Signals: SAML Authentication using Microsoft Azure / Entra ID

If you are configuring authentication for the new Revvity tenant URLs, we recommend creating a new application in Azure/Entra. Editing the existing Azure/Entra application will most likely lock you out of your tenant's existing authentication. The information in this article is applicable to all Signals tenant applications (Signals One, Signals Notebook, Signals ChemDraw, etc.).
 

Information you will need from the Signals tenant

• Log into Signals tenant as an administrator
• Navigate to Configuration > System Settings > Authentication
• Select the URL to configure from the ‘Domain Name’ dropdown menu
• From the ‘Mode of Authentication’ options select ‘External SAML’

If you have existing SAML configuration from a different domain, that configuration will be copied into the fields below, however it will need to be removed for your new configuration to be entered.

Below are the fields you need to copy from the tenant to Azure.

You need to define an Application ID, this can be any value you want with no spaces. Try to avoid using URLs as they usually create confusion with the other URLs used in the configuration.

Creating An Application in Azure

• Click on Enterprise Applications
• Click New Application

• Click Create your Own Application
• Enter a name to display to users on their Microsoft dashboard
• Select Non-Gallery and click Create

Click Single Sign On or Setup Single Sign On:

Select SAML:

On Basic SAML Configuration click Edit:

Here you will enter the values you collected from the SNB configuration page:

• Entity ID is your Application ID, this value needs to match exactly what you entered in SNB Application ID.
• Sign On URL is just your tenant URL.
• You do not need to enter a Logout URL, you can optionally enter it on SNB directly.

Click Save.

By default, Azure/Entra applications have  "Assignment Required = Yes" in the application properties, this means you need to explicitly add users or groups so they can authenticate with this application:

You authentication process will fail if no users have been assigned to the application.

Optionally you can disable the Assignment Required property.

Information you will need from Azure/Entra ID

• Download the Base64 certificate OR the Federation Metadata XML (you can download either one, instructions for each follow below)
• Copy the Login URL

Obtain the certificate string

If you downloaded the Federation Metadata XML:

Copy the certificate string from the X509Certificate tag (line 27 on the screenshot below):

If you downloaded the base64 certificate:

Using a text editor, remove the BEGIN and END lines on the certificate

Using any method you prefer, turn the certificate string into a single line:

Enter Azure information into Signals

• Enter the SAML Key (certificate string in a single line with no spaces)
• Enter the login URL

Optionally you can specify a logout URL to take your users to after they logout.

Entering an incomplete/invalid SAML key will result in the following error:

You can now use the Test Configuration button to validate your settings.

Only save your settings if the test is successful or if you have a different domain to login and modify the settings.