Configure SAML with Azure Active Directory as identity provider

  An administrator role is required. For information about user roles, see User roles .

On this page:

You can use Security Assertion Markup Language An industry standard for exchanging authentication data between an identity provider and an application or service provider (that's Nintex Workflow Cloud) (SAML) 2.0 protocol to enable single sign-on Enables users to access multiple applications using one set of credentials. in your Nintex Workflow Cloud tenant with Azure Active Directory.

The objectives of configuring SAML in Nintex Workflow Cloud include:

  • Set up SAML in Nintex Workflow Cloud and Azure Active Directory at the same time.
  • You must refer to Azure Active Directory's documentation for their steps on how to add a SAML application (such as Nintex Workflow Cloud).
  • Make sure to add users in your directory in Azure Active Directory. Typically, a user directory should already exist for your organization.
  • Identify the SAML-related terminologies used between Nintex Workflow Cloud and Azure Active Directory so that you can set the appropriate values in specific fields during configuration. SAML-related terminologies include the following:
    • Entity ID: A globally unique identifier of an entity, which in our case is the Nintex Workflow Cloud tenant to be configured with SAML.
Note: 

There are two ways to enable single sign-on in Azure Active Directory.

  • If you want to configure the identity federation in your Nintex Workflow Cloud tenant to use SAML settings for enabling single sign-on, refer to the information in this help topic.

  • If you want to select the Azure Active Directory option in the Nintex Workflow Cloud's setup wizard, see Configure single sign-on with Azure Active Directory.

Before you begin

Before configuring SAML in Nintex Workflow Cloud, make sure you have the following:

  • A domain which you intend to federate with Nintex Workflow Cloud. Example: YourDomain.com. Before you can use a domain to associate with your Nintex Workflow Cloud tenant, you must first verify ownership of the domain. To verify a domain, see Verify a domain for SAML configuration.
  • An email address with an administrator role in the Nintex Workflow Cloud tenant that you're going to configure with SAML. For example, admin@YourDomain.com.
  • An email address with an administrator role in Azure Active Directory.
Note: 

Enabling single sign-on in your tenant will also enable single sign-on in associated Nintex Workflow Cloud tenants. For example, both sales-myorg.workflowcloud.com and hr-myorg.workflowcloud.com will be enabled with single sign-on if you configure SAML in either of them.

1

Verify your domain in your Nintex Workflow Cloud tenant

  1. Sign in to Nintex Workflow Cloud using an email address with an administrator permission.
  2. From the main menu on the upper right, click Settings.
  3. From the left menu, click User Management.
  4. A new page appears showing the configuration fields for identity federation and user management.

  5. In the Identity federation section, click Configure.
  6. The setup wizard appears.

    Tip: The initial page of the setup wizard includes a warning message that lists the Nintex Workflow Cloud tenants associated with the tenant you're going to configure with SAML. Click View more to see the list of tenants.

  7. Select SAML.
  8. Click Next.
  9. The Verify Domain page appears where the domain verification code is displayed.

    Verify Domain page

  10. Verify your domain by using the verification code and adding a DNS record. For complete steps on verifying your domain, see Verify a domain for SAML configuration.
  11. Caution: As part of the prerequisites to Federation configuration, you must first verify ownership over a domain that you're going to use for SAML configuration. If you have not verified your domain or while your DNS is still processing the verification, you can continue configuring SAML in Nintex Workflow Cloud but you cannot submit your SAML configuration.

 

2

Get the Identity Provider data from Nintex Workflow Cloud

Note: Make sure your domain is verified successfully.

  1. Go back to Nintex Workflow Cloud.
  2. In the Verify Domain page of the setup wizard, click Next.
  3. In the Configure Identity Provider page, select Other as the identity provider.
  4. Additional fields appear for the following:

    • Entity ID
    • ACS URL
    • Attribute Statement
    • Configure Identity Provider page of the Nintex Workflow Cloud Setup Wizard

    Note: You will later need to copy and insert these values in specific fields in Azure Active Directory.

  5. Keep your Nintex Workflow Cloud browser open and go to Azure Active Directory.

For detailed information on each field that appears on the setup wizard, see Identity federation setup wizard elements and description.

 

3

Create a Nintex Workflow Cloud application in Azure Active Directory

Note: Prepare the Service Provider data (Entity ID and ACS URL) and Attribute Statement values (First Name, Last Name, and Email), which you noted in the previous step. You will need to copy the data and paste them into specific fields in Azure Active Directory.

  1. Sign in to the Azure portal as an administrator and navigate to the Azure Active Directory service.

    The Azure Active Directory Overview page appears.

  2. Create a new enterprise application.

    1. On the left navigation, navigate to the Manage section, and then click Enterprise applications.

    2. On the top of the screen, click New applicationCreate your own application.

    3. In the Create your own application dialog box, type the name of the application.

    4. From the list of reasons for creating the application, select Integrate any other application you don't find in the gallery.

    5. Click Create.

  3. Configure the application settings.

    1. On the left navigation, navigate to the Manage section, and then click Properties.

    2. Switch the User assignment required toggle to No.

      Note: 
      • We recommend clicking No so that any user in Azure Active Directory is able to authenticate as participants in Nintex Workflow Cloud.

      • If you click Yes, the Azure Active Directory Admin needs to assign users to the SAML application before users can access Nintex Workflow Cloud.

    3. Switch the Visible to users toggle to No.

    4. Click Save.

  4. Open the Set up Single Sign-on with SAML page to configure the single sign-on settings.

    1. On the left navigation, navigate to the Manage section, and then click Single sign-on.

    2. Click SAML.

      The Set up Single Sign-on with SAML page appears.

      Set up Single Sign-on with SAML page

  5. Enter the Service Provider data from Nintex Workflow Cloud.

    1. In the Basic SAML Configuration section, click Edit.

      The Basic SAML Configuration page appears.

    2. In the Identifier (Entity ID) field, paste the Entity ID that you copied from Nintex Workflow Cloud.

    3. In the Reply URL (Assertion Consumer Service URL) field, paste the ACS URL that you copied from Nintex Workflow Cloud.

    4. Click Save.

    5. Click Close.

  6. Map the Surname and Givenname identity attributes.

    1. In the User Attributes & Claims section, click Edit.

      The User Attributes & Claims page appears.

    2. Add or edit a claim for Surname and Givenname.

      The Manage claim page appears.

    3. In the Name field, paste the attribute values that you copied from Nintex Workflow Cloud.

      • For Surname, paste the Last Name attribute.

      • For Given name, paste the First Name attribute.

    4. For Source, select Attribute.

    5. In the Source attribute field, select one of the following:

      • For Surname, select user.surname.

      • For Given name, select user.givenname.

    6. Save the changes.

  7. Map the Emailaddress identity attribute by performing one of the following configurations:

    If your Nintex Workflow Cloud tenant will have guest user accounts, follow the steps for Guest user-enabled configuration. Otherwise, follow the steps for normal configuration.

    • Normal configuration

      1. In the User Attributes & Claims section, click Edit.

        The User Attributes & Claims page appears.

      2. Add or edit a claim for Emailaddress.

        The Manage claim page appears.

      3. In the Emailaddress field, paste the Email attribute that you copied from Nintex Workflow Cloud.

      4. Set the Source to Attribute.

      5. In the Source attribute field, select user.mail.

      6. Note: 
        • For each user account, the source attribute value, which is mapped from Azure Active Directory must contain a valid and real email address.

        • Alternatively, you can also use a User Principal Name (UPN) as long as it contains a real email address. To use a UPN, select user.principalname.

      7. Save the changes.

    • Guest user-enabled configuration

      Important: 
      • Users with guest accounts can sign in to Nintex Workflow Cloud only if Auto-acceleration is turned on. For more information, see User management.

      • One-time password (OTP) is not supported for guest users.

      • Guest users cannot be promoted to an administrator role.

      1. In the User Attributes & Claims section, click Edit.

        The User Attributes & Claims page appears.

      2. Add or edit a claim for Emailaddress.

        The Manage claim page appears.

      3. In the Name field, paste the Email attribute that you copied from Nintex Workflow Cloud.

      4. Set the Source to Transformation.

      5. In the Transformation field, click Edit.

        The Manage transformation panel appears.

      6. In the Transformation field, select IfNotEmpty().

      7. In the Parameter 1 (Input) field, select user.mail.

      8. In the Parameter 2 (Output) field, select user.mail.

      9. Select Specify output if no match.

      10. In the Parameter 3 (Output if no match) field, select user.principalname.

      11. Save the changes.

    Caution: After adding Nintex Workflow Cloud as a SAML application to Azure Active Directory, make sure that users exist in Azure Active Directory. Depending on the identity provider, an empty directory may cause SAML configuration to fail. For information on how to manage user accounts, refer to Azure Active Directory's help documentation.

  8. In the Signing Certificate section, copy the SAML Metadata URL or download the file, depending on what you want to use in the Nintex Workflow Cloud setup wizard.

    • In the App Federation Metadata Url field, click the Copy icon.

    • In the Federation Metadata XML field, click Download.

      Note: In the next step, you will need to copy the URL or attach the file in specific fields in Nintex Workflow Cloud.

    For more information on the SAML configuration steps in Azure Active Directory, see Configure SAML-based single sign-on.

 

4

Copy the SAML metadata from Azure Active Directory to Nintex Workflow Cloud

Note: Prepare the App Federation Metadata Url or Federation Metadata XML, which you copied or downloaded in the previous step.

Follow these steps to complete the SAML configuration:

  1. Go back to Nintex Workflow Cloud.
  2. In the Verify Domain page of the setup wizard, click Next.
  3. In the Connect page, do one of the following:
    • In the URL field, paste the App Federation Metadata Url that you copied from Azure Active Directory.
    • Click Choose a file, and then attach the Federation Metadata XML file that you downloaded from Azure Active Directory.
    • Connect page of Nintex Workflow Cloud Setup wizard
  4. Click Connect.
  5. Note: The Connect button is enabled only when your domain is successfully verified AND you have provided the metadata URL or file.

    After connecting, your SAML configurations are checked. If successful, the setup wizard goes to the final page with the following information:

    Information Description
    Expiry date of certificate Date when your certificate expires.
    Recipient email address of the reminder for certificate expiry

    Email address to which a reminder email is sent when the certificate is close to expiring.

    Caution: You must renew the certificate before the expiry date.

    One-Time Password (OTP) URL

    The One-Time Password (OTP) URL is used for troubleshooting purposes when configuration fails and you are locked out of your tenant.

    Follow these steps to access your tenant when you cannot sign in due to a failed configuration of SAML:

    1. To copy the One-time password URL, click (Copy) next to the One-time password URL field.
    2. Open a new tab on your web browser, paste the copied URL and press ENTER.
    3. The Sign in page of Nintex Workflow Cloud appears.

    4. Enter your email address, and click Submit.
    5. For verification, a one-time password is sent to your email address.

      Note: The one-time password expires after five minutes.

    6. Enter the one-time password you received, and click Sign in.
    7. You can access your Nintex Workflow Cloud tenant and resume configuring your identity federation.

  6. Click Done.
  7. The Identity federation section now lists information about your SAML configuration such as provider, domain, person who completed the configuration, and the date of configuration.

     

5

Test your SAML connection

  1. Sign in to your Nintex Workflow Cloud tenant.
  2. Click Sign in or press ENTER.
  3. You are taken to the login page of Azure Active Directory.

  4. In Azure Active Directory's login page, type your credentials, and then submit.
  5. If the SAML configuration is successful, you are granted access to the Nintex Workflow Cloud tenant.