Last updated on 2025-11-21
If you use Azure/Microsoft Entra ID as your identity provider and choose the SAML method for external authentication of the Lucanet CFO Solution Platform, you must first register Lucanet as an enterprise application in the Azure Portal/Microsoft Entra ID Admin Center.
After completing the registration and configuration in Azure Portal/Microsoft Entra ID, you can copy the authentication parameters from Azure/Microsoft Entra ID and paste them into the Lucanet CFO Solution Platform to complete the configuration of external authentication.
To create an Enterprise application for Lucanet in Azure/Microsoft Entra ID:
Open the Azure Portal or the Microsoft Entra Admin Center at https://entra.microsoft.com.
Navigate to Enterprise applications. Click + New application.
On the displayed page Browse Microsoft Entra Gallery, click Create your own application.
Enter a name for the application (e.g., Lucanet CFO Platform Authentication SAML 2) and choose Integrate any other application you don't find in the gallery (Non-gallery).
Click Create.
We recommend setting Assignment required to No in the Properties to simplify the configuration and reduce administrative effort. This allows all users in your Microsoft Entra ID organization to access the application automatically, without the need to manually assign individual users or groups.
However, if your organization requires stricter access control for security or compliance reasons, you can keep the setting at Yes.
To configure user assignment:
In the created enterprise application, navigate to Manage | Properties.
Set the Assignment required toggle based on your requirements:
Click Save.
Go to the newly created enterprise application and perform the following steps to configure Single Sign-On for Lucanet in Azure/Microsoft Entra ID:
Navigate to Manage | Single sign-on.
Select SAML as the single sign-on method.
The options for the Basic SAML Configuration are displayed as followed:
Copy the Entity ID from the External authentication workspace in the Lucanet CFO Solution Platform.
'External authentication' workspace in Lucanet
In the Basic SAML Configuration area in the Azure Portal, click Add identifier under Identifier (Entity ID).
Paste the Entity ID copied from Lucanet into the corresponding field.
Copy the Reply URL from the External authentication workspace in the Lucanet CFO Solution Platform.
'External authentication' workspace in Lucanet
In the Basic SAML Configuration area in the Azure Portal, click Add reply URL under Reply URL (Assertion Consumer Service URL).
Paste the Reply URL copied from Lucanet into the corresponding field.
Click Save.
After configuring the enterprise application and Single Sign-On in Azure/Microsoft Entra ID, you need to retrieve specific authentication parameters and add them to the Lucanet CFO Solution Platform to complete the external authentication setup.
To configure authentication parameters for the Lucanet CFO Solution Platform:
Get the App Federation Metadata Url from Azure Portal/Microsoft Entra ID:
In the Enterprise application for Lucanet, navigate to Manage | Single sign-on | Set up Single Sign-on with SAML. In the SAML Certificates area, copy the App Federation Metadata Url.
Add the App Federation Metadata Url to the Lucanet CFO Solution Platform:
In the Lucanet CFO Solution Platform, navigate to the External authentication workspace.
'External authentication' workspace in Lucanet
Paste the App Federation Metadata Url into the Metadata document URL field.
Get the Attribute value from Azure Portal/Entra ID Admin Center:
In the Enterprise application for Lucanet, navigate to Manage | Single sign-on | Set up Single Sign-on with SAML.
In the Attributes & Claims area, click Edit. The Attributes & Claims page will be displayed as followed, for example:
In the Additional claims area, click the row with the value user.mail. The Manage claim page will be displayed as followed, for example:
Copy the Namespace field value and the Name field value. Combine them to create the Attribute value using the following structure:
Namespace + / + Name
Example in the screenshot above:
Add the Attribute value to the Lucanet CFO Solution Platform:
In the Lucanet CFO Solution Platform, navigate to the External authentication workspace.
'External authentication' workspace in Lucanet
Paste the Attribute value into the Attribute field.
Attention: The e-mail address of a user on the Lucanet CFO Solution Platform must be identical to the e-mail address in Azure/MS Entra ID. The upper and lower case of e-mail addresses must match exactly.
You can find additional information on how to use the parameters when configuring the external authentication for the Lucanet CFO Solution Platform with the OIDC method in the section Configuring SAML in Configuring External Authentication.