Overview

Using Azure AD as an Identity Provider, administrators can allow users to sign in directly to Managed Services Center.

Keep the following information handy
ACS URL (Reply URL): https://login.druva.com/api/commonlogin/mspsamlconsume
Audience URI (Entity ID):MSC-login

Procedure

Step 1: Create your own application in Azure

Launch Azure and go to the Azure Active directory.
Go to the Enterprise applications section, and then click new application.
Click the create your own application button. This opens a new screen to create a new application
Name the application, and then select Integrate any other application you don't find in the gallery (non-gallery) option.
Click the Create button.

Step 2: Edit basic SAML configuration

Go to the Manage section, and then click Single Sign-on.
Select the Single Sign-on method as SAML. This opens a set-up Single Sign-on with SAML screen.
In the basic SAML configuration section, click the Edit button and update the following details:
- Identifier (Entity ID):MSC-login
- Reply URL (ACS URL): https://login.druva.com/api/commonlogin/mspsamlconsume
Click the Save button, and then close the basic SAML configuration screen.

Step 3: Edit attributes and claims

In the Attributes & Claim section, click the Edit button.
Ensure the Unique User Identifier (Name ID) under the required claim is mapped with User Principal Name (UPN) or email address.
Note:This value should match the email address used for MSC Administrators.
Click the Add new claim button, and when the manage claim screen opens, update the following details:
- Name:druva_auth_token
- Source attribute:Paste SSO token generated in MSC
Note:To generate the SSO token, Sign in to Managed Services Center > Settings > Access Settings > Generate SSO Token.
Click the Save button, and then close the Attributes & Claim screen.

Step 4: Get IdP login URL and IdP certificate

In the SAML Certificates section, download the Certificate (Base64).
Open the certificate in the text editor and copy the text.
Paste the certificate text in Managed Services Center while configuring SSO settings.
Copy the Login URL from the Set up <app name> section.
Navigate to Managed Services Center and paste the IdP login URL while configuring the SSO settings.

Step 5: Manage users

Go to the Manage section, and then click Users and group.
Click the Add users/group button, and then select users to assign the application.
Click the Assign button.

(Optional) SAML Authentication requests and encrypt assertions

The AuthnRequests Signed and Encrypt assertions are optional settings in Managed Services Center. If you want to add more security to your SSO, you can enable these settings.

Procedure

Step 1: Enable AuthnRequests Signed or Encrypt Assertions setting

Sign in to Managed Services Center.
Go to Settings > Access Settings.
In the Single Sign-on section, click Configure SSO (if this is your first time configuring SSO) or click Edit to modify existing settings. This will open the Single Sign-on Settings window.
In the ID Provider Configuration section, select the checkbox for AuthnRequests Signed or Encrypt Assertions.
Click the Save button to complete the action.

Step 2: Save the SSO SAML certificate

To save SAML certificate, follow the given steps:

Visit https://login.druva.com/login.
Click the Security icon (Padlock or Tune icon) in the browser address bar.
Select Connection is secure, then click Certificate is valid.
In the Details tab, click Export and save the file with a .cer extension.

❗ Important

This certificate will be the same for both AuthnRequests Signed and Encrypt Assertions.

Step 3: Upload SSO SAML Certificate to IdP

If Encrypt Assertions is enabled in Managed Services Center

Copy the SSO SAML Druva certificate provided above and save it in a .cer format.
Navigate to the Azure Application, and then go to S ecurity > Token Encryption.
Click Import Certificate, and then select the Druva certificate that you saved in .cer format.
Click Add, and then Activate token encryption certificate from the three-dot menu. Token encryption is enabled message appears.
Navigate to Manage > Single sign-on > SAML Certificates, and then click Edit.
Select either the Sign SAML response and assertion or the Sign SAML response sign-in option from the drop-down.
Click Save to update the sign-in properties.