Skip to content
English
Contact
  • There are no suggestions because the search field is empty.

Single-Sign-On (SSO) Setup Via Azure AD / ENTRA ID

Instructions for Customers Using Azure AD

Step 1: Create an Enterprise Application

Log in to the Azure portal.

Navigate to Azure Active Directory / Microsoft Entra ID and add a new Enterprise Application.

Choose "Create your own application", name it "Stackgini", and select "Integrate any other application you don’t find in the gallery (Non-gallery)".

Step 2: Configure Single Sign-On

Open the created application, and go to the Single sign-on menu.

Choose SAML as the sign-on method.

Step 3: Fill in SAML Settings

You can use the predefined links for the SAML configuration. To do this, you must replace <TENANT> with the name of your Stackgini tenant (you'll find it in your Stackgini URL, directly after app.softwaregini.com/; if you're unsure, please reach out.) 

Identifier (Entity ID): urn:stackgini:sso:<TENANT>

Reply URL (Assertion Consumer Service URL): https://softwaregini.com/auth/realms/softwaregini/broker/<TENANT>/endpoint

Logout Url (optional): https://app.softwaregini.com/<TENANT>/logout

Note: If you set up SSO with Stackgini before 23.10.2026, keep your current Identifier. Do not change it.

Step 4: Attributes and Claims

Required:

  • Open "Unique User Identifier (Name ID)" and set the source attribute to user.mail. Keep the format "Email address".
  • Keep the default additional claims (emailaddress, givenname, surname, name). Stackgini reads the email address and the name from them.
  • If you cannot use user.mail, tell us which value you use instead.

Optional: Role mapping

Use this only if Entra ID should decide who is Admin or Manager in Stackgini. Without it, your Stackgini admins assign the roles in Stackgini.

Note: Role mapping switches off role management in Stackgini. At every sign-in, Stackgini gives each user the role that Entra ID sends, and removes the role if Entra ID does not send it.

  1. Go to App registrations > All applications and open "Stackgini".
  2. Open App roles and click "Create app role":
    • Display name: Stackgini Admin
    • Allowed member types: Users/Groups
    • Value: Stackgini.Admin (exactly like this)
    • Description: Admin in Stackgini
    • Keep "Do you want to enable this app role?" checked and click Apply.
  3. Optional: create a second app role the same way with the value Stackgini.Manager.
  4. Go to Enterprise applications > Stackgini > Users and groups. Click "Add user/group", select the users or groups, select the role and click Assign.

Notes:

  • Only direct members of an assigned group get the role. Members of nested groups do not.
  • To assign groups, you need Microsoft Entra ID P1 or P2.

Step 5: Provide Configuration Details to Stackgini

To finalize the setup, please email the following to service@stackgini.de:

  • The App Federation Metadata URL. You find it under Single sign-on > SAML Certificates. It contains appid=. Please send us only the URL, not the downloaded XML file. Using the URL lets us pick up certificate updates automatically, so nothing needs to be replaced manually when the certificate is rotated.
  • If you use role mapping: which app roles you created (Stackgini.Admin, Stackgini.Manager).
  • If you do not use user.mail as Unique User Identifier: the value that you use.

Step 6: Allow access for relevant user groups

Please align internally on which users and user groups need to get access to Stackgini via SSO.

Contact details

If you have any questions, please contact your Stackgini customer service representative.