Configuring Microsoft Entra as an identity provider

You can use Microsoft Entra as an identity provider to access SC//Nexus™. To do this, you create an enterprise application in the Microsoft Entra admin center.

SC//Nexus service provider details

SC//Nexus publishes the following service provider details for your identity provider. The steps on this page show which of them Microsoft Entra uses and where to enter them.

Considerations

The following should be considered when using Microsoft Entra as an identity provider for SC//Nexus.

• The Microsoft Entra application has an optional Sign on URL field, and SC//Nexus behaves differently depending on whether you set it.
  • If you specify https://nexus.scalecomputing.com/ for Sign on URL, then accessing SC//Nexus directly redirects you to your Microsoft Entra application, and access is granted according to your Entra application settings.
  • If you leave Sign on URL empty, then you can reach SC//Nexus only from the Entra application. Accessing SC//Nexus directly prompts you for a username and password instead.

Create the Microsoft Entra app integration

The Microsoft documentation provides the steps for creating an enterprise application for SAML integration from the Microsoft Entra SAML Toolkit gallery app. For more information, see Configure Microsoft Entra SAML Toolkit for single sign-on in the Microsoft documentation.

Prerequisites

The Microsoft Entra enterprise application lets you upload a service provider metadata file to assist with the integration. Download the SC//Nexus metadata XML before creating your Entra application, by retrieving the following URL and saving the response as a file.

https://nexus.scalecomputing.com/api/v1/saml/metadata

Creating the Microsoft Entra enterprise application

1. Access and sign in to the Microsoft Entra admin center.
2. In the left navigation, under Entra ID, choose Enterprise apps.
3. On the Enterprise applications | All applications page, choose + New application.
4. On the Browse Microsoft Entra App Gallery page, in the search box, type Microsoft Entra SAML Toolkit.
5. Select the Microsoft Entra SAML Toolkit tile. In the Microsoft Entra SAML Toolkit pane that opens, do the following.
   1. For Name, replace the default name, Microsoft Entra SAML Toolkit, with a name for the application. We suggest SC//Nexus.
   2. Choose Create. Wait a few seconds while the app is added to your tenant.
6. Once the new application is created, on the Overview page, choose Set up single sign on.
7. On the Single sign-on page, choose SAML.
8. On the SAML-based Sign-on page, do the following.
   1. Choose Upload metadata file.
   2. On the Upload metadata file pop-up, choose the file browser, locate the SC//Nexus metadata XML file you saved earlier, and choose Add. This populates the basic SAML configuration, setting the identifier to https://saml.stargate.local and the reply URL to https://nexus.scalecomputing.com/sso/api/oauth/saml.
   3. For Sign on URL (Optional), specify https://nexus.scalecomputing.com/.
   4. Choose Save, then close the pop-up window to view the application settings.
   5. Verify that all of the settings are correct.
9. On the SAML-based Sign-on page, under Attributes & Claims, choose Edit.
   1. Under Required claim, select the Unique User Identifier (Name ID) line. For Source attribute, select the user.mail attribute and then choose Save.
   2. Under Additional claims, keep only user.mail. Use the three dots to select and delete the other claims.

Retrieve the identity provider metadata

Once your Microsoft Entra enterprise application exists, retrieve the identity provider metadata to complete the setup.

1. In the Microsoft Entra admin console, access the settings for the SC//Nexus application you created.
2. On the SAML-based Sign-on page, under SAML Certificates, select and download the Federation Metadata XML file.
3. Provide the Federation Metadata XML file to your Scale Computing account manager or Support, who adds it to your SC//Nexus organization.

Verify the user's email address

SC//Nexus identifies each user by the email address that Microsoft Entra sends in the user.mail claim. The same email address is used for the downstream applications that the user accesses through SC//Nexus, such as SC//Reliant Platform Manager and SC//AcuVigil™.

For each user who signs in to SC//Nexus through Microsoft Entra, the email address in Microsoft Entra must be the same as the email address on the user's SC//Nexus account and on the user's account in each downstream application they want to access. If the addresses don't match, the user can't sign in or can't access the application.

To verify a user's email address in Microsoft Entra, do the following.

1. Sign in to the Microsoft Entra admin center as at least a User Administrator.
2. In the left navigation, under Entra ID, choose Users.
3. Select the user.
4. On the Properties tab, under Contact information, check the Email value. This is the user.mail value that Microsoft Entra sends to SC//Nexus. Confirm that it matches, in all lowercase, the email address on the user's SC//Nexus account and downstream application accounts.
5. If Email is empty or doesn't match, select the pencil icon next to Contact information, enter the correct email address, and choose Save.

Troubleshooting SC//Nexus login issues when using Microsoft Entra

Issue: When logging in to SC//Nexus, I am prompted for a username and password

Resolution: This has a few possible causes. Your SC//Nexus organization may not have the Microsoft Entra identity provider configured. If the organization is configured correctly, check your Microsoft Entra enterprise application settings and ensure that Sign on URL is set to https://nexus.scalecomputing.com/. If Sign on URL is not specified, SC//Nexus access works when initiated from the Microsoft Entra application but not when SC//Nexus is accessed directly.