How to Configure SAML 2.0 SSO with Microsoft Entra ID for the GFoundry Platform
The information GFoundry and your IT team exchange, and the steps in Microsoft Entra ID, to let users sign in to GFoundry with their company account through SAML 2.0.
What does GFoundry provide (Service Provider details)?
GFoundry is the Service Provider (SP). The GFoundry team defines and sends you these values for your platform:
Entity ID: provided by GFoundry.
Assertion Consumer Service (ACS) URL: provided by GFoundry.
Single Logout Service (SLS) URL: provided by GFoundry.
NameID Format: urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress
What information does GFoundry need from your Identity Provider (Entra ID)?
Entity ID: your Identity Provider's unique identifier.
SSO URL (Login URL): the authentication URL of your Identity Provider.
X.509 Certificate: the signing certificate, in PEM text format.
Which attributes must the SAML assertion include?
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress: the user's email (unique). If this claim is missing, GFoundry uses the NameID as the email, so the NameID must be the user's email address.
GFoundry uses the email in the assertion to find the person's GFoundry account, so it must be the same email the user has in GFoundry. If there is no account with that email, GFoundry tries to create one with the email, first name and last name from the assertion, following your platform's sign-up rules.
How do I configure the application in Microsoft Entra ID?
Open the Entra portal: https://entra.microsoft.com
Go to Enterprise Applications > New Application.
Select Create your own application.
Name: the name provided by GFoundry.
Choose Integrate any other application you don't find in the gallery.
Go to Single Sign-On and choose SAML.
Which values do I fill in?
Identifier (Entity ID): the Entity ID provided by GFoundry.
Reply URL (ACS URL): the ACS URL provided by GFoundry.
Logout URL (optional): the SLS URL provided by GFoundry.
Name ID format: EmailAddress.
In Attributes & Claims, configure the three attributes listed above.
Then send GFoundry the Entity ID, the Login URL and the X.509 certificate of the application you created.
How do I test and validate the configuration?
Test the login from the GFoundry sign-in page.
Check that the attributes in the SAML assertion carry the expected values.
Confirm that both login and logout work.
Who can help?
If you have any questions, contact the GFoundry Technical Team.