The single sign-on configuration is not available for this application in the Enterprise applications experience.

Question

I have installed MediaWiki in Azure and SimpleSAML plugin to get MS SSO.

The problem is that it seems like the metadata has very short lifespan before refresh. I did a simple App Registration and here I can not find any way to change or see expiration date.

After some research I discoved that I should instead create an Enterprise App (the difference is not clear to me) and under Single Sign On I should be able to configure metadata expiration date.

BUT when go to my enterprise app, I get this message:
The single sign-on configuration is not available for this application in the Enterprise applications experience. EnterpriseTestReg was created using the App registrations experience. (Which is not true...)

Answer 1

Hi @KjoniX ,

Thanks for reaching out.

I understand you are trying to configure single sign on in Azure AD for MediaWiki application to increase the lifetime of SAML token but getting the error "The single sign-on configuration is not available for this application in the Enterprise applications experience" although you are registering the application in Enterprise application.

To understand, Application Registration and Enterprise Application

App Registration are basically the apps local to the tenant/organization in which they have been registered to generate unique application id.
Enterprise apps blade shows global apps which can be configured and used within your tenant/organization.

Usually, Apps that are registered using the App Registration blade are considered to be apps that would use either OAuth or OpenIDConnect. Hence the SAML SSO configuration option is not present there.

In case you have created a custom SAML app, that you want to integrate with Azure AD, you need to select the following option under Enterprise Registration: "Integrate any other application you don't find in the gallery"

This setting will allow to setup the SSO for custom SAML application.

If you are looking to extend the lifetime of SAML token which are obtained using Azure AD SAML endpoint, then validity of token is specified by NotOnOrAfter value which can be changed using AccessTokenLifetime parameter in a TokenLifetimePolicy.

Reference: https://learn.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-fed-saml-idp

Hope this will help.

Thanks,
Shweta

-----------------------------------

Please remember to "Accept Answer" if answer helped you.

Answer 2

Yes, it helped. Thx!

I have changed to enterprise app in my test environment and it work. I haven't yet found how I can change the expiration, and it is not clear to me what actually expire. Is it the token or the certitficate?

Will my production environment (which now is on app registration) expire on a fixed time or will it expire because of inactivity?