Azure AD Configuration

1. Log in to the Azure portal and select Azure Active Directory.
2. From the Manage menu, choose Enterprise applications and click New application.
3. Select Create your own application, provide an application name, and ensure names clearly distinguish the Admin Console and Service Portal if configuring both.
4. Assign appropriate users to the application.
5. Open Single sign-on and select SAML.
6. Edit Basic SAML Configuration with these values:
   • Commander Admin Console:
     • Identifier (Entity ID): {Commander FQDN}
     • Reply URL: https://{Commander FQDN}/saml/sso
     • Sign on URL: https://{Commander FQDN}/saml/sso
     • Logout URL: https://login.microsoftonline.com/common/wsfederation?wa=wsignout1.0
   • Commander Service Portal:
     • Identifier (Entity ID): {Commander FQDN}/portal
     • Reply URL: https://{Commander FQDN}/portal/saml/sso
     • Sign on URL: https://{Commander FQDN}/portal/saml/sso
     • Logout URL: https://login.microsoftonline.com/common/wsfederation?wa=wsignout1.0
7. Edit User Attributes and Claims:
   • Click Add new claim.
   • Enter:
     • Name: mail
     • Source: Attribute
     • Source attribute: user.mail
   • Remove all additional claims.
8. Review, confirm configuration, and download the Federation Metadata XML file.

Commander Application Server Configuration

1. On the Commander server, open an Administrator Command Prompt and navigate to:

   <INSTALL_DIRECTORY>\Embotics\vCommander\jre\bin\
   

2. Run the following command to create the SAML keystore:

   keytool -importkeystore -srckeystore ..\..\tomcat\conf\keystore -srcstoretype JKS -srcalias tomcat -srcstorepass changeit -destkeystore ..\..\tomcat\conf\saml-keystore.p12 -deststoretype PKCS12 -deststorepass changeit -destalias saml

3. Securely store the generated file:
   • Path: <INSTALL_DIRECTORY>\Embotics\vCommander\tomcat\conf\saml-keystore.p12
   • Contains key pair saml and uses the password changeit.

Commander Admin Console Configuration

1. Log in as a superuser and navigate to Configuration > Identity and Access, then the Authentication tab.
2. For SAML Single Sign-On for Commander and Service Portal:
   • Click Edit, check Enabled, then select File and upload the downloaded metadata.xml.
   • In SAML Key Pair, upload the saml-keystore.p12 file and provide the keystore password, alias, and key pair password.
   • Confirm external URLs match the Entity ID configured in Azure.
   • Enter User ID Attribute: mail.
   • Keep default hash algorithm (SHA256), check Signed Metadata, and provide Sign Out URL:

     https://login.microsoftonline.com/common/wsfederation?wa=wsignout1.0
     

   • Click OK to save.
3. Reload the browser to clear cached data.

Outcome

After configuration, users are redirected to Azure AD for SSO login when accessing Commander or the Service Portal. If needed, bypass SAML for the Admin Console using:

https://{Commander FQDN}/?defaultLogin