PARTNERS

Configuring GravityZone Cloud single sign-on with Azure AD

GravityZone Cloud supports single sign-on (SSO) with various identity providers that use SAML 2.0 as authentication standard.

This topic describes how to configure GravityZone Cloud single sign-on with Azure Active Directory (Azure AD) from Microsoft. For generic information on configuring other identity providers, refer to Configuring single sign-on using a 3rd party identity provider.

Prerequisites and requirements
  • You have a Microsoft Azure account with Azure AD Premium license activated and with Global Administrator or Co-admin role.

  • You have a GravityZone Cloud administrator account to manage users, your company and other companies.

  • GravityZone users have Azure AD accounts with the same email addresses.

Important

  • As GravityZone administrator, you can configure single sign-on for users from your company and from companies under your management. You cannot enable SSO for your own GravityZone account due to security reasons.

  • Users must be under companies that have SSO enabled. While SSO is active, users cannot log in with GravityZone credentials.

  • Email addresses are case sensitive with GravityZone SSO. Therefore, username@company.domain is different from UserName@company.domain and USERNAME@company.domain. If the email address from GravityZone does not match the email address from the identity provider, the user will receive a login error message when trying to connect to Control Center.

Configure Azure AD

To enable single sign-on with Azure Active Directory, you need to configure a non-gallery application. For generic information about configuring SAML-based single sign-on to non-gallery applications in Azure, you can also refer to this Microsoft KB article.

This is how you create and configure a non-gallery Azure application:

Set up [your application]

Click the View step-by-step instructions link to view the documentation related to your application.

  1. Log in to the Azure portal: https://portal.azure.com.

  2. In the left-side menu, go to Azure Active Directory.

    70359_3_1.png
  3. In the new left-side menu, click Enterprise Applications.

    70359_3_2.png
  4. At the upper-side of the page, click +New application.

    70359_3_3.png
  5. In the Add an application section, click Non-gallery application.

    70359_3_4.png
  6. In the Add your own application section, enter a relevant name (for example, GravityZone SSO) and click Add.

    70359_3_5.png
  7. In the Users and groups menu, click +Add user to assign users or user groups to this application.

    70359_3_6.png
    70359_3_7.png
  8. Next, in the left-side menu, click Single sign-on and SAML.

    70359_3_8.png
  9. In the Set up Single Sign-On with SAML page, complete the following sections:

    70359_3_9.png
Basic SAML Configuration
  1. Click the pencil icon to edit.

  2. Configure the following fields:

    • Identifier (Entity ID). Enter https://gravityzone.bitdefender.com/sp

    • Reply URL (Assertion Consumer Service URL). Enter https://gravityzone.bitdefender.com/sp/login

    • Sign on URL. Enter https://gravityzone.bitdefender.com/sp/login

    • Relay State. Skip. This is a parameter to specify where the application to redirect the user after the authentication is completed.

    • Logout URL. Enter https://gravityzone.bitdefender.com/sp/logout

  3. Click Save.

    70359_3_10.png

Return to the setup page.

User Attributes & Claims
  1. Click the pencil icon to edit.

  2. Configure the following fields:

    • Name. Enter a username.

    • Source. Select Attribute.

    • Source attribute. From the drop-down menu, select user.mail.

  3. Click Save.

    70359_3_11.png

Return to the setup page.

SAML Signing Certificate
  1. Click the pencil icon to edit.

  2. In the configuration page, enter an email address for certificate expiry reminders.

  3. Click Save.

    70359_3_12.png

Return to the setup page.

The SAML Signing Certificate section also displays the App Federation Metadata URL. This is the identity provider metadata URL, which you need in GravityZone Control Center, when configuring single sign-on for your company or a company under your management. Click Copy to clipboard button to copy and paste the URL somewhere at hand or keep this window open in your browser.

70359_3_13.png
Set up [your application]

Click the View step-by-step instructions link to view the documentation related to your application.

70359_3_14.png
Enable SSO in GravityZone

After configuring your application in Azure, go to GravityZone Control Center to enable SSO for companies and users. You cannot enable single sign-on for users under companies that do not have SSO enabled.

Enable SSO for your company

This is how you enable SSO for your company:

  1. In the upper-right corner of Control Center, go to Welcome, [your username] > My Company.

  2. In the Authentication tab, under Single Sign on using SAML, enter the identity provider metadata URL in the corresponding field. The other field, reserved for the GravityZone metadata URL, is non-editable.

    If you have saved the URL already, copy it here. If not, go to Azure Portal > Azure Active Directory > Enterprise application > [your application] > Set up single sign on. The App Federation Metadata URL is available in the SAML Signing Certificate section. Click the Copy to clipboard button to copy the URL and paste it in GravityZone.

  3. Click Save.

    generic-sso-my-company.png
Enable SSO for managed companies

This is how you enable single sign-on for a company under your management:

  1. Go to the Companies page.

  2. In the table, click the company’s name.

  3. Under Configure Single Sign-on using SAML, enter the identity provider metadata URL in the corresponding field. The other field, reserved for the GravityZone metadata URL, is non-editable.

    If you have saved the URL already, copy it here. If not, go to Azure Portal > Azure Active Directory > Enterprise application > [your application] > Set up single sign on. The App Federation Metadata URL is available in the SAML Signing Certificate section. Click the Copy to clipboard button to copy the URL and paste it in GravityZone.

  4. Click Save.

    sso-companies-edit.png
Change the authentication method for users

After enabling SSO for a company, GravityZone user accounts under that company become available for changing their authentication method.

You can change the authentication method for users one by one, as follows:

  1. Go to the Accounts page.

  2. In the table, click the user’s name.

  3. Under Settings and Privileges, go to Authentication method and select Login using your Identity Provider.

  4. Click Save.

    sso-user-edit.png

    You can enable SSO for as many GravityZone users as you want, but not for your own administrator account.

    Note

    If the configuration page of a GravityZone user account does not display the Settings and Privileges section, then probably the company has not SSO enabled.

Test GravityZone SSO

After configuring both the identity provider and GravityZone, you can test single sign-on as follows:

  1. Log out from GravityZone.

  2. Log out from Azure.

  3. Go to https://gravityzone.bitdefender.com/.

  4. Enter a valid email address created for testing (other than the one of your GravityZone administrator account).

  5. Click Next.

    You should be redirected to the identity provider's authentication page.

  6. Authenticate with your identity provider.

    You will be redirected back to GravityZone and, in a few moments, you should automatically log in to Control Center.

Disable GravityZone SSO

To disable single sign-on for your company or for a company under your management:

  1. Delete the identity provider metadata URL from the configuration page of that company.

  2. Click Save and confirm the action.

Users can obtain new passwords by clicking the Forgot password? link on the Control Center login page and following the instructions.

To re-enable GravityZone SSO for a company, enter again the identity provider in the configuration page and click Save.

After re-enabling SSO, users under that company will continue to log in to Control Center with GravityZone credentials. You have to manually configure each account, one by one, to log in with the identity provider again.