Introduction

Single Sign-On (SSO) authentication with SAML technology allows users in your organization to log in once with their corporate credentials and access multiple applications, including wolkvox Manager and wolkvox Agent, without having to re-enter their username/password.

This integration enhances security, usability, and centralizes access control (e.g., expiration policies, MFA, account lockout), leveraging identity providers such as Microsoft Azure Active Directory / Microsoft Entra ID (formerly known as Azure).

Configuration

Create the SAML Application in Microsoft Entra ID (Azure)

1. Log in to the Microsoft Azure portal. Open the main menu (hamburger menu).
2. Select "Microsoft Entra ID" (formerly Azure AD).

1. Within Microsoft Entra ID, expand "Manage" in the left menu.
2. Click on "Enterprise applications".

1. Click on "+ New application".
   • Recommendation: Give it a representative name (e.g., wolkvox-SSO).
   • Choose the SAML option as the authentication method.

Initially configure the application.

Enter the application.

Linking URLs (IdP and SP)

Now we need the target data to tell "Entra ID" (Azure) where to send the login information.

1. Log in to wolkvox Manager configuration.
2. Go to the Integrations tab.
3. Go to the SSO tab.
4. Enable the "Enable SSO (SAML)" checkbox.
5. Identify the "Entity ID" field.
6. Identify the "Reply URL" field.
   • These fields are read-only and contain the information you will paste into "Entra ID" (Azure) in the next step.

From wolkvox to Azure:

1. Return to your application in "Entra ID" (Azure).
2. Go to "Manage".
3. Single Sign-On.
4. Section "Basic SAML Configuration".
5. Copy the "Entity ID" from wolkvox and paste it into the "Identifier (Entity ID)" field in "Entra ID" (Azure).
6. Copy the "Reply URL" from wolkvox and paste it into the "Reply URL (Assertion Consumer Service URL)" field in Entra ID (Azure).

From "Entra ID" (Azure) to wolkvox:

1. Return to your application in "Entra ID" (Azure).
2. Go to "Manage".
3. Single Sign-On.
4. In Azure, go to the bottom section "Set up {your application name}". Use the "copy" icon to transfer the exact data to wolkvox:
   • Copy the "Login URL" from "Entra ID" (Azure) and paste it into the "Login URL" field in wolkvox Manager.
   • Copy the "Logout URL" from "Entra ID" (Azure) and paste it into the "Logout URL" field in wolkvox Manager.

1. Log in to wolkvox Manager configuration.
2. Go to the Integrations tab.
3. Go to the SSO tab.
4. Copy the "Login URL" from "Entra ID" (Azure) and paste it into the "Login URL" field in wolkvox Manager.
5. Copy the "Logout URL" from "Entra ID" (Azure) and paste it into the "Logout URL" field in wolkvox Manager.

Installation of the Security Certificate

1. Return to your application in "Entra ID" (Azure).
2. Go to "Manage".
3. Single Sign-On.
4. To validate the authenticity of requests, a digital certificate is required.
   • In Azure, go to the "SAML Certificates" section.
   • Locate the "Certificate (Base64)" and click "Download".

1. Log in to wolkvox Manager configuration.
2. Go to the Integrations tab.
3. Go to the SSO tab.
4. Open the downloaded file with a text editor (such as Notepad).
   1. Copy all the code that appears in the file.
   2. In wolkvox Manager, locate the "Certificate - x509" field and paste the certificate content.
   3. If you want to view the certificate content after adding and saving the configuration, click the "Show" button (as it is a protected field).

Customization and Final Activation

Finally, adjust how users will see and use this functionality in wolkvox:

1. Log in to wolkvox Manager configuration.
2. Go to the Integrations tab.
3. Go to the SSO tab.
4. Configure the fields:
   • Login Button Text: Write the message users will see on the button (e.g., "SSO Login").
   • Integrated Login:
     • Enabled: wolkvox will use its own internal browser for the login process.
     • Disabled: The user's operating system default browser will open.
   • Enable Single Sign-On SAML: If you enable this checkbox, users will only be able to log in using the SSO button. The traditional username and password fields will disappear, enforcing the use of the corporate account.

Don't forget to save the changes made in this configuration window.

Once the changes are saved, your wolkvox Manager and wolkvox Agent users will see the new enabled login button when opening wolkvox Agent and/or wolkvox Manager.