About Timetastic Contact support Sign in Pricing & free trial

Pro Security

Set up single sign on with SAML and Azure AD

pro-feature_2x.png

You can use single sign-on in Timetastic using Azure AD as your identity provider. So if you already manage users in Azure AD and Office 365 - this is for you.

Note: auto-provisioning is not supported by Timetastic.

 

Step 1. Azure AD setup

Start by going to 'Enterprise applications' in your Azure portal.

Click 'New application'. 

Timetastic_Screen_Shots_Frame__4_.png

Then 'Create your own application'.

Timetastic_Screen_Shots_Frame__4_.png

Name your new app 'Timetastic', leave the default setting 'Integrate any other application you don't find in the gallery' and click 'Create'.

Azure_Name_and_Create_app.png

You'll now find yourself in the overview page for your new Timetastic app. Under Getting Started, click the 'Set up single sign on' box.

Timetastic_Screen_Shots_Frame__6_.png

Select 'SAML' as your single sign-on method.

Timetastic_Screen_Shots_Frame__6_.pngOn this next page, in the 'Basic SAML Configuration' section, click 'Edit'.

Azure_SAML_configureation.png

You'll now need to grab some security details from your Timetastic account:

In Timetastic, head to SETTINGS > SECURITY.

Click 'Set up SAML single sign-on'.

Security_Single_sign-on_Set_up_SAML_single_sign-on.png

Click the 'How to configure your Identity Provider' link to bring up your settings:

Timetastic__51_.png

Copy the Assertion Consumer Service URL and paste it into the 'Reply URL (Assertion Consumer Service URL)' field in Azure.

Copy the Entity ID or Audience URI and paste it into the 'Identifier (Entity ID)' field in Azure.

Click 'Save'.

Timetastic_Screen_Shots_Frame__7_.png

If you're prompted to test SSO with Timetastic, click 'No' as it still won't work at this stage. You need to complete the below steps before you're ready to test. 

Important: Your Timetastic user email addresses need to match the Unique User Identifier in Azure which by default is 'user.userprincialname'. The Unique User Identifier field can be edited if needed. 

 

Granting user access

You'll now need to set which users and groups will be allowed to log in to Timetastic via Azure AD.

Click on 'Users and groups' on the left hand menu.

Timetastic_Screen_Shots_Frame__8_.png

Click 'Add User' then select the users/ groups you want to log in to Timetastic via Azure AD. 

Timetastic_Screen_Shots_Frame__10_.png

After selecting the relevant users/ groups, click 'Assign'.

Lastly, before you leave Azure, click back to the 'Single sign on' option on the left hand menu and scroll down to section 4 'Set up Timetastic'. You'll need these details to enter in Timetastic.

Timetastic_Screen_Shots_Frame__12_.png

 

Step 2. Timetastic setup

Now it's time to head over to Timetastic. Go to SETTINGS > SECURITY  then 'Set up SAML single sign-on'.

Security_Single_sign-on_Set_up_SAML_single_sign-on.png

In the 'SAML SSO URL' field, paste the 'Login URL' value from Azure.

For 'Issuer entity ID', paste the 'Azure AD Identifier' value from Azure.

For 'Public certificate', click the 'Download' link next to 'Certificate (Base64)' under section 3 '

SAML Signing Certificate' in Azure.
Azure_SAML_Signing_Certificate.png
Once you've downloaded the file, open it in a text editor and you should see the certificate value enclosed within "-----BEGIN CERTIFICATE-----" and "-----END CERTIFICATE-----".  Copy all the text and paste into the 'Public certificate' field.

Timetastic__51_.png

You can turn 'Force authentication' on, if you want users to have to re-enter their identity providers details. (This will only work if the identity providers also support this option)

To customise the Sign-in button, enter something useful, such as 'Azure' against 'Customisation'.

We'd recommend you test SSO is working correctly before making it mandatory. 

Once you're happy with your settings, click 'Save changes', then you're good to go!