Bright supports the following provisioning attribute mappings:

• userPrincipleName
• Switch([IsSoftDeleted], , "False", "True", "True", "False")
• givenName
• surname
• mail
• displayName

Prerequisites

• You have a valid organization API key with the scim scope.
  *The user profile email is specified in Azure.

Step-by-step guide

Step 1. Create an application for SSO integration in Azure

To enable Bright SSO with AD FS, you should first authenticate Azure in the Bright app.

1. Create an application for Bright in Azure. For that, go to Enterprise Applications and click + New application.

2. Click + Create your own application.

3. In the Create your own application window, enter a name for a new application and click Create.
4. Once the application is created, go back to the Home page and select Azure Active Directory.

5. In the left pane, select App registrations, open the All applications tab, and select the created application from the list.

📘

Note

It may take some time until the predefined application is published in the Azure AD gallery.

6. Add the redirect URL. For that, select the relevant setting and add a Web platform.

        In the Redirect URIs field, enter <https://app.brightsec.com/adfs/callback> and click Configure.

7. Go back to the created application and get the following credentials to use them further in the Bright app:

• On the application page, copy the Client ID.

• In the Certificates & secrets tab, create a new secret key and copy its Value.

• In the Endpoints tab, copy the OpenID Connect metadata document URL.

8. Go back to App registrations, select the created application, and then assign users to this application in the Users section.
   The assigned users will be able to log in to the Bright App using AD FS SSO.

Step 2. Enable SSO authentication in the Bright app

Now go to the Bright app and do the following:

1. In the left pane, select the Organization option.
2. From the Required SSO provider dropdown list, select AD FS, and then click Connect.

3. Fill in the AD FS Authentication fields with the credentials copied in Azure AD, and then click Continue.

4. On the Microsoft Permissions Requested page, click Accept.
   Now the AD FS SSO is enabled for all the users of the authenticated application with no limitations.
5. (Optional) You can enforce AD FS SSO registration by selecting the Require your organization members to use SSO to access Bright checkbox. When this option is selected, only the registered users (current members of a Bright organization) with existing SSO accounts can access the Bright app.

🚧

Important

Strict enforcement of SSO for all organization members will require resetting the connection in case of an SSO break. If that happens, please contact the Bright technical support for assistance.

Step 3. Enable provisioning

To configure the automatic provisioning of Azure AD users and groups to your Bright organization, follow these steps:

1. In the ORGANIZATION SETTING section, select the Sync the groups & users from SSO provider to Bright checkbox.

2. In Azure AD, go to the provisioning section of your application and click Get Started.

3. Select one of the following provisioning modes:

• Manual option allows you to add a new user or group to your Bright organization manually with immediate synchronization.
• Automatic mode enables adding every new user or group to your Bright organization automatically. The automatic provisioning interval is 40 minutes.

4. In the Admin Credentials section, do the following:

• In the Tenant URL field, enter <https://app.brightsec.com/api/v1/scim>.

🚧

Important

If you delete a user that was provisioned to a connected Bright organization on the Azure side (either from the synced group or completely), the user will become inactive in the Bright organization and will not be activated back automatically after re-adding them to Azure (or the synced group). To enable automatic activation of users after re-adding them on the Azure side, add the ?aadOptscim062020 flag to the Tenant URL, to make it look like <https://app.brightsec.com/api/v1/scim?aadOptscim062020>.
According to the Microsoft docs, this behavior is currently only available when using the flag, but will become the default behavior over the next few months. Note this feature flag currently does not work with on-demand provisioning.

• In the Secret Token field, enter the API key created in the Bright app.

5. Click Test Connection to verify the credentials that are authorized for provisioning.
6. (Optional) In the Settings section, make sure to set the scope to Sync only assigned users and groups. This will ensure that the provisioning will be limited to assigned users/groups only, and that no other Azure AD users will have access to the Bright app unintendedly.

7. Above the Provisioning mode, click Save to save the configuration.
8. In the Manage provisioning section, select Edit attribute mappings.

9. In the Mappings section, select Provision Azure Directory Users.
   Note: You can keep the group provisioning mappings to default, no changes are required.

10. Set the attribute mappings to the following:
    • userPrincipleName\
    • Switch([IsSoftDeleted], , "False", "True", "True", "False")
    • givenName
    • surname
    • mail
    • displayName

11. To start provisioning, click Start provisioning.

Step 4. Assign Azure AD users and groups to your Bright organization

1. In the left pane, select Users and groups.
2. Click + Add user/group.

3. In the Users and groups field, click None Selected. Select specific users or a group of users to sync them to your Bright organization, and then click Assign.

• The assigned users will be automatically added to the MEMBERS section of your Bright organization.
• The assigned groups will be automatically added to the GROUPS section of your Bright organization.

📘

Note

If you deprovision a user from the Bright integration application in Azure AD, the relative member turns inactive in your Bright organization and is no longer able to log in to the Bright app using AD FS SSO.

Step 5. Log in to the Bright app using AD FS SSO

1. On the login page, click Single Sign On (SSO).

2. Enter the name of the Bright organization for which the AD FS SSO was enabled, and then click Continue.

3. Select Sign in with AD FS.
   You are redirected to the Microsoft login page.

4. Enter your Azure AD user's credentials.