Azure SAML Setup for Formbird Integration

Overview

This guide outlines the steps to configure Single Sign-On (SSO) using SAML (Security Assertion Markup Language) for Formbird, integrated with Azure Active Directory (AD) as the Identity Provider (IdP).

Configuration Steps

Configure Formbird: Configure Formbird according to client data requirements, which must include a unique identifier for user profiles (email address)
Import User Data: Import client user data which must include agreed system unique identifier (manual data upload or inbound data feed). The screenshot below is Microsoft Azure Active Directory’s UI to import users.

import data

Setup Formbird as a Service Provider (SP):
Define the Entity ID, typically the Formbird URL (e.g., https://servername.formbird.com).
Specify the Assertion Consumer Service (ACS) URL, which processes SAML assertions (e.g., https://servername.formbird.com/auth/login/saml).
Modify the NameID format to "user.email" for uniformity.

Retrieve and download the "App Federation Metadata Url" and associated certificate for Formbird's configuration. ```javascript

    "authenticationProviders": {
        "saml": {
            "entryPoint": "https://login.microsoftonline.com/......",
            "cert": "MIIC8DCCAdigAwIBAgIQIPqW1dusd5hOwdGgGpM5GjANBgkqhkiG9w0BAQsFAD...."
        }
    }
```
*Note: The values for entryPoint and cert above are just portions of its real value. Please copy and paste the full values when configuring authenticationProviders.*

This can be copied from SSO server. Example below is from Azure’s Active Directory UI’s 3rd Step on setting up SAML. The "App Federation Metadata Url" will be the “entryPoint” and Certificate (Raw) will be the “cert”.
<img src="step-3.png" alt="download cert"/>
- `entryPoint`: identity provider entrypoint (is required to be spec-compliant when the request is signed)
- `cert`: the IDP's public signing certificate used to validate the signatures of the incoming SAML Responses`

Test the single sign on and copy the login url to client's configuration under authenticationProviders.saml.authenticationLink.

Export IdP Metadata File from Azure AD:
Instruct customer to export their IdP metadata file in XML format from Azure AD.
Identify and nominate specific accounts for initial SSO testing.
Import IdP Metadata File into Formbird:
Setup the Relying Party Trust in their Identity Provider (IdP) for the Formbird SP, and manually enter / import SP metadata. This will be done in customer side.
Configure Relying Party Trust in Azure AD:
- The customer needs to configure Claim Rules in their IdP:
  - Define data source for authentication (e.g. Active Directory)
  - Define attributes used for identity assertion, which must include at minimum the unique identifier defined in the Formbird in step 1 ( email address)
  - Configured to use the transient Name ID format