Enable Entra ID SAML Login

​

Activate SAML in Entra ID

1. Go to Entra ID Portal → Enterprise apps → click on the xorlab app.
2. Open Single sign-on:
3. Choose SAML.
4. Edit the Basic SAML Configuration:
5. Add an Identifier and a Reply URL entry, where xyz is your customer ID.

   Input field name	URL
   Identifier (Entity ID)	https://xyz.activeguard.cloud/auth/saml2/service-provider-metadata/entraSaml
   Reply URL (Assertion Consumer Service URL)	https://xyz.activeguard.cloud/auth/saml2/sso/entraSaml

   The entraSaml part of both URLs is the SAML backend name. You will need to use exactly the same name later when configuring the SAML authentication in xorlab. Each SAML backend must have a unique name. If you are configuring multiple SAML providers in a multi-tenant deployment, use unique names that identify the tenant (e.g nameSAML).
6. Save and click No, I’ll test it later.
7. Copy and save the App Federation Metadata URL from SAML Certificates, you will need it later.

​

Configure users and roles in Entra ID

1. Go to Entra ID Portal → App registrations → All applications → click on the xorlab app.
2. Click on App roles and then Create app role:
3. Create three new app roles via Create app role. The optional ones can be omitted if they are not needed.

   Display Name	Value	Required?
   Administrator	entra_xor_admin	Mandatory
   Analyst	entra_xor_analyst	Optional
   Quarantine user	entra_xor_quarantine_user	Optional

   
4. Open the Enterprise apps menu on the left side, choose again the xorlab app and click on Assign users and groups:
5. Click on Add user/group:
6. Add the users or groups who need access to xorlab and assign them one of the three created roles Administrator, Analyst or Quarantine user.
   Group assigning is only available in the Microsoft Entra ID P1+ license.

​

Activate SAML on xorlab

1. Open the file auth/auth/auth.yml and add a SAML backend.
   auth.yml

   enabledAuthBackends:
     # Add this to the list of enabled backends. If you put it as first entry, it will be the new default.
     - entraSaml
   
   saml2AuthBackends:
     entraSaml:
       idp:
         # Enter the App Federation Metadata URL from Entra ID
         metadataUrl: https://login.microsoftonline.com/*****************************
       attributeMapping:
         displayName: attr('http://schemas.microsoft.com/identity/claims/displayname')
         emails: attr('http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name')
         roles: attr('http://schemas.microsoft.com/ws/2008/06/identity/claims/role')
   
   If you rename entraSaml, make sure to update the Identifier and Reply URL in Entra ID SAML configuration above.
2. Enter the App Federation Metadata Url you copied before for the metadataUrl key.
3. Map your Entra ID roles to xorlab roles by adding a roleMapping. More information about xorlab roles can be found at Built-in User Roles
   auth.yml

   enabledAuthBackends:
     - entraSaml
   
   saml2AuthBackends:
     entraSaml:
       idp:
         # Enter the App Federation Metadata Url from M365
         metadataUrl: https://login.microsoftonline.com/*****************************
       attributeMapping:
         displayName: attr('http://schemas.microsoft.com/identity/claims/displayname')
         emails: attr('http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name')
         roles: attr('http://schemas.microsoft.com/ws/2008/06/identity/claims/role')
       # Add your Entra ID roles to every xorlab role that is required.
       roleMapping:
         xcc_admin:
         - entra_xor_admin
         xcc_monitor:
         - entra_xor_admin
         xcc_analyst:
         - entra_xor_analyst
         xcc_insights:
         - entra_xor_admin
         - entra_xor_analyst
         xcc_quarantine_user:
         - entra_xor_admin
         - entra_xor_analyst
         - entra_xor_quarantine_user
   

   Role pass-through without role mapping

   The following example shows how to do a role pass-through without role mapping. In general this is not recommended because it is more error prone. However if you do it, make sure to:

   • Specify all xorlab roles in Entra ID (including xcc_insights and xcc_monitor) and assign them to your users
   • Provide only xorlab related roles in the SAML token to avoid an excessive token size

   auth.yml

   enabledAuthBackends:
     - entraSaml
   
   saml2AuthBackends:
     entraSaml:
       idp:
         # Enter the App Federation Metadata Url from M365
         metadataUrl: https://login.microsoftonline.com/*****************************
       attributeMapping:
         displayName: attr('http://schemas.microsoft.com/identity/claims/displayname')
         emails: attr('http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name')
         roles: attr('http://schemas.microsoft.com/ws/2008/06/identity/claims/role')
       # Specify PASS_THROUGH, otherwise xorlab will only consider roles that match the role mapping
       roleMappingMode: PASS_THROUGH
   

4. Click Publish. The authentication configuration becomes active within about one minute.
5. Now the SAML integration is done and you can test the login with the link https://xyz.activeguard.cloud/?_agAuthBackend=entraSaml. Replace xyz with your customer ID.

​

Next steps

• Either M365 Monitoring Mode or M365 Inline Mode

• Import Past M365 Emails