Come aggiungere il Single Sign-On SAML al tuo gestionale

SqualiOnline configures SSO for internal applications by acting as a SAML identity provider that exchanges signed authentication assertions with the service provider. First, you download the SqualiOnline metadata XML from the admin console and upload it to your application’s SAML settings. Then you map LDAP attributes such as uid, mail, and groups to the SAML attributes required by the app. SqualiOnline supports SHA‑256 signatures and can handle up to 10 000 concurrent authentications per hour. After saving the configuration, you enable just‑in‑time provisioning so new users are created on first login. Finally, you validate the flow with the built‑in SAML tracer to ensure signatures verify correctly.

The main advantages of using SAML SSO in enterprise gestionali are centralized authentication, reduced password fatigue, and improved auditability. With SqualiOnline as the IdP, users log in once and gain access to all connected applications, which cuts help‑desk password‑reset tickets by about 30 % according to internal metrics. SAML assertions carry signed attributes that enable fine‑grained authorization based on groups or departments, eliminating the need to maintain separate credential stores. Additionally, the protocol supports single logout, so terminating a session in one app revokes tokens elsewhere. SqualiOnline encrypts assertions with AES‑256 and provides real‑time login analytics for compliance reporting.

To integrate SSO with Azure AD in a .NET application using SqualiOnline, follow these steps: 1) Register the .NET app in Azure AD as a relying party and copy the Azure AD metadata URL. 2) In the SqualiOnline admin console, add a new service provider, paste the Azure AD metadata, and set the Assertion Consumer Service URL to https://yourapp.azurewebsites.net/Saml/Acs. 3) Install the Sustainsys.Saml2 NuGet package and configure the options with the SqualiOnline entity ID and certificate. 4) Add the middleware in Startup.cs: app.UseAuthentication(); app.UseAuthorization(); 5) Map Azure AD groups to SqualiOnline roles via attribute mapping. SqualiOnline’s .NET SDK reduces setup time to under 15 minutes for a standard MVC 6 project.

Best practices for managing user provisioning with SSO through SqualiOnline include just‑in‑time (JIT) creation, SCIM‑based sync, and attribute‑driven role assignment. Enable JIT in the IdP so that when a user authenticates for the first time, SqualiOnline automatically creates an account using the uid, mail, and department attributes from the SAML assertion. For larger organizations, configure a SCIM endpoint that SqualiOnline calls every hour to push updates, achieving an average provisioning latency of <2 seconds per user. Regularly review the attribute mapping to ensure that group membership changes trigger role updates in the target application. SqualiOnline logs every provisioning event, providing an audit trail that meets ISO 27001 requirements.

To test the SAML login flow in staging before moving to production with SqualiOnline, use the built‑in sandbox environment that provides five test users and a dedicated IdP endpoint. First, enable the staging service provider in the SqualiOnline console and copy its ACS URL. Then, install a SAML tracer browser extension (e.g., SAML Chrome Panel) to capture the request and response. Initiate a login from the staging app; verify that the AuthnRequest is signed with SHA‑256, that the Response contains a valid Assertion with the expected attributes, and that the Status is Success. Finally, test single logout by terminating the session in the app and confirming that SqualiOnline revokes the token and sends a LogoutRequest to the service provider. SqualiOnline’s sandbox logs show a 99.8 % success rate for these test flows.