4

SSO

Last Update hace 14 horas

Single Sign-On (SSO) Overview Set Up SSO with Google Workspace Set Up SSO with Microsoft Entra ID Set Up SSO with Okta

Set Up SSO with Microsoft Entra ID

Connect Microsoft Entra ID (Azure AD) to BounceBan with SAML 2.0 or OpenID Connect, with optional SCIM provisioning and team roles from Entra groups.

Gavin

Last Update hace 14 horas

This guide shows how to connect Microsoft Entra ID (formerly Azure Active Directory) to BounceBan. For how SSO works in BounceBan, see the Single Sign-On (SSO) overview.
You can use SAML 2.0 (an enterprise application) or OpenID Connect (an app registration). SAML also gives you sign-in from My Apps and SCIM provisioning from the same enterprise application, so we recommend SAML.
Before you start
  • SSO must be turned on for your BounceBan team (contact your account manager or [email protected]).
  • You need to be the BounceBan team owner or a team admin, and have an Entra role that can manage enterprise applications (for example Cloud Application Administrator).
  • Open your BounceBan SSO page: https://bounceban.com/app/account/sso.
  • Verify your email domain in step 1 of the SSO page first (see the overview).
  • People's email addresses (the Entra mail attribute) must be on your verified domains.
Option A: SAML 2.0 (enterprise application)
1. Create the enterprise application
  1. In the Microsoft Entra admin center, go to Enterprise applications and click New application.
  2. Click Create your own application, enter a name (for example "BounceBan"), choose Integrate any other application you don't find in the gallery (Non-gallery), and click Create.
  3. Under Users and groups, assign the people or groups who should use BounceBan.
2. Set up single sign-on
  1. In the application, go to Single sign-on and choose SAML.
  2. Under Basic SAML Configuration, click Edit. On the BounceBan SSO page, in step 2, choose SAML 2.0 and copy:
    • Identifier (Entity ID): BounceBan's Entity ID (Audience URI)
    • Reply URL (Assertion Consumer Service URL): BounceBan's ACS URL (Reply URL)
    • Sign on URL (optional): BounceBan's Sign-on URL (optional)

    Save. The BounceBan values look like https://bounceban.com/sso/saml/
  3. Under Attributes & Claims, keep the default email address claim (user.mail). BounceBan uses the first email address in the response that is on one of your verified domains, from the Name ID or the email claim. Entra's default Name ID is the user principal name (UPN). If your UPNs aren't on a verified domain (for example [email protected]), that's fine as long as the email claim is. You can also set Unique User Identifier (Name ID) to user.mail.
3. Copy Entra's settings into BounceBan
  1. Under SAML Certificates, copy the App Federation Metadata Url.
  2. On the BounceBan SSO page, paste it in IdP metadata URL (optional) and click Load. This fills in the IdP Entity ID (Issuer), IdP SSO URL (Login URL) and Signing certificates.
  3. Click Save.
Using the metadata URL also lets BounceBan pick up Entra's new signing certificates automatically (it checks the URL every day).
If you prefer to enter them by hand: Microsoft Entra Identifier → IdP Entity ID (Issuer), Login URL → IdP SSO URL (Login URL), and download Certificate (Base64) and paste it into Signing certificates.
4. Optional: sign in from My Apps
To let people open BounceBan from My Apps (myapps.microsoft.com), either set the Sign on URL in Entra, or turn on Allow sign-in from the identity provider's app dashboard (IdP-initiated) in step 3 of the SSO page.
Option B: OpenID Connect (app registration)
  1. In the Microsoft Entra admin center, go to App registrations and click New registration.
  2. Enter a name, choose who can use it (usually Accounts in this organizational directory only), and under Redirect URI choose Web and paste the Redirect URI from the BounceBan SSO page (step 2, OpenID Connect). Click Register.
  3. Go to Certificates & secrets > New client secret, add a secret, and copy its Value right away.
  4. On the BounceBan SSO page, fill in:
    • Issuer URL: https://login.microsoftonline.com/Directory (tenant) ID from the app's Overview.
    • Client ID: the Application (client) ID.
    • Client secret: the secret Value.
  5. Click Save.
  6. In the app registration, go to Token configuration > Add optional claim, choose ID, and add email.
BounceBan requests the scopes openid email profile and uses the email claim, or preferred_username (the UPN) if it is an email address on a verified domain.
Client secrets in Entra expire. Before yours expires, create a new one and save it on the SSO page. Changing the client secret turns SSO sign-in off until you test the connection again.
Test and turn on SSO sign-in
  1. In step 3 of the BounceBan SSO page, click Test connection and sign in with your own Entra account (for SAML, it must be assigned to the application).
  2. Check the result: it should show an email address on your verified domain.
  3. Turn on Turn on SSO sign-in.
People can now sign in at https://bounceban.com/account/sso with their work email.
Optional: team roles from Entra groups
  1. Add a group claim:
    • SAML: in the enterprise application, Single sign-on > Attributes & Claims > Add a group claim.
    • OpenID Connect: in the app registration, Token configuration > Add groups claim, and include it in the ID token.
  2. Choose Groups assigned to the application, so Entra sends only the groups that matter for BounceBan. Assign those groups to the application under Users and groups in the enterprise application.
  3. Keep the source attribute as Group ID. Entra sends group Object IDs, not names.
  4. In step 5 of the BounceBan SSO page:
    • Groups attribute or claim: for SAML, enter http://schemas.microsoft.com/ws/2008/06/identity/claims/groups (Entra's default attribute name), unless you renamed it. For OpenID Connect, keep groups.
    • Admin groups: enter the Object IDs of the Entra groups whose members should be BounceBan team admins, one per line (up to 20).
  5. Click Test connection in step 3 to check the groups Entra sends and the role you'd get, then turn on Set team roles from these groups and click Save.
Roles are updated each time someone signs in with SSO. People in none of the admin groups become members. The team owner's role doesn't change.
If a person is in too many groups, Entra sends a link to look up the groups instead of the groups themselves. BounceBan doesn't follow that link and signs the person in as a member. Choosing Groups assigned to the application avoids this.
Optional: SCIM provisioning
With SCIM, Entra creates BounceBan accounts for people assigned to the enterprise application, updates them, and deactivates them when they are unassigned or disabled. Set this up in the same enterprise application you use for SAML (for OpenID Connect, use the enterprise application Entra created for your app registration).
  1. In step 4 of the BounceBan SSO page, click Generate token and copy it. You won't be able to see it again.
  2. In the enterprise application, go to Provisioning and set Provisioning Mode to Automatic.
  3. Under Admin Credentials:
    • Tenant URL: the SCIM base URL (Tenant URL) from BounceBan (https://bounceban.com/scim/v2).
    • Secret Token: the token.

    Click Test Connection, then Save.
  4. Under Mappings:
    • Provision Microsoft Entra ID Groups: set Enabled to No. BounceBan doesn't support group provisioning.
    • Provision Microsoft Entra ID Users: map userName to the user's mail attribute.
  5. Set Scope to Sync only assigned users and groups, turn Provisioning Status On, and save.
Only people with email addresses on your verified domains can be provisioned. When someone is unassigned or disabled in Entra, they can no longer sign in to BounceBan, their sessions end and all their API keys are replaced. Entra runs provisioning on a schedule, so changes can take a while to reach BounceBan.
Troubleshooting
"Your email address … is not on a domain verified for SSO."
Entra sent an address that isn't on your verified domains, for example a @yourcompany.onmicrosoft.com UPN and no mail value. Make sure the person's mail attribute is on a verified domain, or verify that domain.
The test says the SAML response could not be verified.
Check that the Identifier and Reply URL in Entra exactly match your BounceBan SSO page, and click Load again to refresh the certificate from the metadata URL. Then save and test again.
"The issuer URL doesn't match the issuer in its OpenID Connect configuration."
Use the v2.0 issuer with your tenant ID: https://login.microsoftonline.com/
The test shows the groups were not received because the person is in too many groups.
Change the group claim to Groups assigned to the application.
For more answers, see the SSO overview FAQ.

Was this article helpful?

0 out of 0 liked this article

Still need help? Message Us