Skip to main content

Security - Single Sign-On - Setting Up AAD Single Sign-On

Updated over 2 months ago

Single sign-on using Azure Active Directory (AAD) allows users to log in to Coins ERP+ using their Microsoft account, or to go directly into Coins ERP+ if they are already logged in to their Microsoft account.

The instructions below are for setting up AAD Single Sign-On using the OpenID Connect method. We now recommend using the Code Grant method instead.

  1. In SY Parameters, set the parameters below:

    Parameter - AAD_AUTHORIZE

    Description - A URL to the authorise endpoint for Azure. Set this to: https://login.microsoftonline.com/common/oauth2/v2.0/authorize

    If your AAD app is set as single tenant you will need to alter the tenant value from “common” to “organizations” (note spelling).

    For example: https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize

    AAD_CLIENT_ID

    The ID of the Azure Active Directory app for Coins ERP+ authentication. See Configuring AAD.

    AAD_HOME_URI

    The URI to the home page a user is taken to if they log out of Coins ERP+ but do not log out of AAD; for example: https://www.office.com .

    AAD_KEYS

    The URL to the Azure certificate keys (used to validate the returned authentication token). Set this to: https://login.microsoftonline.com/common/discovery/v2.0/keys .

    AAD_LOGOUT

    A URL to the logout endpoint for Azure. Set this to: https://login.microsoftonline.com/common/oauth2/v2.0/logout

    If your AAD app is set as single tenant you will need to alter the tenant value from “common” to “organizations” (note spelling).

    For example: https://login.microsoftonline.com/organizations/oauth2/v2.0/logout

    AAD_REDIRECT_URI

    The partial URI to the Coins ERP+ application, not including the program (just the cgi script) with no trailing slash. This needs to be registered in the Azure application.

    AAD_SSO

    Set to Y. This puts the Log in with Microsoft button on the Coins ERP+ login page and enables Single sign-on using Azure Active Directory.

  2. Disable Coins ERP+ two-factor authentication: set the AUTH2IPS parameter to blank.

  3. For each user who will use this feature, ensure that the correct email account is set up on their Coins ERP+ user ID.

  4. Ensure that syaadkeys.p is run to collect the Azure public keys to check the authentication tokens that are returned to Coins ERP+ from AAD. This is run automatically in sy906b.p which should be running every day, but you can run it from the tram lines editor to initialise.

  5. Check that the $BASE/var/certs/aad/v2.0 directory contains files (cert and pem) and the pem files have a size. This requires OpenSSL Jan 2017 version to be available.

Did this answer your question?