Configuring Your Identity Provider

IntroADFSOKTAMicrosoft Entra ID

Intro

Many organizations can serve as your Identity Provider for SAML.

The following sections describe how to configure the following providers:

• ADFS

• OKTA

• Microsoft Entra ID

For customers in FedRAMP environments, the default Identity Provider (IdP) is Active Directory Federation Services (ADFS), provided and maintained by Microsoft Entra ID. If there is a need to use a third-party service as the IdP, such as Okta or OneLogin, please contact our Support Team for assistance.

No matter which Identity Provider you use, you should do the following:.

1. Set the Signature algorithm name for SAML to SHA256withRSA.

2. On your Identity Provider, configure the following Attribute Mappings(OneSpan Sign will use them to identify the user who is logging in):

   User	Attributes
   email	One of the following: email emailaddress mail
   first name	One of the following: firstname givenname cn
   last name	One of the following: lastname surname sn
   accountid	One of the following: account accountid accountId
   type	One of the following: role type userType

If you want to configure an Identity Provider only for "recipients" (not members of a OneSpan Sign account), specify only the parameter email. You don't need to specify a first name or last name .

If you need to import the required metadata into your keystore, see Updating your SAML Certificate and Metadata

SSO and Roles and Permissions

If Sender Auto Provisioning has been disabled a sender will automatically be activated upon logging in for the first time (assuming that their activation status is Pending, and not Locked). If Roles and Permissions have been enabled, then this feature works in the following scenarios:

• Pending user with no role

• Pending user with role

• Active user with no role

• Active user with role

ADFS

Microsoft's Active Directory Federation Services (ADFS) can serve as a SAML 2.0 Identity Provider for OneSpan Sign.

To configure ADFS to serve as a SAML Identity Provider for OneSpan Sign:

1. Start the ADFS 2.0 Management Console.

2. Open the Trust Relationships folder, and right-click Relying Party Trusts.
   

3. Select Add Relying Party Trust, and then Start.

4. In the Add Relying Party Trust wizard, select Import data about the relying party from a file.
   

5. Import the required metadata into your keystore. To download it, see Updating your SAML Certificate and Metadata.

6. Complete the wizard as necessary, entering your Display Name, and the Authorization Rules you want to use.

7. On the Advanced tab, change the Secure hash algorithm to SHA-256.

8. Create new Claims Rule for LDAP Attributes using the following template:
   

9. Edit the rule so your screen looks as follows:
   

10. Create another Claims Rule to Transform an Incoming Claim. This will add email to the Subject of the response as NameID.

    

11. This Claim Rule will reference the first Claim Rule. For this reason, the latter must remain Rule 1.

    

OKTA

OKTA can serve as a SAML Identity Provider for OneSpan Sign.

The following example configures OKTA as the Identity Provider for a OneSpan Sign US Sandbox instance.

To configure OKTA to serve as a SAML Identity Provider for OneSpan Sign:

1. Navigate to https://www.okta.com/developer/signup/, and create a free OKTA Developer Edition organization.

2. Log in to the Admin Console, and click Add Applications.

3. Click Create New App, and select SAML 2.0 as the Sign On Method.

4. In the General Settings section, enter an App name. Then click Next.

5. In the Configure SAML section, paste the following URL into the Single sign on URL fields, where <your environment> represents your OneSpan Sign environment:

   https://<your environment>/sso/saml/SSO/alias/e-signlive

   Environment	FQDN
   Canada Sandbox	sandbox.e-signlive.ca
   US2 Sandbox	sandbox.esignlive.com
   US1 Sandbox	sandbox.e-signlive.com
   Europe Production	apps.esignlive.eu
   Canada Production	apps.e-signlive.ca
   US2 Production	apps.esignlive.com
   US1 Production	apps.e-signlive.com
   Australia Production	apps.esignlive.com.au

   Keep the recipient URL and destination URL the same.

6. In the Audience Restriction field, enter the SP entity ID. For example: urn:saml:sso:<your environment>.

   Be sure to replace all periods in your environment address with a colon. For example, instead of urn:saml:sso:sandbox:esignlive.com, the SP entity ID should be be urn:saml:sso:sandbox:esignlive:com and not urn:saml:sso:sandbox:esignlive.com .

7. For the default relay state value, enter <your environment>/packages/inbox

8. Click Show Advanced Settings, and configure the settings in the following table:

   SETTING	VALUE
   Name ID format	EmailAddress
   Response	Signed
   Assertion Signature	Unsigned
   Signature Algorithm	RSA_SHA256
   Digest Algorithm	SHA256
   Assertion Encryption	Unencrypted
   SAML Single Logout	Disabled
   authContextClassRef	Unspecified
   Honor Force Authentication	No
   SAML Issuer ID	http://www.okta.com/${org.externalKey}

9. In the Attribute Statements section, add the following three attribute statements, and then click Next:

   Name	Name Format	Value
   email	URI Reference	user.email
   firstname	URI Reference	user.firstName
   lastname	URI Reference	user.lastName

10. In the Feedback section, select This is an internal application that we created. Then click Finish.

    You will now see the Sign On section of your newly created Example SAML Application. Keep this page open in a separate browser tab or window. You will need its Identity Providermetadata link when you perform the procedure Configuring SAML on Your eSignLive Account.

    To copy the Identity Provider metadata link, right-click it and select Copy.

11. Right-click the People section of the Name of your application, and select Open Link In New Tab (so you can come back to the Sign On section later).

12. In the new tab that opens, click the Assign Application button.

13. A dialog box called Assign name of Application to up to 500 people appears. Type your username in the search box, and select the check box next to your username. Then click Next.

14. You will be prompted to enter user-specific attributes. Click Confirm Assignments to keep the defaults.

    You are now ready to perform the procedure Configuring SAML on Your eSignLive Account. You will need the Identity Provider metadata link from Step 10.

Microsoft Entra ID

Microsoft recently renamed Microsoft Azure Active Directory to Microsoft Entra ID. References to Azure and Microsoft Entra ID may be used interchangeably. For more information, see New Name for Azure AD.

Azure AD can serve as a SAML Identity Provider for OneSpan Sign. For more information on this, see the Microsoft Azure documentation.

To configure Azure to work with OneSpan Sign, you must perform the following procedures:

1. Satisfying Prerequisites

2. Adding OneSpan Sign as an Application to Azure AD

3. Configuring Basic SAML Settings

4. Configuring User Attributes and Claims

5. Configuring Users & Permissions

6. Testing the SP Initiated SSO

Prerequisites

To get started, you need the following items:

• An Azure AD subscription

• A OneSpan Sign account, either Sandbox or Production

• The SAML Metadata that applies to your OneSpan Sign instance (e.g., sandbox.esignlive.com)

• If you plan to use SP Initiated SSO, you must download the Federation Metadata XML file.

To download the Federation Metadata XML file:

1. Sign in to the Azure portal as either a Cloud application admin, or as an application admin for your Azure AD tenant.

2. Click Azure Active Directory.

3. From the active directory, click Enterprise application, and then All Applications.

4. Find the Manage section, and select Single sign-on.

5. Select SAML.

6. On the Set up single sign-on with SAML page, navigate to the SAML Signing Certificate section.

7. Click the Federation Metadata Download link.

   

8. Contact our Support Team, so we can complete the configurations needed on our end.

Adding OneSpan Sign as an Application to Azure AD

The first step in configuring Azure as a SAML provider for OneSpan Sign is to add OneSpan Sign to the Azure AD application portal.

To add OneSpan Sign to the Azure AD portal:

1. Sign in to the Azure portal as either a Cloud application admin, or as an application admin for your Azure AD tenant.

2. Click Azure Active Directory.

3. Select Enterprise applications, and then click All Applications.
   

4. Click New application, and then choose Non-gallery application.
   

5. Enter a name for your application (e.g., OSS) , and then click Add.

Configuring Basic SAML Settings

Now you have added the app, you need to make some basic SAML configurations.

The settings you must configure will vary, depending on your OneSpan Sign instance, and on whether you will configure SSO to be IDP Initiated or SP Initiated.

To configure your SAML settings:

1. Sign in to the Azure portal as either a Cloud application admin, or as an application admin for your Azure AD tenant.

2. Click Azure Active Directory.

3. From the active directory, click Enterprise application, and then choose the app you just added (e.g., OSS).

4. Find the Manage section, and then select Single sign-on.

5. Select SAML.

6. On the Set up single sign-on with SAML page, click the edit icon in the Basic SAML Configuration section.

7. Enter the following information:

   • Identifier (Entity ID): The Entity ID can be copied from the SAML Metadata you downloaded earlier. To find the Entity ID, open the metadata file using a text editor such as Notepad, and search for Entity ID. Once found, copy and paste the entry into this field.

     Be sure to replace all periods in your environment address with a colon. For example, instead of urn:saml:sso:sandbox:esignlive.com, the SP entity ID should be be urn:saml:sso:sandbox:esignlive:com and not urn:saml:sso:sandbox:esignlive.com .

   • Reply URL: The reply URL is your SSO service URL. For example, https://<your instance>/sso/saml/SSO/alias/e-signlive.

   • Sign on URL: This field is necessary only if you will use SP Initiated SSO. If you are using IDP Initiated SSO, leave this field blank. if you will use SP Initiated SSO, enter the following: https://<server:port>/sso/saml/login/alias/e-signlive?idp=<EntityId of an IdP>,
     where:

     • <server:port> is the server port used by your OneSpan Sign instance. For example, https://sandbox.esignlive.com.

     • <EntityId of an IdP> is the Entity ID found in the Federation Metadata XML file you downloaded earlier. To find the Entity ID, open the metadata file using a text editor such as Notepad, and search for Entity ID. Once found, copy and paste the entry into this section of the URL.

8. If you are using SP Initiated SSO, contact our Support Team so we can complete the configurations that are needed on our end.

The following table contains more information about SAML's configuration settings:

Once completed, your Basic SAML Configuration should look something like this, with the values in each field representing values from your own site. For example, in the following image you must replace sandbox.esignlive.com with the domain name from your own SSO service URL:

Configuring User Attributes and Claims

Once your Basic SAML Settings have been configured, you can begin creating associations between a user and their attributes.

If you have more than one account with the same entity ID and you have auto-provisioning enabled, you will need to add the account ID as an attribute. If you do not, the user will not be created. To obtain the account ID, contact our Support Team.

To configure user attributes and claims:

1. Click Azure Active Directory.

2. From the active directory, click Enterprise application, and then choose the app you just added (e.g., OSS).

3. On the Set up single sign-on with SAML page, click the edit icon in the User Attributes section.

4. Delete any existing attributes that appear.

5. Click Add new claim.
   

6. In the Name box, type the attribute name.

7. Leave the Namespace field blank.

8. Add the following claims in the Source Attribute field, mapping the claim name and source attributes as follows:

   Name Options	Source Attribute
   firstname	user.givenname
   email	user.mail
   lastname	user.surname

   

9. Click Save.

Automatic Provisioning

If you have the same SAML configured in multiple accounts across the same instance, you will need to add an additional attribute to automatically provision new senders to a specific account. If you fail to do so, automatic provisioning will fail.

The name of the required attribute is accountid. It can be mapped to any Azure Ad attributes that have the destination account UID (for the list of your account UIDs, contact our Support Team).

• accountid: This claim should be mapped to an active directory attribute that contains the owner account's accountID.

• type: This claim should be mapped to an active directory attribute that is either a Regular value or a Manager value.

Configuring Users & Permissions

Now that you've defined some user attributes and claims, you can begin to assign users to the app.

To configure user permissions:

1. Click Azure Active Directory.

2. From the active directory, click Enterprise application, and then choose the app you just added (e.g., OSS).

3. Click Users and Groups.

4. Click Add user.

5. In the Add Assignment section, select Users and Groups.

6. Select the user or group you want to assign to use the application.
   

7. Click Select.

Testing the SP Initiated SSO

Now that you've finished your configurations, you can test to see that everything works.

To test the SP Initiated SSO:

1. Sign in to the Azure portal as either a Cloud application admin, or as an application admin for your Azure AD tenant.

2. Click Azure Active Directory.

3. From the active directory, click Enterprise application, and then choose the app you just added (e.g., OSS).

4. Find the Manage section, and then select Single sign-on.

5. In the Test Single Sign On section, click Test.

6. Click Sign in as current user.