Authentication & SSO Integration

Create an OAuth 2.0 client in your OIDC provider.

Key configuration:

1. Register a Web OAuth2 client/app
2. Configure the authorized redirect URI:
   Copy

   Ask AI

   https://API_URL/v2/login/callback
   

3. Request the following scopes (minimum):
   Copy

   Ask AI

   openid email
   

4. Add profile scope if you need first name and last name

Note the following credentials:

• Client ID
• Client Secret
• Auth URL (authorization_endpoint)
• Token URL (token_endpoint)
• Certificate URL (jwks_uri)

Create an authProviders.config.yml file with your OIDC provider details.

providers:
  <ProviderName>:
    type: oidc
    config:
      client_id: "your client id"
      client_secret: "your client secret"
      authorization_endpoint: "idp authorization_endpoint"
      token_endpoint: "idp token_endpoint"
      jwks_uri: "idp public certificates endpoint"
      scopes: "openid email profile"
    attributesMapping:
      firstName: 'given_name'
      lastName: 'family_name'
      email: 'email'

• The scopes field is optional and defaults to openid email
• The minimum required scopes are openid and email
• Add profile scope to retrieve additional user attributes like name

Register Prisme.ai as a Service Provider (SP) in your Identity Provider.

Key configuration:

1. Configure the ACS Endpoint:
   Copy

   Ask AI

   https://API_URL/v2/login/callback
   

2. Set the SP EntityID : must match the audience configured below
3. Set Name ID format to unspecified (all formats are supported)

Export the IdP metadata XML file containing the signing certificate and entity information.

Create an authProviders.config.yml file with your SAML provider details.

providers:
  <ProviderName>:
    type: saml
    config:
      idp_metadata_filepath: "/path/towards/idp-saml-metadata.xml"
      audience: "Service Provider entity id"  
      issuer: "Issuer entity id, can be set to audience value"  
    attributesMapping:
      firstName: 'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname'
      lastName: 'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname'
      email: 'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress'

If no XML file is available, you can configure individual parameters:

providers:
  <ProviderName>:
    type: saml
    config:
      entryPoint: "https://idp.example.org/SAML2/SSO/Redirect"
      idpCert: "-----BEGIN CERTIFICATE-----\nMIID...\n-----END CERTIFICATE-----"
      audience: "Service Provider entity id"
      issuer: "Service Provider entity id"

See node-saml documentation for complete configuration options.

Register a new application in your Microsoft Entra ID tenant.

1. Navigate to Azure Portal > App registrations
2. Click New registration
3. Name the application (e.g., “Prisme.ai”)
4. Select the appropriate Supported account types:
   • Accounts in this organizational directory only
   • Accounts in any organizational directory
   • Accounts in any organizational directory and personal Microsoft accounts
   • Personal Microsoft accounts only
5. Set the Redirect URI platform to Web with the value:
   Copy

   Ask AI

   https://API_URL/v2/login/azure/callback
   

6. Click Register

Note the Application (client) ID displayed on the overview page.

Create a secret for authentication.

1. Navigate to Certificates & secrets in the left menu
2. Click New client secret
3. Add a description and select an expiry period
4. Click Add

Immediately copy and store the client secret value, as it won’t be visible again.

Set the required environment variables in the prismeai-api-gateway service.

# Microsoft Entra ID Configuration
AZURE_AD_CLOUD_INSTANCE_ID=https://login.microsoftonline.com/
AZURE_AD_TENANT=YourCompany.onmicrosoft.com
AZURE_AD_APP_ID=your-application-id
AZURE_AD_CLIENT_SECRET=your-client-secret

For the AZURE_AD_TENANT value:

• Use your tenant domain (e.g., YourCompany.onmicrosoft.com) for single-tenant apps
• Use organizations for multi-tenant organizational accounts
• Use common for both organizational and personal accounts
• Use consumers for Microsoft accounts only