✅ Setting up Delegated Authentication with SAML on Microsoft Azure

Before setting up the installer, you have to configure Microsoft Entra ID.

Set up Microsoft Entra ID

With an account with enough rights, go to : Enterprise Applications

1. Click on New Application
2. Click on Create your own application on the top left corner
3. Choose a name for it, and select Integrate any other application you don't find in the gallery
4. Click on "Create"
5. Select Set up single sign on
6. Select SAML
7. Edit on Basic SAML Configuration
8. In Identifier , add the following URL : https://synapse_fqdn/_synapse/client/saml2/metadata.xml
9. Remove the default URL
10. In Reply URL , add the following URL : https://synapse_fqdn/_synapse/client/saml2/authn_response
11. Click on Save

12. Make a note of the App Federation Metadata Url under SAML Certificates as this will be required in a later step.
13. Edit on Attributes & Claims
14. Remove all defaults for additional claims
15. Click on Add new claim to add the following (suggested) claims (the UID will be used as the MXID):
    • Name: uid , Transformation : ExtractMailPrefix , Parameter 1 : user.userprincipalname
    • Name: email , Source attribute : user.mail
    • Name: displayName , Source attribute : user.displayname
16. Click on Save

17. In the application overview screen select Users and Groups and add groups and users which may have access to element

Configure the installer

Add a SAML provider in the 'Synapse' configuration after enabling Delegated Auth and set the following (suggested) fields in the installer:

• Allow Unknown Attributes.
  Checked
• Attribute Map.
  Select URN:Oasis:Names:TC:SAML:2.0:Attrname Format:Basic as the Identifier
• Mapping.
  Set the following mappings:
  • From: Primary Email To: email
  • From: First Name To: firstname
  • From: Last Name To: lastname
• Entity.
  
  • Description.
    
  • Entity ID. (From Azure)
  • Name.
    
• User Mapping Provider.
  Set the following:
  • MXID Mapping: Dotreplace
  • MXID Source Attribute: uid
• Metadata URL.
  Add the App Federation Metadata URL from Azure.