# Adding Individual Schools to the CCM Enterprise App Add a school's Oliver instance to the consolidated CCM SAML enterprise app. The source requires the standard WONDE user mapping and at least the PIM Application Administrator role. !!!warning Source-derived reference These notes were recovered from OneNote. Configuration, permissions and operating results have not been freshly verified. Confirm the applicable authority and environment before acting. !!! All CCM Schools should use the consolidated CCM: Oliver v5 SAML Auth enterprise app for Oliver SSO. This requires that all schools use a standard user configuration within Oliver, as per [Oliver Standard Configuration (WONDE Sync)](oliver-standard-configuration-wonde-sync.md) The Enterprise App Unique User Identifier in Attributes and Claims is configured with user.userprincipalname. As long as the Oliver Username field contains the users Email/UPN, as per the standard configuration, the user will be able to logon to Oliver, once configuration is completed. To use SSO for Oliver v5 you must configure the following: CCM: Oliver v5 SAML Auth Enterprise App To do the following you need the PIM Application Administrator role as a minimum. - Open the [CCM: Oliver v5 SAML Auth](https://entra.microsoft.com/?feature.msaljs=true#view/Microsoft_AAD_IAM/ManagedAppMenuBlade/~/Overview/objectId/b8e9658f-8fb8-496b-97f3-55c92357a97f/appId/8352e535-6728-4791-a534-a6379d178368/preferredSingleSignOnMode/saml/servicePrincipalType/Application/fromNav/) enterprise app in Entra Admin Centre. - Select Single Sign-on - Edit the Basic SAML Configuration and add the following: - Add a new Identifier (Entity ID). This is the schools Oliver URL usually in the format https://\.softlinkhosting.com.au:443. E.g. - Add and new Reply URL (Assertion Consumer Service URL). This is the schools Oliver URL, followed by /Oliver/Login. e.g. [Screenshot retained for review](../../review/Review-status.md#asset-ed7c3afcf98d2fcb3fbc) - BIG WARNING: DO NOT CHANGE ANY OF THE EXISTING IDENTIFIERS OR REPLY URLS OR YOU WILL BREAK OTHER SCHOOLS SAML SSO!!! - BIG WARNING: DO NOT CHANGE ANY ATTRIBUTES & CLAIMS. If your Oliver is not configured as per the standard config, i.e. Oliver USERNAME field isn't configured with your users email/UPN, then fix your Oliver data before trying to configure SSO on this Enterprise app. [Screenshot retained for review](../../review/Review-status.md#asset-ab889300ab6f106aabff) - In the SAML Certificates section, copy the App Federation Metadata Url. This is required to import the configuration into Oliver. [Screenshot retained for review](../../review/Review-status.md#asset-48d967b920a1ce1ce866) - Select Users and groups on the left and add any school user groups that require logon to Oliver. Because this enterprise app is NOT used for user provisioning within Oliver groups for each school can be added safely. Oliver v5 Configuration for SSO - In your school Oliver Instance open the Oliver Management Console. - Select MANAGEMENT\>Parameters on the left hand side. - Search for parameter 8250 in the search box or Open section SUPPORT \[SINGLE SIGN ON\] \[8000-8999\] and \[8200-8299\] - Click the Edit (pencil) icon. - Scroll to parameter 8279 samlMetadataUrl - Select Import Idp metadata URL and paste in the App Federation Metadata Url from the enterprise app. HINT: this will be the same url for all schools. IMPORTANT: Using the Import Idp metadata URL method is recommended because when the SAML token signing certificate is renewed in the future, Oliver will automatically updated the certificate from the App Federation Metadata URL. See the section [Updating the SAML Certificate](updating-the-saml-certificate.md) If you choose to use the Import Idp Metadata XML method instead, this is static and will NOT update the certificate when it changes. Hence you would need to manually reimport into Oliver. [Screenshot retained for review](../../review/Review-status.md#asset-5df3653eb46a132accb9) - Scroll to parameter 8258 samlNameIDPolicyFormat - Copy and paste the following. This is identical for all Oliver instances using Microsoft SAML Auth. urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified - Scroll to parameter 8264 samlPrincipalAttribute - Enter user.userprincipalname. This is not strictly required, however recommended to ensure Oliver always matches to the Unique User ID that is passed in the SAML auth. - Scroll to parameter 8259 samlAuthnContextClassRef - Copy and paste the following. This is identical for all Oliver instances using MS SAML Auth. This is required to allow Oliver SAML to support Windows Hello for Business, and hence all Oliver instances require this moving forward. urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified BIG NOTE: For those schools who already have SSO with Oliver, using an individual Enterprise App, you will be required to move the config to the consolidated CCM: Oliver v5 SAML Auth at some point. Some things to note are: - It isn't possible to have two Enterprise apps with the same Single Sign-on Identifier (Entity ID). Therefore to enable migration, existing individual enterprise app would need to have the Identifier (Entity ID) changed or removed prior to adding the Identifier to the CCM enterprise app. But note that AS SOON AS YOU DO, USERS WILL NO LONGER BE ABLE TO LOGON TO OLIVER. It doesn't kill any existing sessions, but new logons won't work, so choose an appropriate time. - In Oliver the Username field must contain the users Email/UPN, as this is what is matched to the enterprise app Unique User Identifier. If you don't have the email address/UPN in the Username field then do NOT proceed. Fix your Oliver data first. [Screenshot retained for review](../../review/Review-status.md#asset-86b1ee95049a3784dcab) ## Related guidance - [Topic overview](Introduction.md) - [Source review status](../../review/Review-status.md)