Setup SSO with Entra ID (Azure AD)

Service Provider (SP) Initiated SAML Authentication Flow

SqlDBM offers Service Provider (SP) Initiated SAML Authentication for a variety of Identity Providers (IdPs). The diagram below illustrates the request workflow.

SSO Setup Steps

1. Before configuring anything in Azure, reach out to SqlDBM to get your Company Identifier. This value is going to be needed in Step 4.2.2

   Open a support ticket with SqlDBM and request SSO setup.

   1. Navigate to https://support.sqldbm.com/hc/en-us/requests/new (log in if not already, before continuing)
   2. Select Account SSO: Enablement Request from the request type dropdown 
      1. 
   3. Fill out the following fields:
      1. Subject: Enable SSO
      2. IdP Admin Email: Provide the primary IdP Admin's email address
      3. Description: Requesting Company Identifier to enable SSO
   4. Submit the form

2. Create Application in Azure Active Directory

   1. Navigate to the Azure Active Directory portal

   2. Go to ‘Enterprise applications’ → ‘New application’ → ‘Create your own application’

   3. Name the application (we recommend a name that reflects “SqlDBM”)

   4. Select “Integrate any other application you don’t find in the gallery”

3. Assign Application to Users

   1. Assign the app to Azure AD users, ensuring the admin account for your subscription is included

4. Set up SAML

   1. In the app settings, go to "Set up single sign-on" and choose "SAML".

   2. Configure the following

      1. Basic SAML Configuration

         1. Identifier (Entity ID): https://idp.sqldbm.com

         2. Reply URL: https://idp.sqldbm.com/saml/metadata/<company identifier>/Acs

         3. Sign on URL: leave blank

         4. Relay state: leave blank

         5. Logout Url: leave blank

             

            

5. Setup Claims:

   1. Email

      1. This should correspond to the user’s email address

      2. Claim type should match the following (case sensitive):

         1. http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress

Submit a Request to Enable SSO

Once your team has completed the setup steps mentioned above, please proceed update your previously created support ticket and provide the following information

• App Federation Metadata Url

What to expect once you have submitted a ticket:

• The support team will review the information shared

• Once the information is verified, your SSO will be enabled and we'll check that it properly redirects to your IdP and notify you on your ticket

• Please verify that logging in is successful and let us know

After Enabling SSO

For new users

1. Accept the invitation to join your organization by clicking the link in your invitation email, sent by your Admin via the Admin Console

2. Enter your email

3. Enter the verification code sent to your email to confirm SSO association

4. Visit your subscription page to confirm that you accepted the invitation

5. Your account will now be linked to the subscription

For existing subscription users

1. Log in using SSO by selecting the appropriate IdP from the options provided, or proceed directly to the SQLDBM private SSO sign-in page

    

   

2. Enter your email

3. Enter the verification code sent to your email to confirm SSO association

To access SSO, use the icons on the Sign-In page. If your provider isn’t listed, click the three dots to find the correct IdP.