​

OAuth: Sign in with Microsoft or Google

​

SAML SSO for ChemCloud with Microsoft Entra ID

1. Open the ChemCloud SSO settings page, select SAML 2.0 and save. This will show your settings.
2. Copy and past the three Service Provider endpoints for your account.
3. Create a non-gallery enterprise application in the Entra admin centre and paste those endpoints into its Basic SAML Configuration.
4. Copy three values back from Entra (Login URL, Microsoft Entra Identifier, certificate) and paste them into ChemCloud.
5. Assign users or groups to the Entra app, then run Test connection from ChemCloud before switching ChemCloud to enforce SAML.

• A ChemCloud buyer admin account whose email is on the same domain that your Entra users use (e.g. you@acme.com if your users sign in as @acme.com). The admin’s email domain becomes the only domain SAML logins are accepted from.
• An Entra Cloud Application Administrator or Application Administrator (or Global Administrator).
• Both browser tabs open side-by-side — you’ll be copy-pasting between them.

​

Step 1 — Open the ChemCloud SSO page

1. Sign in to ChemCloud as a buyer admin.
2. Go to Account Settings → Single Sign-On (path: /buyer/single_sign_on).
3. In Active provider, leave the current value as-is for now (do not switch to SAML 2.0 until Step 7). Switching first would lock everyone — including you — out behind a SAML flow that isn’t configured yet.
4. Scroll to the SAML 2.0 → Service Provider Endpoints panel. You’ll see four read-only fields. Keep this tab open; you’ll copy three of them in the next step:

Tip. ChemCloud serves SP metadata XML at the Metadata URL. If your IT team prefers, they can download that XML and feed it to Entra’s Upload metadata file button in Step 3 instead of pasting Entity ID and Reply URL by hand.

​

Step 2 — Create the enterprise application in Entra

1. In a new tab, sign in to the Microsoft Entra admin centre.
2. Go to Entra ID → Enterprise apps → All applications.
3. Click New application → Create your own application.
4. Name: ChemCloud (or whatever your IT naming convention dictates — this name is what admins and end users see in My Apps).
5. Select Integrate any other application you don’t find in the gallery (Non-gallery).
6. Click Create. Provisioning takes a few seconds.
7. From the new app’s overview page, in the left menu under Manage, click Single sign-on, then choose SAML.

​

Step 3 — Tell Entra about ChemCloud’s endpoints (Card 1)

Shortcut. Instead of filling in Identifier and Reply URL by hand, click Upload metadata file at the top of the SAML config page and point it at ChemCloud’s Metadata URL. Entra will populate Identifier and Reply URL in one go. You’ll still need to fill in Logout Url manually if you want SLO.

​

Card 2 — Attributes & Claims

• Email from the Unique User Identifier (Name ID) — defaulted to user.userprincipalname in emailAddress format. Leave it.
• First name from http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname (Entra default).
• Last name from http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname (Entra default).

You do not need to add or rename any claims. Only touch this card if your tenant uses a non-email UPN (e.g. firstname.lastname@onmicrosoft.com while real mailboxes are @acme.com) — in that case, change Unique User Identifier (Name ID) to user.mail and set Name ID format to Email Address. The domain on whatever Entra sends as NameID must match the buyer admin’s email domain in ChemCloud, or sign-in will be rejected.

​

Step 4 — Copy IdP values from Entra back into ChemCloud (Cards 3 & 4)

​

From Card 3 — SAML Certificates

-----BEGIN CERTIFICATE-----
MIID...
-----END CERTIFICATE-----

​

From Card 4 — Set up [your app name]

• Login URL
• Microsoft Entra Identifier

​

User Provisioning Defaults

​

Step 5 — Assign users and groups to the Entra app

1. From the Entra app’s left menu, click Users and groups.
2. Click Add user/group.
3. Pick a test user first — don’t roll out to everyone yet. For production rollout, prefer assigning a security group rather than individual users.
4. Click Assign.

If you want any user in the tenant to sign in without explicit assignment, go to the app’s Properties and set Assignment required? to No. For ChemCloud — which holds commercial order data — leave it set to Yes.

​

Step 6 — Test the connection (don’t switch the provider yet)

Important. Use ChemCloud’s “Test connection” button, not Entra’s “Test” button on Card 5. ChemCloud rejects SAML responses that aren’t tied to a request it issued itself, so an Entra-initiated test will be rejected as a replay.

1. In ChemCloud’s SSO page, scroll to the bottom of the SAML 2.0 panel and click Test connection. You’ll be redirected to Entra.
2. Sign in to Entra as a user the app is assigned to.
3. Entra posts a SAML response back to ChemCloud. You should land back on the SSO page with “SAML test succeeded. IdP returned user you@acme.com”.

​

Step 7 — Flip ChemCloud over to SAML

1. In the Provider panel, change Active provider to SAML 2.0 and click Save.
2. New sign-ins will now go through Entra. Existing logged-in users keep their current session.

Important. Switching to SAML 2.0 disables password and magic-link sign-in for this account. Users who exist only in Entra but who you haven’t auto-provisioned (Auto-create users = Off) will see “Your account has not been provisioned. Please contact your IT administrator.”

​

Troubleshooting

• A user signs in to Entra fine but ChemCloud says “not provisioned”: Auto-create users is off and there’s no ChemCloud user with that email yet. Either turn auto-create on or create the ChemCloud user first.
• “Your sign-out could not be completed”: SLO is misconfigured. Either re-paste matching Logout URLs on both sides, or clear the IdP SLO (Logout) URL field in ChemCloud and the Logout Url field in Entra’s Card 1 to disable SP-initiated logout.
• Need to roll back: in ChemCloud’s SSO settings, switch Active provider back to whatever it was before. The SAML config is preserved — switching providers does not delete it.
• Certificate rotation in Entra: Entra → app → Single sign-on → Card 3 → SAML Signing Certificate → New Certificate, activate it, then download the new Base64 cert and paste it into ChemCloud’s IdP Certificate (PEM) field and Save. Entra supports up to three active certs per app, so you can stage the rotation without downtime.
• Conditional Access: once SAML is live, you can enforce MFA, device compliance, or location restrictions on the ChemCloud app from Entra without changing anything on ChemCloud’s side.
• Audit trail: SAML sign-ins are logged under Entra ID → Sign-in logs, filtered by application name.

​

Quick reference — what each side wants

​

Reference

​

Frequently asked questions