Process Manager required.

You can configure single sign-on (SSO) in your Nintex Process Manager site with Microsoft Entra ID to enable users to securely and conveniently sign in to Nintex Process Manager using the same credentials.

Prerequisites

You must have the following prerequisites configured before you start:

Once you have the prerequisites configured, follow the details in the sections below.

Configure SSO settings in Microsoft Azure portal and Nintex Process Manager

Follow these steps to configure settings in a Microsoft Azure portal and Nintex Process Manager for enabling SSO.

Important: 
  • For customers in Australia and New Zealand, https://au.promapp.com/<sitename> is the preferred URL to access your Nintex Process Manager site.
  • If you are using https://go.promapp.com/<sitename> as your main URL, you must add both https://go.promapp.com/<sitename> and https://au.promapp.com/<sitename> in Step 2.3a and Step 2.3b described below.

Before configuring Nintex Process Manager for SSO with Microsoft Entra ID (previously Microsoft Azure Entra ID), you need to add Nintex Process Manager from the Microsoft Entra ID application gallery to your list of managed SaaS applications.

Follow these steps to add the Nintex Process Manager application:

  1. Sign in to your Microsoft Azure portal.
  2. In the left navigation pane, click Microsoft Entra ID.
  3. Click Enterprise applications > All applications.
  4. Click + New application from the top pane.
  5. Type Nintex Process Manager in the Search box.
  6. Select Nintex Process Manager from the search results.
  7. Type a Name which will help you to identify the application for users in your organisation on the Access Panel.
  8. Click Add.

The Nintex Process Manager application is added to the Microsoft Azure portal and you can now set up SSO for your Nintex Process Manager site.

After you add Nintex Process Manager from the Microsoft Azure Entra ID application gallery to your list of managed SaaS applications, follow these steps to configure Microsoft Azure Entra ID SSO.

  1. Sign in to your Microsoft Azure portal and navigate to the Nintex Process Manager application that you added in Step 1: Add the Nintex Process Manager application to a Microsoft Azure portal.
  2. In the left navigation pane, click Single sign-on > SAML.
  1. In the Set up Single Sign-On with SAML page, click the pencil icon in the Basic SAML Configuration section.
    1. In the Identifier (Entity ID) field, type your Nintex Process Manager site URL in the following format: https://<au/us/ca/eu>.promapp.com/<sitename>/.
      For example: If your Nintex Process Manager site name is demosso in au region, you must enter: https://au.promapp.com/demosso/.The slash (/) at the end MUST be included.
    Important: 
    • For customers in Australia and New Zealand, https://au.promapp.com/<sitename> is the preferred URL to access your Nintex Process Manager site.
    • If you are using https://go.promapp.com/<sitename>/ as your main URL, you must add both https://go.promapp.com/<sitename>/ and https://au.promapp.com/<sitename>/.
    1. In the Reply URL (Assertion Consumer Service URL) field, type https://<au/us/ca/eu>.promapp.com/<sitename>/saml/authenticate.aspx.
      For example: If your Nintex Process Manager site name is demosso in au region, you must enter: https://au.promapp.com/demosso/saml/authenticate.aspx.
    Important: 
    • For customers in Australia and New Zealand, https://au.promapp.com/<sitename> is the preferred URL to access your Nintex Process Manager site.
    • If you are using https://go.promapp.com/<sitename> as your main URL, you must add both https://go.promapp.com/<sitename>/saml/authenticate.aspx and https://au.promapp.com/<sitename>/saml/authenticate.aspx .
    1. Click Save on the top-left.
  1. Scroll down to the SAML Certificate section and download the Certificate (Base64) details. This certificate is required to configure the Nintex Process Manager SSO settings. Open this file using Notepad and copy all text between “---Begin Certificate---“ and “----End Certificate---“ .
  1. In the Set up <application> section, click Copy to clipboard next to the Login URL field. This Login URL will be used as the SSO Login Url used by Nintex Process Manager for Service Provider initiated login.

Follow Step 3: Configure Nintex Process Manager SSO settings to configure the SSO settings in your Nintex Process Manager site.

Follow these steps to configure the SSO settings in your Nintex Process Manager site:

  1. Sign in to your Nintex Process Manager site.
  2. Go to Admin > Configure > Security.
  3. In the SSO - Single Sign-on Mode field, click edit and select Optional from the drop-down list. Setting it as Optional allows you to test both the Identity Provider login and Nintex Process Manager login independently to ensure both are working. Once set to Required it is much more difficult to troubleshoot problems if login does not work as expected.
  4. In the SSO - Login Url field, click edit. Paste the Login URL you copied in Step 5 of Step 2: Configure Microsoft Entra ID SSO.
  1. In the SSO - x.509 Certificate field, click edit. Paste the Certificate (Base64) details you copied in Step 4 of Step 2: Configure Microsoft Entra ID SSO.

  1. Enabling the Sync user details with SSO provider setting will allow users in your Microsoft Azure Entra ID portal to log in to the configured Nintex Process Manager for the first time and a “User” and "Profile" will be automatically created in Nintex Process Manager if an existing record is not found.

    • If Sync user details with SSO provider is disabled, the Promaster must create the user in Nintex Process Manager.

    • Ensure that the Logon field for the User record in Nintex Process Manager must match the User Principal Name in the Microsoft Azure Entra ID portal.

    • Update Nintex Process Manager user names in bulk (if required) by exporting the user details, changing them in the .csv file, and importing again. For more information, see import users.

Once you have configured the SSO settings for your Nintex Process Manager site, ensure you test the connection.

  1. Sign in to your Microsoft Azure portal and navigate to the Nintex Process Manager application you added in Step 1.
  2. In the left navigation pane, click Single sign-on.
  3. On the top of the Set up Single Sign-On with SAML page, click Test this application and follow the instructions.
Azure AD integration with Nintex Process Manager is currently configured only for service-initiated authentication. That is, going to a Nintex Process Manager site URL initiates the authentication process.

Troubleshooting

For more information and troubleshooting SSO, see: