Looking to deploy Single Sign-on authentication on an on-premises application (SAML integrated) with Azure AD. In real world, we have two servers a. Identity provider & b. Service provider for SSO.
However, in this case, can i use - Azure AD for IdP and also as SP (same server) for on-premise application SSO authentication? Would be great if someone please explain how would be the flow of authentication in this case?
Azure AD can be an IDP only.
It cannot function as an SP to another IDP.
Could you please elaborate on "also as SP (same server) for on-premise application SSO authentication". What do you mean here? What's the use case?
You can add custom SAML applications to AAD as per this.
Related
My Azure web application will have both internal and external users. The requirements regarding authentication are:
Internal users authenticate with their domain accounts (with SSO)
External users authenticate through Azure AD B2C (we need to create accounts for them)
How can I set up such scenario?
Regards
George
If your internal users are using Azure AD - simple - you add your corporate AAD as Identity provider to your B2C.
There are various ways to do this. So start here.
If your internal users do not have Microsoft 365 (Azure AD), and you only have on-premises AD DS infrastructure - ... move to Cloud, things will be so much easier. If not, you need at least ADFS, then you can hook up ADFS as Identity Provider in your B2C.
There is no way to make Windows Integrated Authentication and Claims Based authentication at the same time for the app.
We have the following scenario:
an Angular app accessing a Web Api backend
our own user database
We are planning to use a third-party identity solution such as Azure AD B2C, AWS IAM or Auth0. To my surprise, I found that Auth0 has an integration with on-premise Active Directory, but Azure AD B2C seems not to support this (at least not that I could find out)
We want to get to the following scenario:
an Angular app accessing a Web Api backend
third-party identity solution that manages the users of the angular app (preferably Azure AD B2C)
users need to authenticate via the identity solution (e.g. using a social account)
some users are in an existing on-premise AD and also need to be able to access the angular app
So my problem basically is : if we would use Azure AD B2C, how can we let users that are defined in an on-premise AD, authenticate in our Angular app? Or with other words: can an on-premise AD be an identity provider for Azure B2C?
This scenario can be solved with AD B2C custom policies.
I found that Auth0 has an integration with on-premise Active
Directory, but Azure AD B2C seems not to support this (at least not
that I could find out)
One way I know to make this work through ADFS. Where you can Integrate ADFS in B2C. I will update this answer if I know any other way of doing this.
Update Start
You can use Shibboleth and Okta servers apart ADFS server.
Update End
users need to authenticate via the identity solution (e.g. using a
social account) some users are in an existing on-premise AD and also
need to be able to access the angular app
If you use custom policies, you can achieve all of these scenarios. You can integrate both social accounts and AD via ADFS (On Premise ADFS server which give access to On Premise AD users)
if we would use Azure AD B2C, how can we let users that are defined in
an on-premise AD, authenticate in our Angular app? Or with other
words: can an on-premise AD be an identity provider for Azure B2C?
As I said this is possible through ADFS server. All you need to do is enable ADFS service on your server and add Relying Parties and make B2C consume and allow your AD users to login with B2C.
Warning: If at all your server not have ADFS enabled first try it on other test server.
ADFS in custom policies can found at: https://learn.microsoft.com/en-us/azure/active-directory-b2c/active-directory-b2c-custom-setup-adfs2016-idp
Is it possible to integrate Okta as an IDP (Identity Provider) for an application in Azure, where Azure would be the Service Provider?
Presently the authentication is managed by Azure AD, we have AD users that have been granted access to these applications hosted in Azure, and Use ADAL for logging in users, and obtaining tokens for securing API calls to the Backend APIs.
Can Okta be added as an IDP and added to the AAD, through SAML or WS-Federation?
Yes, OKTA is listed as one of the third-party IDPs in the Azure AD federation compatibility list which can support federation with Azure Active Directory (AAD).
The supported scenario matrix is listed here.
Hope this clarifies your doubt.
Can anyone suggest which is best idp that we can integrate with Azure AD for SAML SSO.
My goal is need to use Azure AD credentials for all my business application.
Thanks
In Azure AD, AAD is the IDP.
You are the RP.
Any SAML provider can be used e.g. ADFS, PingFederate, Shibboleth etc.
You want "Azure AD credentials for all my business application". Is your business application .NET, Java ... ? Does it have to use SAML? Could it use WS-Federation, OpenID Connect, OAuth ... ?
Is your business application one you wrote yourself or is it SaaS - many of these are already integrated with AAD.
We are developing a multi-tenant application and would like to be listed on Azure and support Azure AD as an IdP for our customers. However, a few customers that already have ADFS 2.0 setup didn't like the idea of sync'ing all accounts and passwords to Azure AD. So, is there anyway that when Azure AD receives a login request, somehow, have it redirect to ADFS and let ADFS do all the magic and return a token back to Azure AD which then returns JWT (using OpenID Connect) to our application?
I know that ACS supports such scenario but we are worried that Microsoft would soon drop support for it.
Thanks!
This document details how your customers can federate their ADFS instance with Azure AD:
https://technet.microsoft.com/library/dn550987.aspx