Configuring External Authentication

Documentation

Getting Started

Global Functions

Lucanet Lume

Administration

User Management

Managing the CFO Solution Platform

Managing Lucanet Licenses

Configuring External Authentication

Configuring Lucanet OIDC Authentication with Microsoft Entra ID/Azure

Configuring Lucanet SAML Single Sign-On with Microsoft Entra ID/Azure

Generating and Downloading SEA Certificates

Configuring Customizations

Exchange Rate Management

Data Hub

Consolidation & Financial Planning

Lease Accounting

Extended Planning & Analysis (xP&A)

ESG Reporting

Disclosure Management

XBRL Tagger

Tax Compliance & Reporting

Banking & Cash Management

Data Collection

Glossary

In the External authentication workspace of the Lucanet CFO Solution Platform, you can activate or deactivate an external identity provider. This means that a password no longer needs to be maintained separately for accessing the CFO Solution Platform.

External authentication using OIDC (OpenID Connect) and SAML (Security Assertion Markup Language) is possible for the Lucanet CFO Solution Platform, with identity providers such as Microsoft Entra ID, Okta, or a custom provider.

To activate external authentication for the Lucanet CFO Solution Platform:

Click Administration.

Open the External authentication workspace in Platform management:

Shows the 'External authentication' workspace in the Platform management area. — Open 'External authentication' workspace

Activate the Activate external authentication check box.

Under Please choose the authentication procedure, select the combination of authentication protocol and identity provider that matches your setup:

Shows the authentication-procedure menu with the OIDC and SAML options for Entra, Okta, and Custom. — 'Please choose the authentication procedure' menu

The configuration form then displays the fields and provider-specific hints for your selection.

Configure the displayed fields:

OIDC

(see

Configuring OIDC

)

SAML

(see

Configuring SAML

)

Click Apply to save your configuration.

The options you configure depend on the authentication protocol and identity provider you selected. Hover over the info icon next to a field to see provider-specific guidance.

If you selected an OIDC combination, the following options are displayed:

External authentication with the options to configure 'OIDC' for Microsoft Entra ID, including the Issuer URL validation. — Options for the configuration of 'OIDC'

To configure external authentication with OIDC:

Option	Description
Client ID	Enter the OIDC Client ID. Note: The client can be represented by different concepts in different identity providers, for example: • App registration (Microsoft Entra ID) • OIDC app integration (Okta)
Client secret	Enter the secret for the OIDC client. Note: For security reasons, the full client secret cannot be displayed after activation.
Issuer URL	The base address from which your identity provider's well-known OIDC metadata endpoints (including the OIDC configuration and the JSON Web Key Set) are exposed. The required format depends on your identity provider: • Microsoft Entra ID: https://sts.windows.net/{tenant-id}/ • Okta: https://{your-okta-domain}/oauth2/default Note: The Issuer URL is validated in real time. If the value does not match the expected format for the selected identity provider, a validation message is displayed and you cannot save until you correct it. For a Custom provider, no provider-specific format is enforced.
Authorized scopes	The authorized scopes represent the level of access to your users' profiles that is requested by the Lucanet CFO Solution Platform. This must be configured correctly in the OIDC client. Copy the authorized scopes displayed and paste them into the configuration of your OIDC client.
Sign-in redirect URL(s)	The sign-in redirect URL is the address to which users are redirected after authentication with your identity provider. It must be configured in the OIDC client. Copy the displayed sign-in redirect URL and paste it into the configuration of your OIDC client.

For more information on configuration steps in Microsoft Entra ID/Azure, see Configuring Lucanet OIDC Authentication with Microsoft Entra ID/Azure.

If you selected a SAML combination, the following options are displayed:

External authentication with the options to configure 'SAML' for Microsoft Entra ID. — Options for the configuration of 'SAML'

To configure external authentication with SAML:

Option	Description
Metadata document URL	The metadata document URL is the address via which the SAML configuration document is accessible. Enter the metadata document URL for the SAML implementation of your identity provider. Note: Each identity provider uses a different format for the metadata URL, for example: • Microsoft Entra ID: https://login.microsoftonline.com/{tenant-id}/ FederationMetadata/2007-06/FederationMetadata.xml?appid=xxxxxx • Okta: https://{your-okta-domain}/app/{app-instance-id}/sso/saml/metadata
Attribute	• The name of the e-mail attribute sent by your identity provider to the Lucanet CFO Solution Platform. • The canonical name is: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress, which is pre-filled by default.
Reply URL	• The URL where the SAML response is sent by your identity provider. It must be configured in the SAML integration that represents the Service Provider of the Lucanet CFO Solution Platform to your identity provider. • The reply URL is also known as the Assertion Consumer Service (ACS) URL or Single Sign-On URL. Note: The SAML integration can be represented by various concepts in different identity providers, for example: • App registration (Microsoft Entra ID) • SAML app integration (Okta) Copy the displayed reply URL and paste it into your SAML integration.
Entity ID	The unique identifier for the Lucanet CFO Solution Platform Service Provider. It must be configured in the SAML integration that represents the Lucanet CFO Solution Platform to your identity provider. This is also known as the Audience URI. Copy the displayed entity ID and paste it into the SAML configuration of your service provider.

Keep your SAML signing certificate valid. Lucanet reads the SAML signing certificate from the metadata document URL you configured. Before that certificate expires, Lucanet sends you a reminder e-mail. Renew or rotate the certificate at your identity provider in good time and make sure the metadata document served at your URL contains the new certificate before the current one expires. Otherwise, users may be unable to sign in with SAML.

For more information on configuration steps in Microsoft Entra ID/Azure, see Configuring Lucanet SAML Single Sign-On with Microsoft Entra ID/Azure.

In order to use external authentication of users, it must be activated in a further step in the properties of the desired user.

To do this, navigate to the User workspace and edit the properties of the users who are to log in to the Lucanet CFO Solution Platform using external authentication. For additional information see Creating and Editing Users for the Lucanet CFO Solution Platform.

When you activate external authentication for a user, the user receives an invitation e-mail with a Log In button that links directly to the login page.

In the Global authentication settings section of the External authentication workspace, you can define how the users of the Lucanet CFO Solution Platform authenticate.

The section is displayed as follows:

The 'Global authentication settings' section with the deactivated settings 'External authentication by default' and 'Enforce external authentication'. — 'Global authentication settings' section

The following options are available:

Option	Description
External authentication by default	Preselects External authentication as the authentication method when you create a user, so the user does not receive Lucanet login credentials. If a user should log in with a user name and password instead, deactivate External authentication when you create the user. The setting does not affect existing users. You can still change the authentication method of existing users.
Enforce external authentication	Requires all users to use external authentication. The Lucanet CFO Solution Platform automatically converts all existing users who log in with a user name and password. For more information, see Enforced External Authentication.

Only one of the two settings can be activated at a time. Both settings require external authentication to be activated and configured successfully.

To activate or deactivate one of the settings:

Open the External authentication workspace in Platform management.

In the Global authentication settings section, activate or deactivate the required setting.

A dialog is displayed that describes the consequences of the change.

Confirm the change.

If external authentication is enforced, the following applies:

The Lucanet CFO Solution Platform converts all existing users who log in with a user name and password to external authentication and sends them the invitation e-mail for external authentication. These users can then only log in through your identity provider.

Users who already use external authentication remain unchanged.

A locked user is only converted once you unlock the user.

When you create a user,

External authentication

is preselected as the authentication method and cannot be changed.

The

TOTP MFA (authenticator app code)

authentication method cannot be activated or deactivated. For more information, see

Creating and Editing Users for the Lucanet CFO Solution Platform | Authentication Methods

Make sure that external authentication works correctly before you enforce it. Otherwise, users may no longer be able to log in.

The conversion runs in the background. Users who are logged in at that time are not signed out. While the conversion is running, you cannot change the global authentication settings or deactivate external authentication.

If the conversion fails, the Lucanet CFO Solution Platform deactivates the Enforce external authentication setting again and resets all converted users to their previous authentication method.

The Enforce external authentication setting cannot be deactivated directly. To end the enforcement, deactivate external authentication. The options in the Global authentication settings section are deactivated in the process. You can then activate external authentication again if required.

If you deactivate external authentication while it is enforced, the Lucanet CFO Solution Platform switches all users to logging in with a user name and password: every user receives a new invitation e-mail with a temporary password and can no longer log in through your identity provider.