An overview of configuring Intacct for single sign-on. To configure the Intacct application for single-sign on (an overview)

Transcription

1 Chapter 94 Intacct This section contains the following topics: "An overview of configuring Intacct for single sign-on" on page "Configuring Intacct for SSO" on page "Configuring Intacct in Admin Portal" on page "For more information about Intacct" on page An overview of configuring Intacct for single sign-on To configure the Intacct application for single-sign on (an overview) 1 Configure Intacct for SSO with SAML. For details, see "Configuring Intacct for SSO" on page Configure Intacct users for SSO. For each user in Intacct, enable the account for SSO and provide the unique SSO ID that maps to a specified attribute in Active Directory or the Cloud User Service. 3 Configure the application settings in Admin Portal: Configure the Intacct web application in the Admin Portal. Here you specify some of the settings you specified in the web application directly. For details, see "Configuring Intacct in Admin Portal" on page Requirements A signed certificate in PEM format. You can either download the standard certificate from Admin Portal or use your organization s trusted certificate. Setting up the certificates for SSO To establish a trusted connection between the web application and the cloud service, you need to have the same signing certificate in both the application and the application settings in Admin Portal. If you use your own certificate, you upload the signing certificate and its private key in a.pfx or.p12 file to the application settings in Admin Portal. You also upload the public key certificate in a.cer or.pem file to the web application. 710

2 Configuring Intacct for SSO What you need to know about Intacct Each SAML application is different. Here are the Intacct features and functionality that you need to know when configuring the application for SSO. Feature Available versions and clients SP-initiated SSO works? IdP-initiated SSO works? Is there a separate login for administrators after SSO is enabled? Lockout possibility and how to recover after lockout User provisioning User types Can users reset their own passwords? Can administrators reset a user s password? IP range Description web application only yes yes yes The Intacct Administrator account can continue to log in with their Intacct user name and password after SSO is enabled (no lockout). When creating a user for SSO, you do need to edit the user and enter the user s federated SSO ID. For example, if you use Active Directory users, you can use the samaccountname field. Administrator and general users Intacct users can reset their own Intacct password, and Intacct administrators can reset users passwords. If desired, you can specify IP range settings directly in Intacct by going to Company > Company Information > Security Settings and edit the setting for Enforce IP Address filters. Configuring Intacct for SSO You need administrator privileges in Intacct to perform these steps. Tip It can be useful to open the web application and Admin Portal simultaneously and have them both open, perhaps side by side. As part of the SSO configuration process, you ll need to copy and paste settings between the two browser windows. To configure Intacct for SSO: 1 In your web browser, go to and log in with your Company ID, administrator user name, and password. 2 Go to Company > Company Info. 3 Click Single Sign-On. 4 Click Edit. Chapter

3 Configuring Intacct for SSO Use this page to configure the application for single sign-on. 5 Specify the following for the SSO Settings: Option Single Sign On Enabled 6 Click Save. 7 Go to Company > Users. 8 For each user: a b c d Description SSO Identity Provider Type SAML 2.0 SSO Issuer URL SSO Login URL SSO Certificate Next to the user name, click Edit. Click the Single Sign-on tab. Select the Enable Single Sign on option. Enter the user s SSO user id. 9 Log out of your Intacct account. select this option to enable SSO Copy the SSO Issuer URL from the Intacct Application Settings and paste it into this field. To enable SP-initiated SSO, copy the Login URL from the Intacct Application Settings and paste it here. [paste in the contents of your public-key certificate in PEM format] Cloud Manager user s guide 712

4 Configuring Intacct in Admin Portal Configuring Intacct in Admin Portal To add and configure the Intacct application in Admin Portal: 1 In Admin Portal, click Apps. 2 Click Add Web Apps. The Add Web Apps screen appears. 3 On the Search tab, enter the partial or full application name in the Search field and click the search icon. 4 Next to the application, click Add. 5 In the Add Web App screen, click Yes to confirm. Admin Portal adds the application. 6 Click Close to exit the Application Catalog. The application that you just added opens to the Application Settings page. 7 On the Application Settings page, specify the following settings that are unique to this application: Option SSO Issuer URL Your Intacct Company ID SSO Login URL Description The cloud service automatically generates the content of this field. Copy this URL and paste into Intacct directly. Enter your Intacct Company ID here. The cloud service automatically generates the content of this field. Copy this URL and paste into Intacct directly. Chapter

5 Configuring Intacct in Admin Portal 8 On the Application Settings page, expand the Additional Options section and specify the following settings: Option Application ID Show in User app list Security Certificate Description Configure this field if you are deploying a mobile application that uses the Samsung mobile SDK, for example mobile applications that are deployed into a Samsung KNOX version 1 container. The cloud service uses the Application ID to provide single sign-on to mobile applications. Note the following: The Application ID has to be the same as the text string that is specified as the target in the code of the mobile application written using the mobile SDK. If you change the name of the web application that corresponds to the mobile application, you need to enter the original application name in the Application ID field. There can only be one SAML application deployed with the name used by the mobile application. The Application ID is case-sensitive and can be any combination of letters, numbers, spaces, and special characters up to 256 characters. Select Show in User app list to display this web application in the user portal. (This option is selected by default.) If this web application is added only to provide SAML for a corresponding mobile app, deselect this option so the web application won t display for users in the user portal. These settings specify the signing certificate used for secure SSO authentication between the cloud service and the web application. Just be sure to use a matching certificate both in the application settings in the Admin Portal and in the application itself. Select an option to change the signing certificate. Use existing certificate When selected the certificate currently in use is displayed. It s not necessary to select this option it s present to display the current certificate in use. Use the default tenant signing certificate Select this option to use the cloud service standard certificate. This is the default setting. Use a certificate with a private key (pfx file) from your local storage Select this option to use your organization s own certificate. To use your own certificate, you must click Browse to upload an archive file (.p12 or.pfx extension) that contains the certificate along with its private key. If the file has a password, you must enter it when prompted. Upload the certificate from your local storage prior to downloading the IdP metadata or the Signing Certificate from the Applications Settings page. If the IdP metadata is available from a URL, be sure to upload the certificate prior to providing the URL to your service provider. Cloud Manager user s guide 714

6 Configuring Intacct in Admin Portal 9 (Optional) On the Description page, you can change the name, description, and logo for the application. For some applications, the name cannot be modified. The Category field specifies the default grouping for the application in the user portal. Users have the option to create a tag that overrides the default grouping in the user portal. 10 On the User Access page, select the role(s) that represent the users and groups that have access to the application. When assigning an application to a role, select either Automatic Install or Optional Install: Select Automatic Install for applications that you want to appear automatically for users. If you select Optional Install, the application doesn t automatically appear in the user portal and users have the option to add the application. 11 (Optional) On the Policy page, specify additional authentication control for this application.you can select one or both of the following settings: Restrict app to clients within the Corporate IP Range: Select this option to prevent users outside the company intranet from launching this application. To use this option, you must also specify which IP addresses are considered as your intranet by specifying the Corporate IP range in Settings > Corporate IP Range. Require Strong Authentication: Select this option to force users to authenticate using additional, stronger authentication mechanisms when launching an application. Specify these mechanisms in Policy > Add Policy Set > Account Security Policies > Authentication. You can also include JavaScript code to identify specific circumstances when you want to block an application or you want to require additional authentication methods. For details, see Application access policies with JavaScript. 12 On the Account Mapping page, configure how the login information is mapped to the application s user accounts. The options are as follows: Use the following Directory Service field to supply the user name: Use this option if the user accounts are based on user attributes. For example, specify an Active Directory field such as mail or userprincipalname or a similar field from the Samsung SDS EMM user service. Everybody shares a single user name: Use this option if you want to share access to an account but not share the user name and password. For example, some people share an application developer account. Use Account Mapping Script: You can customize the user account mapping here by supplying a custom JavaScript script. For example, you could use the following line as a script: Chapter

7 For more information about Intacct LoginUser.Username = LoginUser.Get('mail')+'.ad'; The above script instructs the cloud service to set the login user name to the user s mail attribute value in Active Directory and add.ad to the end. So, if the user s mail attribute value is Adele.Darwin@acme.com then the cloud service uses Adele.Darwin@acme.com.ad. For more information about writing a script to map user accounts, see the SAML application scripting. 13 (Optional) On the Advanced page, you can edit the script that generates the SAML assertion, if needed. In most cases, you don t need to edit this script. For more information, see the SAML application scripting. 14 (Optional) On the Changelog page, you can see recent changes that have been made to the application settings, by date, user, and the type of change that was made. 15 (Optional) Click Workflow to set up a request and approval work flow for this application. The Workflow feature is a premium feature and is available only in the Samsung SDS EMM User Suite App+ Edition. See Configuring Workflow for more information. 16 Click Save. After configuring the application settings (including the role assignment) and the application s web site, you re ready for users to launch the application from the user portal. For more information about Intacct For more information about configuring Intacct for SSO, see: developer.intacct.com/node/3101 Cloud Manager user s guide 716

8 For more information about Intacct Chapter