Configure SAML with Entra ID as identity provider

An Organization administrator role is required. For information, see User roles.

Before you begin, read Configure SSO with an Identity provider connection.

Jump to: 

1. Get the Identity Provider data from Nintex Workflow
  1. In the Identity provider connections page in Nintex Workflow, click Add connection.
  2. In the Add connection panel, select Entra ID as the identity provider.

    3. Additional fields appear for the following:

    • Entity ID
    • ACS URL
    • Attribute Statement

    Note: You will later need to copy and insert these values in specific fields in Entra ID.

  3. Keep your Nintex Workflow browser open and go to Entra ID.

For detailed information on each field that appears on the setup wizard, see Identity provider connection setup wizard elements and description.

2. Create a Nintex Workflow application in Entra ID

Note: Prepare the Service Provider data (Entity ID and ACS URL) and Attribute Statement values (First Name, Last Name, and Email), which you noted in the previous step. You will need to copy the data and paste them into specific fields in Entra ID.

  1. Sign in to the Azure portal as an administrator and navigate to the Entra ID service.

  2. Create a new enterprise application.

    1. On the left, navigate to the Manage section, and then click Enterprise applications.

    2. Click New application > Create your own application.

    3. Type the name of the application.

    4. From the list of reasons for creating the application, select Integrate any other application you don't find in the gallery.

    5. Click Create.

  3. Configure the application settings.

    1. On the left, navigate to the Manage section, and then click Properties.

    2. Switch the Assignment required toggle to No.

      Note: 

      • We recommend clicking No so that any user in Entra ID is able to authenticate as participants in Nintex Workflow.

      • If you click Yes, the Entra ID Admin needs to assign users to the SAML application before users can access Nintex Workflow.

    3. Switch the Visible to users toggle to No.

    4. Click Save.

  4. Open the Set up Single Sign-on with SAML page to configure the single sign-on settings.

    1. On the left, navigate to the Manage section, and then click Single sign-on.

    2. Click SAML.

      Set up Single Sign-on with SAML page

  5. Enter the Service Provider data from Nintex Workflow.

    1. In the Basic SAML Configuration section, click Edit.

    2. In the Identifier (Entity ID) field, paste the Entity ID that you copied from Nintex Workflow.

    3. In the Reply URL (Assertion Consumer Service URL) field, paste the ACS URL that you copied from Nintex Workflow.

    4. Click Save.

    5. Click Close.

  6. Map the Surname and Givenname identity attributes.

    1. In the User Attributes & Claims section, click Edit.

      Note: If you anticipate that a user's UPN might change in the future, edit the Unique User Identifier claim:

      • For Source, select Attribute.

      • In the Source attribute field, select user.objectid.

      • For Name identifier format, select Persistent.

    2. Add or edit a claim for Surname and Givenname.

    3. In the Name field, paste the attribute values that you copied from Nintex Workflow.

      • For Surname, paste the Last Name attribute.

      • For Given name, paste the First Name attribute.

    4. For Source, select Attribute.

    5. In the Source attribute field, select one of the following:

      • For Surname, select user.surname.

      • For Given name, select user.givenname.

    6. Save the changes.

  7. Map the Emailaddress identity attribute by performing one of the following configurations:

    If your Nintex Workflow tenant will have guest user accounts, follow the steps for Guest user-enabled configuration. Otherwise, follow the steps for normal configuration.

    • Normal configuration

      1. In the User Attributes & Claims section, click Edit.

      2. Add or edit a claim for Emailaddress.

      3. In the Emailaddress field, paste the Email attribute that you copied from Nintex Workflow.

      4. Set the Source to Attribute.

      5. In the Source attribute field, select user.mail.

        6. Note: 

        • For each user account, the source attribute value, which is mapped from Entra ID must contain a valid and real email address.

        • Alternatively, you can also use a User Principal Name (UPN) as long as it contains a real email address. To use a UPN, select user.principalname. The UPN and email address do not need to be the same.

      6. Save the changes.

    • Guest user-enabled configuration

      Important: 

      • Users with guest accounts can sign in to Nintex Workflow only if Auto-acceleration is turned on. For more information, see User management.

      • One-time password (OTP) is not supported for guest users.

      • Guest users cannot be promoted to a global administrator role.

      1. In the User Attributes & Claims section, click Edit.

      2. Add or edit a claim for Emailaddress.

        The Manage claim page appears.

      3. In the Name field, paste the Email attribute that you copied from Nintex Workflow.

      4. Set the Source to Transformation.

      5. In the Transformation field, click Edit.

        The Manage transformation panel appears.

      6. In the Transformation field, select IfNotEmpty().

      7. In the Parameter 1 (Input) field, select user.mail.

      8. In the Parameter 2 (Output) field, select user.mail.

      9. Select Specify output if no match.

      10. In the Parameter 3 (Output if no match) field, select user.principalname.

      11. Save the changes.

    Caution: After adding Nintex Workflow as a SAML application to Entra ID, make sure that users exist in Entra ID. Depending on the identity provider, an empty directory may cause SAML configuration to fail. For information on how to manage user accounts, refer to Entra ID's help documentation.

  8. In the Signing Certificate section, copy the SAML Metadata URL or download the file, depending on what you want to use in the Nintex Workflow setup wizard.

    • In the App Metadata Url field, click the Copy icon.

    • In the Metadata XML field, click Download.

      In the next step, you will need to copy the URL or attach the file in specific fields in Nintex Workflow.

    For more information on the SAML configuration steps in Entra ID, see Configure SAML-based single sign-on.

3. Copy the SAML metadata from Entra ID to Nintex Workflow

Prepare the App Metadata Url or Metadata XML, which you copied or downloaded in the previous step.

Follow these steps to complete the SAML configuration:

  1. In the Configure Identity Provider page of the setup wizard in Nintex Workflow, click Next.
  2. In the Connect page,:
    • In the URL field, paste the App Metadata Url that you copied from Entra ID.
    • Click Choose a file, and then attach the Metadata XML file that you downloaded from Entra ID.
  3. Click Connect.

    4. Note: The Connect button is enabled only when your domain is successfully verified AND you have provided the metadata URL or file.

    After connecting, your SAML configurations are checked. If successful, the setup wizard goes to the final page with the following information:

    Information Description
    Expiry date of certificate Date when your certificate expires.
    Recipient email address of the reminder for certificate expiry

    Email address to which a reminder email is sent when the certificate is close to expiring.

    Caution: You must renew the certificate before the expiry date.
    One-Time Password (OTP) URL

    The One-Time Password (OTP) URL is used for troubleshooting purposes when configuration fails and you are locked out of your tenant.

    Follow these steps to access your tenant when you cannot sign in due to a failed configuration of SAML:

    1. To copy the One-time password URL, click (Copy) next to the One-time password URL field.
    2. Open a new tab on your web browser, paste the copied URL and press ENTER.
    3. Enter your email address, and click Submit.

      4. For verification, a one-time password is sent to your email address. The one-time password expires after five minutes.

    4. Enter the one-time password you received, and click Sign in.

      5. You can access your Nintex Workflow tenant and resume configuring your identity provider connection.
  4. Click Done.

    5. The Identity provider connection section now lists information about your SAML configuration such as provider, domain, person who completed the configuration, and the date of configuration.

4. Test your SAML connection

  1. Sign in to your Nintex Workflow tenant.
  2. Click Sign in or press ENTER.

    3. You are taken to the login page of Entra ID.

  3. In Entra ID's login page, type your credentials, and then submit.

    4. If the SAML configuration is successful, you are granted access to the Nintex Workflow tenant.

Page Section User interface element

Description
Identity Provider Choose Identity Provider Identity provider

Displays the list of identity providers you can use for your tenant's identity federation.

  Service Provider data

 

(Appears after you select an identity provider)

In the context of our SAML configuration, the service provider is Nintex Workflow. Depending on the identity provider you choose, the SAML terminologies displayed in this section correspond with what your identity provider uses.

  Generic term Terminologies used in identity providers
Okta PingOne OneLogin Google Suite Active Directory Federation Services

Azure Active Directory

 
Entity ID A globally unique identifier of an entity, which in our case is the Nintex Workflow tenant to be configured with SAML. Audience URI (SP Entity ID) Entity ID Audience Entity ID Relying party trust identifier Identifier (Entity ID)
ACS URL or Assertion Consumer Service URL Single sign on URL ACS URLS ACS (Consumer) URL ACS URL Relying party SAML 2.0 SSO service URL Reply URL (Assertion Consumer Service URL)
Metadata An XML document that contains information about a SAML deployment. URL A link is provided to retrieve the URL.

IDP Metadata URL

A downloadable metadata file is also available.

Issuer URL A downloadable metadata file is provided. Federation Service identifier App Federation Metadata Url
   

Attributes

Set of identity data about a user. In configuring SAML in Nintex Workflow, only three attributes are requested from the identity provider:

  • First name
  • Last name
  • Email
    (Copy) Click to copy the values in the fields.
Connect
  URL

Location of the SAML metadata An XML document that contains information about a SAML deployment..
    Upload metadata The SAML metadata file.
Complete  

<Date>

(Only displayed for SAML)

Expiry date of the certificate.
    <Email address>

(Only displayed for SAML)

Email address to receive reminder when certificate is soon to expire.
  One-Time Password (OTP) URL <URL>

The One-Time Password (OTP) URL is used for troubleshooting purposes when configuration fails and you are locked out of your tenant.

Follow these steps to access your tenant when you cannot sign in due to a failed configuration of SAML:

  1. To copy the One-time password URL, click (Copy) next to the One-time password URL field.
  2. Open a new tab on your web browser, paste the copied URL and press ENTER.
  3. Enter your email address, and click Submit.

    4. For verification, a one-time password is sent to your email address. The one-time password expires after five minutes.

  4. Enter the one-time password you received, and click Sign in.

    5. You can access your Nintex Workflow tenant and resume configuring your identity provider connection.