# MSP Portal Configuration

{% hint style="success" %}

### Necessary Pre-requisite

* ADFS installation and initial setup are complete.
* Obtain the [**metadata file**](https://adfshelp.microsoft.com/MetadataExplorer/GetFederationMetadata) from ADFS.
* The MSP portal on EnGenius Cloud Platform is activated with an MSP license.
  {% endhint %}

## <mark style="color:blue;">Configure SAML SSO for the Organization</mark>&#x20;

1. Go to **Organization > MSP Portal > Teams > Team Management** and find the **SAML SSO** section.
2. Enable **SAML SSO**.

<div align="left"><figure><img src="https://1886313717-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fus0DBFfmoooUbiDkYdbq%2Fuploads%2Fz2BQL2plpHR2gHQW3YBF%2Fimage.png?alt=media&#x26;token=408d1c68-31ec-481f-8949-96f17160647c" alt="" width="255"><figcaption><p>1-1 SAML SSO</p></figcaption></figure></div>

3. Click on **Add** to create a new  “**IdP**" to input SAML identity provider details:

* Upload the **Identity Provider (IdP) Metadata** file, which you can extract from your ADFS server.
* Provide a **Name** that helps to identify this IdP.
* Provide the **Login URL**, which is the URL of the existing ADFS login page. &#x20;

<div align="left"><figure><img src="https://1886313717-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fus0DBFfmoooUbiDkYdbq%2Fuploads%2FgOb0TG6iF8i8bwiEHTcj%2Fimage.png?alt=media&#x26;token=a2dc13d1-9c77-4f33-b5ac-d0e1a047d150" alt="" width="563"><figcaption><p>1-2 Add IdP</p></figcaption></figure></div>

{% hint style="info" %}
**IdP Metadata for SSO Integration**

**Metadata** for an IdP is a data file containing the IdP's unique identifier, service URLs, public key certificates, and supported communication protocols, used to enable secure SSO connections.
{% endhint %}

{% hint style="info" %}
**Logout URL for Auto-Logout Redirection**

The 'Logout URL' allows users to set a specific webpage to redirect to after a defined period of inactivity, ensuring an automatic and secure logout.
{% endhint %}

4. &#x20;Upon creation of IdP, the system auto-generates the **Consumer URL** for where the IdP user data will be sent post-IdP authentication.

<figure><img src="https://1886313717-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fus0DBFfmoooUbiDkYdbq%2Fuploads%2FtQlv4HUcNQf27YSkowFe%2F1-3%20Consumer%20URL-1.png?alt=media&#x26;token=8f5bba27-1a4d-45bc-9563-5abc0a323952" alt=""><figcaption><p>1-3 Consumer URL</p></figcaption></figure>

{% hint style="info" %}
Record the "**Consumer URL"** as it is essential for future ADFS configuration.
{% endhint %}

5. Customize the EnGenius **SSO Login URL**:  Adjust the ending URL for easier recall. It serves as a direct link to the default IdP and is unique to a single IdP.

<div align="left"><figure><img src="https://1886313717-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fus0DBFfmoooUbiDkYdbq%2Fuploads%2FY4vTDHugdD0hNP1H6Hfh%2F1-4%20SSO%20Login%20URL-1.png?alt=media&#x26;token=d3d1bdf6-d994-493f-b750-74135af24921" alt=""><figcaption><p>1-4 SSO Login URL</p></figcaption></figure></div>

6. Select a **Default IdP** from the IdP list, it will associate to EnGenius Cloud SSO page as the redirect IdP when user tries to login through SSO URL.

<div align="left"><figure><img src="https://1886313717-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fus0DBFfmoooUbiDkYdbq%2Fuploads%2Fydk80B6AKFdCj8IysiUc%2Fimage.png?alt=media&#x26;token=cdaa84fe-ad71-46ed-ab6d-5357695f9b52" alt="" width="563"><figcaption><p>1-5 Default IdP</p></figcaption></figure></div>

{% hint style="info" %}
**Multi-IDP SAML SSO Configuration**

You can manage and create several IdPs in the EnGenius Cloud to establish SAML SSO, each with its unique Login and Consumer URLs, but only one can map to the SSO Login shorthand URL.
{% endhint %}

## <mark style="color:blue;">Create SAML Roles</mark>&#x20;

Navigate to **Organization > MSP Portal > Teams > Team Privilege** to access the SAML administrator roles. Use this to assign user group privileges. SAML users receive permissions based on the 'role' attribute in their SAML token from the IdP.

To set up a new role for the IdP:

1. Click "**Add Team**".
2. Assign managed scope and permissions as you would for standard users.
3. To finalize, click "**Create admin**" and "**Save changes**".

<figure><img src="https://1886313717-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fus0DBFfmoooUbiDkYdbq%2Fuploads%2FjQUEFeAKVNgYDXx1fCO9%2F1-6%20Team%20Privilege-1.png?alt=media&#x26;token=6820dec7-4b3a-4b5a-a521-1deb0e501b5f" alt=""><figcaption><p>1-6 Team Privilege</p></figcaption></figure>

{% hint style="info" %}
The new team is set by default to the "**All Org**" scope with "**Admin**" permissions; however, customization for individual organizations is possible.
{% endhint %}