Users and sign-in

Everyone who works with invoiceR needs a user. What a user may see and do is controlled by permissions, preferably through roles (see Permissions).

Where users come from

• By hand: Under Administration > Users you create and maintain users directly in invoiceR.
• Import from Active Directory (LDAP): A recurring job (Benutzer von ActiveDirectory importieren) reads the users of an AD group.
• Import from Microsoft Entra ID: A recurring job (Benutzer von Azure AD importieren) reads the members of an Entra group through Microsoft Graph. New users are created, changed users updated, and users disabled in Entra are deleted in invoiceR.

Preparing the import from Microsoft Entra ID

1. Create an app registration (or use an existing one for invoiceR) and note the Tenant ID, Application (client) ID and Client Secret.
2. Under API permissions, add the Microsoft Graph application permissions User.Read.All, Group.Read.All and GroupMember.Read.All and click Grant admin consent.
3. Create a group in Entra ID with everyone who uses invoiceR and note its Object ID.

enio enters the values in the configuration of the import job:

Key	Content
TenantId	Tenant ID of the Microsoft tenant.
ClientId	Application ID of the app registration.
ClientSecret	Client secret of the app registration.
GroupObjectId	Object ID of the group whose members are imported.
DefaultRoleIds	Optional. Roles new users receive automatically.
UseOnPremisesSamAccountNameAsUsername	Optional. true uses the Windows sign-in name as user name, needed together with Windows sign-in.

Sign-in methods

User name and password

The default. Users sign in with User name and Password, see Log in and log out.

Sign-in with Microsoft Entra ID (OpenID Connect)

Users sign in with their Microsoft account. For this the app registration also needs:

1. Under Authentication > Add a platform > Web, the redirect URI you receive from enio.
2. The ID tokens option.
3. Under Token configuration > Add optional claim > ID, the claim email; confirm that the Microsoft Graph permission email is turned on.

Sign-in is configured in the backend in the Authentication:OpenId section of the appsettings.

Windows sign-in (single sign-on with Kerberos)

Users on the company network are signed in automatically with their Windows account. This requires settings in IIS, in the domain and in the browsers.

1. Set up IIS

1. In Server Manager, enable the IIS feature Windows Authentication.
2. On the backend website, enable both Anonymous Authentication and Windows Authentication under Authentication.
3. Run the backend application pool under a domain service account, for example CONTOSO\sa-invoicer.
4. In the Configuration Editor (system.webServer/security/authentication/windowsAuthentication), set useAppPoolCredentials to True.

The backend web.config then contains:

<system.webServer>
  <security>
    <authentication>
      <anonymousAuthentication enabled="true" />
      <windowsAuthentication enabled="true" useAppPoolCredentials="true" />
    </authentication>
  </security>
</system.webServer>

If IIS reports “This configuration section cannot be used at this path”, first unlock the section at server level in the Configuration Editor (Unlock Section).

2. SPN entries in the domain

If the backend is reached under a name other than the server name, a domain administrator must map the address to the service account. The HTTP entry is required even if only HTTPS is used:

setspn -A HTTP/invoicer-backend CONTOSO\sa-invoicer
setspn -A HTTP/invoicer-backend.contoso.ch CONTOSO\sa-invoicer

Any user can check this without domain rights: setspn -L CONTOSO\sa-invoicer.

3. Browsers

Browsers only send the Windows sign-in to addresses in the “Local intranet” zone. Add the frontend and backend addresses to this zone via group policy and allow automatic sign-in there. Otherwise a sign-in dialog appears.

4. Turn it on in invoiceR

Under Administration > Settings, on the Other Settings tab, turn on Is ‘Windows Authentication’ (Single-Sign-On) enabled. The login page then shows Login with windows user.

Troubleshooting

• https://<backend-address>/api/TokenAuth/WindowsAuthTest returns the detected Windows user if the setup works.
• If the sign-in dialog keeps coming back, something is wrong with IIS or Kerberos (SPN). If it works after one entry, the browser does not recognize the address as intranet.
• If requests answer with status 302 after turning it on, check whether the backend address in the configuration contains double slashes.

Logging out

If Windows sign-in is turned on or sign-in through OpenID Connect is active, invoiceR hides Logout in the user menu. Logging out would not help because the user is signed in again automatically right away.

Users with the permission Allow Logout despite ‘Windows Authentication’ (General.AllowLogoutDespiteWindowsAuthentication) still see Logout. They can log out and sign in with a different user, for example for tests or support. You grant the permission under Administration > Roles.