Azure SAML Configuration and Integration

Configuring Azure SAML is a crucial step in integrating your Azure Active Directory (Azure AD) with your on-premises applications or cloud services that support the Security Assertion Markup Language (SAML) 2.0 protocol.

To begin, you need to register your application in the Azure portal and copy the Application ID and Directory ID from the Azure portal.

The Identity Provider (IdP) endpoint is used to issue SAML assertions to the service provider, and in Azure, this is typically done through the Azure AD application's configuration.

The Azure AD SAML configuration involves creating a new Enterprise Application, which will serve as the IdP for your organization.

To set up Single Sign-On (SSO) with Azure AD, you'll need to log in to the Azure Portal and search for Active Directory.

Select Groups and create a new group, such as Hyperglance Admins.

The application name must be given and added in the Enterprise applications section.

For SAML, select the SAML option from the Single sign-on page.

On your VM, generate Service Provider (SP) metadata by running the mellon_create_metadata.sh script.

The IP address or DNS name used here must be the one that your browser would use to reach the Hyperglance VM.

After uploading the sp.xml file to the Azure portal, the Entity ID and Reply URL should be populated.

Replace the empty idp.xml file on the VM with the Federation Metadata XML downloaded from the Sign sign-on page in the Azure portal.

Set the Source to Attribute and type in HyperglanceUser;HyperglanceAdmin as the Value in the claim conditions.

Select users and/or groups that you will allow to access the Hyperglance application.

To enable SAML on the Hyperglance VM, edit the config.env file and set the SAML_ENABLED flag to true.

Azure will suggest you test your new SSO configuration.

Microsoft Entra ID can be configured to work with identity providers that use the SAML 2.0 SP Lite profile with specific requirements.

You must ensure that your SAML 2.0 identity provider output messages are as similar as possible to the provided sample traces. This will help ensure a smooth federated login process.

The Microsoft Entra metadata can be downloaded from https://nexus.microsoftonline-p.com/federationmetadata/saml20/federationmetadata.xml or https://nexus.partner.microsoftonline-p.cn/federationmetadata/saml20/federationmetadata.xml for customers in China.

To improve security, ensure to use a more secure algorithm like SHA-256 instead of SHA-1.

To federate with Microsoft Entra ID, your SAML 2.0 identity provider must implement specific protocol and message formatting requirements.

You should ensure your SAML 2.0 identity provider output messages are as similar as possible to the provided sample traces. This will help ensure a smooth integration with Microsoft Entra ID.

To achieve interoperability with Microsoft Entra ID, you can use the SAML 2.0 SP Lite profile with specific requirements. SHA-1 algorithm is deprecated, so ensure to use a more secure algorithm like SHA-256.

You must enable communication between your SAML 2.0 identity provider and Microsoft Entra ID by setting the relying party ID to the same as the entityID from the Microsoft Entra metadata.

To configure a domain in your Microsoft Entra Directory for federation, you need to follow these steps:

Verify the clock on your SAML 2.0 identity provider server is synchronized to an accurate time source, as an inaccurate clock time can cause federated logins to fail.

To add Entra metadata, you'll need to import the latest metadata from Microsoft Entra ID. This can be done by accessing the federationmetadata/saml20/federationmetadata.xml URL.

You'll find the metadata at https://nexus.microsoftonline-p.com/federationmetadata/saml20/federationmetadata.xml. It's recommended to always import the latest metadata when configuring your SAML 2.0 identity provider.

If you're using a SAML 2.0 identity provider, you'll need to set the relying party ID to the same as the entityID from the Microsoft Entra metadata. This will enable communication between your identity provider and Microsoft Entra ID.

Make sure your SAML 2.0 identity provider server's clock is synchronized to an accurate time source. An inaccurate clock time can cause federated logins to fail.

Here's a summary of the steps to add Entra metadata:

To get Azure SAML up and running, you need to focus on the required attributes and configuration.

Microsoft Entra ID requires a specific NameID format URI for SAML 2.0, which is urn:oasis:names:tc:SAML:2.0:nameid-format:persistent.

The SAML 2.0 protocol requires a secure algorithm, so make sure to use SHA-256 instead of SHA-1.

You'll need to configure your SAML 2.0 compliant identity provider to federate with Microsoft Entra ID, which involves setting up a domain in your Microsoft Entra Directory for federation.

Here's a list of the required attributes for SAML 2.0:

You can obtain the signing certificate base64 encoded string from your IDP metadata file.

Make sure to use the correct Issuer URI, which must match the specified URI setting configured per domain.

You'll also need to configure Azure AD claim rules, which involves mapping LDAP attributes to outgoing claim types. Here's a list of common attributes and claim mappings:

Remember to double-check your entries, as the mapping is case sensitive.

To configure your identity provider, you'll need to enable communication between your SAML 2.0 identity provider and Microsoft Entra ID. This configuration is dependent on your specific identity provider, so be sure to refer to its documentation.

You'll need to set the relying party ID to the same as the entity ID from the Microsoft Entra metadata. To do this, download and import the latest Microsoft Entra metadata from https://nexus.microsoftonline-p.com/federationmetadata/saml20/federationmetadata.xml.

Verify that the clock on your SAML 2.0 identity provider server is synchronized to an accurate time source. An inaccurate clock time can cause federated logins to fail.

To set up a trust between your SAML identity provider and Microsoft Entra ID, you'll need to either add or convert a domain to a single sign-on domain. This will set up a trust between your SAML 2.0 identity provider and Microsoft Entra ID.

Here are the common attributes and claim mappings you should verify with your specific Azure AD configuration:

You should also import the IdP metadata file into your identity provider, such as SugarIdentity, to complete the configuration.