Articles in this section

Configuring SSO for Dazychain

Avatar
Natalie Wong
Updated

Dazychain uses Secure Assertion Markup Language (SAML) via Cognito as our single sign-on (SSO) authentication method. Many identity provider services, such as Okta, OneLogin, and Azure AD support this.

SSO is an additional function that can be configured for your organisation. It requires configuration by your IT team in coordination with Dazychain.

Note: Idp Initiated / Entra Azure Dashboard login is available.

Requirements

  • A Dazychain instance
  • An Active Directory instance where all users have an email address attribute
  • Compatible Outlook version, review here

Process

  1. A Cognito User Pool ID and Reply URL will be provided at the commencement of the integration setup by Dazychain
  2. Your IT team create an Enterprise Application in the Active Directory (e.g. Azure /Entra ID IdP).
  3. Add users and groups to the application. Add all users that will use Dazychain and submit intake forms. This is best applied to all users across the organization.
  4. Download and share the Federation Metadata XML will be downloaded and provided to Dazychain once configured (or download link provided)
    Fed link.png
  5. Dazychain completes Cognito User Pool configuration and links back to Dazychain application completing the integration setup

Note: A sandbox environment is available for testing purposes on request.

 

Certificate Expiry

We recommend signing your certificate and allowing a few years minimum until expiry to reduce the need to rotate certificates too frequently. Please ensure the expiry date is noted and alerts are in place to anticipate and intercept expiration before the service becomes unavailable.

Troubleshooting

The following attributes need to be mapped:

  • email
  • givenname
  • surname

As per the following example:

Example.png

 

IdP initiated SSO / Microsoft Myapps Dashboard

A Dazychain icon can be published on your https://myapps.microsoft.com/ dashboard for your users. The icon provides a single-click experience for the user from their common dashboard into Dazychain. The visibility of the link icon is managed by your IT team. Please advise if an IdP initiated SSO is desired before configuration.

The Dazychain team will configure and provide a RelayState parameter to add to your Enterprise application enabling a single click from dashboard to application flow. If this is the first time the user visits Dazychain, they will be prompted to enter their email address to allow us to establish the company they are from before completing the sign in. This is only required if the user's cookies are cleared or they switch browsers.

 

Integration diagram 

SSO__1_.png

Troubleshooting

If a user cannot log in to Dazychain it is important to note the messages and errors presented. Common errors are usually due to:

  • User not listed in permissions for the Dazychain Enterprise application.
    Solution: Allow all users to auth to Dazychain. This does not permit all users access to private data in Dazychain. They must also be invited by the org admin and granted permissions via groups and roles in Dazychain to be able to see matters and documents.
  • Microsoft login prompts for approvals.
    Solution: Ensure the App Registration for Dazychain has been configured to allow all users to access it without admin approval.
  • Any other problems
    Solution: Contact the Dazychain support team

 

External resources

How do I set up Okta as a SAML identity provider?

How do I set up Azure AD as a SAML identity provider?

 

Related articles