SSO Single Sign-On: Setup in two steps

With the release of Survalyzer Next Generation it is easier than ever to configure Single Sign-On without the support of Survalyzer.

There are two preconditions that this self service based configuration is possible:

• Your Identity Provider is accessible over the Internet and supports SAML 2.0
• You purchased the Advanced Security Package (If you haven’t please contact Sales)

Step 1: Setup Survalyzer in your Identity Provider

The following illustrations are based on Microsoft Azure Active Directory. Therefore it could look different if you use another Identity Provider.

The important information to setup the identity provider are:

• EU Datacenter
  • Identifier: SurvalyzerEUServiceProvider
  • Reply Url: https://api.survalyzer-eu.app/api/Authentication/AssertionConsumerService
  • Relay State: https://{tenant}.survalyzer-eu.app/loginsso?tenant={tenant}&loginType=1
  • NameID: must contain E-Mail
• CH Datacenter
  • Identifier: SurvalyzerCHServiceProvider
  • Reply Url: https://api.survalyzer-swiss.app/api/Authentication/AssertionConsumerService
  • Relay State: https://{tenant}.survalyzer-swiss.app/loginsso?tenant={tenant}&loginType=1
  • NameID: must contain E-Mail

Then you need the following elements from your Identify Provider:

1. The Certificate (Base64)
2. The Login URL
3. The Azure AD Identifier
4. Logout URL

Step 2: Setup SSO in Survalyzer

In Survalyzer navigate to Account in the top right navigation, select the Account Administration tab and go to Single sign-on configuration. Then:

• Turn on the Single sign-on settings
• Enter the Entity Name (Azure AD Identifier of illustration above )
• Enter the Description ({Company} {IdentityProvider Name})
• Enter the Login service URL (Login URL of illustration above)
• Enter the Logout URL (Logout URL of illustration above)
• The base64 certificate that you downloaded needs to be adjusted as follows:

A. Open the certificate file in Notepad:

B. The file should only contain the content between —–BEGIN CERTIFICATE—– and —–END CERTIFICATE—–, meaning that the content always starts with MII.

This means you remove the content highlighted in red:

C. When the file content looks like the example below (starting with MII), you save the file and upload it as Primary certificate:

• The secondary certificate is for expiring scenarios to be independent of a specific time to exchange the certificate. For now this should be left empty.
• Save Settings
• Logoff

By navigating to the base Url (https://{tenant}.survalyzer-eu.app for EU or https://{tenant}.survalyzer-swiss.app for CH) the newly configured SSO applies.

Certificate renewal

You should have an internal process in place that ensures that you renew the certificate before it expires. Survalyzer will also inform the account admins when the expiration date is almost reached.

When the new base64 certificate file has been generated and adjusted (See steps A, B & C above to ensure that the file only contains the content between —–BEGIN CERTIFICATE—– and —–END CERTIFICATE—–, meaning that the content always starts with MII.) the old certificate file can be removed by clicking on the bin icon:

Directly after that, the new certificate file can be uploaded. Please note that if no certificate file is present and Single Sign On is enabled, users will not be able to log in.

Request signing

It is possible to enable the ‘Request Signing’ option in Survalyzer. When this is enabled, Survalyzer signs SSO login requests using a digital signature to enhance security:

As a client, you follow these steps:

1. Generating a CSR (Certificate Signing Request) using a certificate authority.
2. Obtaining a signing certificate based on that CSR.
3. Exporting the certificate and private key as a .pfx file (PKCS#12 format).
4. Uploading the .pfx file in Survalyzer’s SSO settings.
5. Entering the password used to protect the .pfx file in the Request signing password field.