Celonis Process Management SSO

Azure AD Premium is required

Worked Example: Celonis Process Management & Azure AD

The Microsoft Azure Active Directory provides a SAML 2.0 Identity Provider (IdP) implementation, too, though it does not provide group claims of any kind (see User & Rights Management Considerations). The following example describes setting up Celonis Process Management as a Service Provider (SP) in and for Azure AD.

Azure AD and IdP will be used interchangeably. The same holds true for Celonis Process Management and SP.

Configuration of Celonis Process Management in Azure AD

Before actually configuring Celonis Process Management in Azure AD, decide which EntityID you will give to Celonis Process Management and under which URL Celonis Process Management will be available. For this example we use the following values:

Append "AuthServices/Acs" to get the ACS URL of your Celonis Process Management instance.

Creating a new Application and Defining Claims

In your Azure Portal select Azure Active Directory / Enterprise applications - All applications:

  1. Click + New application .
  2. Select "Non-Gallery Application".
  3. Choose "Manual Provisioning".
  4. Select "SAML-based Sign-on".
  5. Enter an Identifier (Entity ID) such as urn:cpm.example.com:adfs-example
  6. Enter the Reply URL (Assertion Consumer Service URL): https://processes.example.com/AuthServices/Acs .
  7. Select the User Identifier: user.userprincipalname
  8. View and edit all other user attributes:
  9. Save changes.
  10. Download the Metadata XML file.

Configuration of AD FS in Celonis Process Management

The downloaded medatata file is a text file containing XML. You can read it using Notepad/Editor.

Usually the file starts with the tag which has an "entityID" attribute whose value is the IdP EntityID you need to configure Celonis Process Management.

Near the end you will find the elements. Look for the one with Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect". Its "Location" attribute value will be needed to configure Celonis Process Management.

Here are the values from the example metadata XML file:

entityID: https://sts.windows.net/0ee05e8d-dd1c-4065-a51c-840902926d66/

Location: https://login.microsoftonline.com/0ee05e8d-dd1c-4065-a51c-840902926d66/saml2

Setting up a new SAML Authentication Provider in Celonis Process Management

Log in as an administrator to the database or collection for which you want to activate SAML login. For this example we will set up a SAML login for the "GreenField" database in the "Testing" collection. The corresponding URL is https://processes.example.com/Testing/GreenField/editor/1033/

Switch to the Admin section and then select Authentication Providers. Make sure that the root node is set to "Use local" and then add a new SAML Authentication Provider with an ID of "AAD". Select it and adjust its details:

Celonis Process Management in Cloud

If your Celonis Process Management web server can reach the Azure AD servers, consider adding the Metadata XML file as a URL (see above) instead of downloading it from Azure AD and then uploading it to Celonis Process Management. That way changes to the metadata such as a new certficate don't require manual updates to Celonis Process Management.

Celonis Process Management on Premise

Don't add the Metadata XML file as a URL. The Intranet server will likely not have access to Azure AD servers on the internet. Celonis Process Management won't be able to access the metadata and will therefore fail on every SAML login attempt.

Configure User Groups and Permission Sets

The new provider is now live and usable. All users logging in via SAML are made Viewers. As Azure AD does not transmit group claims you need to manage user group assignments manually.

Create user groups and permission sets as needed.

Once a user has logged in for the first time you can access their data and change their application role, default permission sets, and user group memberships (don't use SAML user groups). As long as SAML group management is deactivated these values won't be changed automatically.