Skip to main content
License and users
Search
Search Contract Express Help and Support.

This article applies to:

  • Product: Contract Express

Contract Express - SSO with Microsoft Entra ID

The Contract Express application is built of four (four) web applications:
  • API
    : This Contract Express API application is responsible for core (aka API) functionality; it is usually deployed as a virtual application "/rest".
  • UI
    : This Contract Express UI application is responsible for UI elements; it is usually is deployed as a virtual application "/app".
  • ID
    : This Contract Express Identity Server application is responsible for authentication; it is usually deployed as a virtual application "/id".
  • Search
    : This Contract Express Search application is responsible for the Search feature within UI; it is usually deployed as a virtual application "/search".
Contract Express Identity Server supports using a company's Microsoft Entra ID (Formerly Azure AD) as an external identity provider to authenticate users. This page details the necessary configuration changes required to enable this feature.
Contract Express Identity Server uses the OpenId Connect protocol to authenticate users against Microsoft Entra ID. Only work or school accounts can be used for authentication, Microsoft personal accounts are not supported.

Azure – Register a Client Application for Microsoft Graph API

Contract Express needs to be registered with Microsoft Entra ID to support authentication and access the Microsoft Graph API. To register for the app, please follow the instructions:
  1. Navigate to the
    Microsoft Azure Portal
    (https://portal.azure.com/)
    .
  2. Login
     using your work or school account.
  3. Navigate to
    App Registrations
     blade.
  4. Click
    New registration
    , and:
    1. Specify a
      Name
       for the app
      (for example, Contract Express SSO with Microsoft Entra ID)
    2. Select the appropriate option from the
      Supported account types
       (we strongly recommend
      Accounts in this organizational decretory only
       unless another option is required)
    3. In the Redirect URI section, select the
      Web
       option from the dropdown and enter the Contract Express Identity Server signin-azuread endpoint to
      %The_ID_URL%/core/signin-azuread
      (for example, https://contoso.contractexpress.com/id/core/signin-azuread)
    4. Click
      Register
  5. You will be
    redirected
     to the created application:
    1. Take a note of
      Application (client) ID
       as this is the value of
      MSGraphClientId
    2. Take a note of
      Directory (tenant) ID
       as this is the value of
      MSGraphTenant
  6. Select
    Certificates & secrets
     blade within just created application.
  7. Click
    New client secret
    1. Specify
      Description
      (for example, Contract Express MSGraphClientSecret)
    2. Select
      Expires
       option
      (we strongly do not recommend set as Never)
    3. Click
      Add
    4. Take a note of
      Value
       as this is the value of
      MSGraphClientSecret
       and it will be not possible to display that again
  8. Select
    API permissions
     blade within the created application.
  9. Click
    Add a permission
    .
  10. In a pop-up blade, select
    Microsoft Graph
    1. Click
      Delegate permissions
       and select the following:
      • GroupMember.Read.All
      • User.Read
    2. Click Application permissions and select the following:
      • GroupMember.Read.All
      • User.Read.All
    3. Click
      Add permissions
    4. You should see all added API/permissions
  11. Select
    Authentication
     blade within created application:
    1. Under
      Redirect URIs
      , add the Contract Express
      %The_UI_URL%/admin/authentication
       endpoint as a new Web type entry (
      for example, https://contoso.contractexpress.com/app/admin/authentication)
    2. Under
      Advanced settings
      , check-in
      Access tokens
       and
      ID tokens
    3. Click
      Save

Contract Express – Back-end Configuration

These configuration steps are issued by Contract Express back-end administrator.
Update the API web.config as follows:
  1. Update value of
    MSGraphClientId
     parameter with previously captured
    MSGraphClientId
  2. Update value of
    MSGraphClientSecret
     parameter with previously captured
    MSGraphClientSecret
Update the ID web.config as follows:
  1. Update value of
    MSGraphClientId
     parameter with previously captured
    MSGraphClientId
  2. Update value of
    MSGraphClientSecret
     parameter with previously captured
    MSGraphClientSecret
  3. Update value of
    MSGraphTenant
     parameter with previously captured
    MSGraphTenant
    note
    If "Supported account type" is selected as "Accounts in any organizational director" during the application provisioning, you may want to use Common as
    MSGraphTenant
     value.
  4. Update value of
    EnableMSAuth
     parameter with
    True
    .

Contract Express – Front-end Configuration

The following steps are required to implement in order to enable Microsoft Entra ID user/group lookup and AD sync via the Microsoft Graph API. This is a one-time activity. These configuration steps must be issued by a Contract Express
front-end Administrator
, who also has
Microsoft Entra ID Global Admin rights
:
  1. Login
     as Admin user to Contract Express.
  2. Navigate to
    Admin
     page.
  3. Select
    Authentication
     under Licence
    (this option is visible only if CE SSO with Microsoft Entra ID is configured)
  4. Click on
    here
    .
  5. Once
    redirected
     to Azure Portal, use the Microsoft Entra ID Global Admin credentials to authenticate.
  6. On the next screen click
    Accept
    (this will establish trust between Contract Express and Azure)
  7. Once accepted, the page will redirect to the Contract Express application.