Auto-Provisioning for Azure Active Directory

Introduction

SigningHub gives you an option to pre-authorize users in your Azure Active Directory so that they may serve as your registered enterprise users. In this way, your enterprise users can use their Directory credentials (i.e. organizational domain user ID and password) for SigningHub authentication, and won't even need to create their SigningHub IDs.

---

How it works?

1. Configure an Azure Active Directory connector in SigningHub Admin.

2. Configure the connector in an authentication profile, in SigningHub Admin.

3. Configure auto provisioning in SigningHub Web.

4. Configure a security group for auto-provisioning.

5. Auto-provision the users at login

---

Configure a connector in SigningHub Admin

Make the following configurations to a connector in SigningHub Admin:

1. In the "Basic Information" section, choose "Azure Active Directory" as the "Provider".

   
2. In the "Details" section, fill in the required fields.

   

1. In addition to "User.Read", an additional mandatory permission, "Directory.Read.All", will have to be configured for pre-authorization of users in Azure Active Directory.

---

Configure an authentication profile in SigningHub Admin

Make the following configurations to an authentication profile in SigningHub Admin:

1. Select the Azure Active Directory Connector created earlier, in the highlighted field below:

   

1. If you want to allow access to specific authorised security groups in your Azure Active Directory (i.e. Sales, Marketing, Accounts, etc.), enter the name of the security groups, with comma separation, in the "Allowed Groups" field to be used for provisioning in SigningHub.

2. If the "Allowed Groups" field is left blank, then all the domain users of a directory would be able to authenticate by using the authentication profile.

---

Configure auto-provisioning in SigningHub Web

To see in detail, how to pre-authorise users in SigningHub, click here.

Make the following configurations in the "Users" tab in SigningHub Web:

1. In the "Auto Provision Users" section, check the "Automatically register the users" check box and select the "Authentication Profile", created earlier. Click the "Save" button.

1. All the users that belong to the selected authentication profile will be authorised through Azure Active Directory upon login and will be automatically registered and activated in SigningHub under the default SigningHub role, provided that provisioning is not enabled by any other enterprise within the same on-premises deployment.
2. If multiple enterprises have been configured within an on-premises deployment, then the "Automatically register the users" check box should be ticked for only one enterprise.

3. Both public and private authentication profiles will be visible in the "Authentication Profile" drop-down for pre-authorising users.

---

Configure a security group for auto-provisioning

SingingHub also allows you to give role-based access to SigningHub (i.e. Enterprise Admin, Enterprise Users, etc.) at the Security Group level.

Make the following configurations to a security group in SigningHub Web:

1. For the security group, add the name and role of the security group.

1. The added security group will be listed inside the Security Group grid. All the users that belong to the security group will be automatically registered and activated in SigningHub, upon login, under the specified role.

   
2. The names of the security groups are not validated against the security groups in the Azure Active Directory, at this screen, so the correct security group name must be added for successful pre-authorisation upon login.

3. In case specific authorised security groups in were allowed in the authentication profile, only the security groups will appear in the "Security Group" drop down.

---

Auto-provision users at login

Logging in through your Azure Active Directory credentials for the first time, will take you to the registration screen and display your Azure Active Directory (email address) for new registration. After registration, you can easily login through your Azure Active Directory credentials. However, if the "Automatically register the users" check box is ticked from the "Auto Provision Users" screen, and an Azure Active Directory has been selected as an Authentication Profile, then the registration screen will not be displayed, as the provisioned Azure Active Directory users from there will be automatically registered and activated in SigningHub.

1. From the "More Login Options" option, select Azure Active Directory.

   
2. Provide your Azure Active Directory credentials.

   
3. The following login preferences will be followed when logging into SigningHub Web via Azure Active Directory:

Login preferences for auto-provisioning

Availability of Security Group in Azure Active Directory	Availability of Security Group in SigningHub Web	System Behaviour
Yes, the security group exists.	Yes, the mapping for the security group exists.	In case the user was already registered, the system will log in the user as per the assigned role. In case the user was not already registered, the system will register, auto activate, and log in the user as per the assigned role.
Yes, the security group exists.	No, the mapping for the security group does not exist.	In case the user was already registered, the system will log in the user as per the default role. In case the user was not already registered, the system will register, auto activate, and log in the user as per the default role.
No, the security group does not exist.	N/A	The system will throw an error and will not allow auto-provisioning.