Single Sign-On (SSO) & User Provisioning
Introduction
AdvaPACS supports SAML 2.0 Single Sign-On (SSO) and SCIM user provisioning, allowing your organisation to integrate with a central Identity Provider (IdP) for authentication and automated user lifecycle management. By combining SAML and SCIM, users can authenticate using their existing organisational credentials while user accounts are automatically created, updated, and deactivated as changes are made within your identity provider.
While this guide uses Microsoft Entra ID (formerly Azure Active Directory) as the example, AdvaPACS supports integration with other SAML 2.0 and SCIM-compliant identity providers. Although the configuration screens and terminology may differ between providers, the overall process remains similar.
SAML vs. SCIM
Although SAML and SCIM are commonly configured together, they serve different purposes.
| Technology | Purpose |
|---|---|
| SAML 2.0 | Authenticates users and allows them to sign in to AdvaPACS using their Identity Provider credentials. |
| SCIM | Automatically creates, updates and deactivates user accounts in AdvaPACS based on changes made within your Identity Provider. |
SAML determines how users authenticate, while SCIM determines how user accounts are managed.
Both services can be configured independently, however most organisations choose to implement both to provide a complete identity management solution.
Prerequisites
Before configuring SAML or SCIM, ensure you have:
- Administrator access to your Identity Provider.
- The Manage Authentication permission in AdvaPACS.
- An existing Identity Provider tenant (such as Microsoft Entra ID).
Configuration Guide
Configuring Single Sign-On and user provisioning consists of the following stages:
- Create an Enterprise Application within your Identity Provider.
- Configure SAML Single Sign-On.
- Configure SCIM User Provisioning.
- Assign users or groups.
- Verify the integration.
The following sections describe each stage using Microsoft Entra ID as the example Identity Provider.
Step 1: Configure the Enterprise Application
Before configuring either SAML or SCIM, create an Enterprise Application within Microsoft Entra ID.
- Sign in to the Microsoft Entra admin centre.
- Navigate to Enterprise Applications.
- Select New application.
- Select Create your own application.
- Choose Integrate any other application you don't find in the gallery (Non-gallery).
- Enter a name for the application (for example, AdvaPACS).
- Select Create.
This application will be used for both SAML authentication and SCIM provisioning.
Configure SAML Single Sign-On
SAML allows users to authenticate to AdvaPACS using their Microsoft Entra ID credentials. Authentication policies such as Conditional Access and Multi-Factor Authentication (MFA) continue to be managed within Microsoft Entra ID.
Step 1 – Create a SAML Configuration in AdvaPACS
- Navigate to Admin → Settings → Authentication.
- Open the SAML tab.
- Select Add Configuration.
AdvaPACS will generate the Service Provider (SP) information required by Microsoft Entra ID.
Copy the following values:
- SP Entity ID
- Assertion Consumer Service (ACS) URL
Step 2 – Configure SAML in Microsoft Entra ID
Within the Enterprise Application:
- Select Single sign-on.
- Choose SAML.
- Edit the Basic SAML Configuration section.
Populate the following values.
| Microsoft Entra ID Field | Value |
|---|---|
| Identifier (Entity ID) | SP Entity ID from AdvaPACS |
| Reply URL (ACS URL) | Assertion Consumer Service URL from AdvaPACS |
Save the configuration.
Step 3 – Copy Identity Provider Information
From the SAML-based Sign-on page, record the following values.
| Microsoft Entra ID | AdvaPACS |
|---|---|
| Microsoft Entra Identifier | IdP Entity ID |
| Login URL | IdP Sign-On URL |
Next, download the Certificate (Base64) from the SAML Certificates section.
Open the downloaded certificate in a text editor and copy the entire contents.
Step 4 – Complete the SAML Configuration
Return to the AdvaPACS SAML configuration and populate the Identity Provider details.
| AdvaPACS Field | Description |
|---|---|
| IdP Name | Display name shown on the AdvaPACS login screen (for example, Microsoft Entra ID). |
| IdP Entity ID | Microsoft Entra Identifier. |
| IdP Sign-On URL | Login URL from Microsoft Entra ID. |
| IdP Certificate | Complete contents of the downloaded Base64 certificate. |
Save the configuration.
Optional – Bypass AdvaPACS MFA
If Multi-Factor Authentication is already enforced by Microsoft Entra ID, AdvaPACS can bypass its own MFA prompt.
Enable Bypass MFA when:
- Microsoft Entra ID Conditional Access policies enforce MFA.
- Users should only be prompted once during sign-in.
We recommend enforcing Multi-Factor Authentication through your Identity Provider before enabling Bypass MFA within AdvaPACS.
Configure SCIM User Provisioning
SCIM automatically synchronises users from Microsoft Entra ID into AdvaPACS. This includes creating new users, updating existing users, and disabling user accounts when access is removed.
Step 1 – Create a SCIM Configuration
- Navigate to Admin → Settings → Authentication.
- Open the SCIM tab.
- Select Add Configuration.
- Enter a descriptive Name.
- Configure the default settings that should be applied to provisioned users.
These settings are applied when users are first created and can be modified later on a per-user basis if required.
After saving the configuration, AdvaPACS generates:
- SCIM URL
- Secret Token
These values will be required when configuring Microsoft Entra ID.
Step 2 – Configure Provisioning
Within the Enterprise Application:
- Select Provisioning.
- Select Get started.
- Set Provisioning Mode to Automatic.
Under Admin Credentials, enter:
| Microsoft Entra ID Field | Value |
|---|---|
| Tenant URL | SCIM URL from AdvaPACS |
| Secret Token | Secret Token from AdvaPACS |
Select Test Connection.
Once the connection succeeds, select Save.
Step 3 – Disable Group Provisioning
AdvaPACS currently supports user provisioning only.
Group provisioning is not currently supported and must be disabled within Microsoft Entra ID.
To disable group provisioning:
- Select Mappings.
- Open Provision Microsoft Entra ID Groups.
- Set Enabled to No.
- Save the changes.
Step 4 – Review User Attribute Mappings (Optional)
Microsoft Entra ID provides a default SCIM attribute mapping suitable for most deployments.
Common attributes include:
userNamegivenNamesurnameemails
If you customise these mappings, ensure they remain consistent with the identifiers expected by your SAML configuration.
Assign Users
Only users assigned to the Enterprise Application can access AdvaPACS.
To assign users:
- Open the Enterprise Application.
- Navigate to Users and groups.
- Assign the users or groups that require access.
Assigned users will:
- Be able to authenticate using SAML.
- Be provisioned into AdvaPACS through SCIM (if enabled).
Verify the Integration
After configuration is complete, verify both authentication and provisioning.
Test Single Sign-On
- Sign out of AdvaPACS.
- Select
Login via <Identity Provider Name>. - Authenticate using a Microsoft Entra ID account.
If authentication succeeds, the SAML integration has been configured correctly.
Verify User Provisioning
Navigate to Admin → Users within AdvaPACS and confirm that assigned users have been created or updated.
Provisioning occurs automatically according to the Microsoft Entra ID provisioning schedule.
Troubleshooting
SAML Authentication
If users cannot sign in:
- Verify the Entity ID and ACS URL match exactly.
- Ensure the complete Base64 certificate has been copied into AdvaPACS.
- Confirm users are assigned to the Enterprise Application.
- Review the Microsoft Entra ID Sign-in logs for authentication errors.
SCIM Provisioning
If users are not being provisioned:
- Verify the SCIM URL and Secret Token.
- Confirm the provisioning connection test succeeds.
- Ensure group provisioning is disabled.
- Review the Microsoft Entra ID Provisioning logs.
- Verify assigned users contain the required attributes.