Configure Azure AD settings in Platform

Gather required values from Azure AD

The following values are required from the Azure AD administrator who creates the Itential Platform application in Azure:

• Tenant ID ("tenant"): Found in Azure AD > Itential Platform App > Tenant ID.
• Client ID ("client"): Found in Azure AD > Itential Platform App > Application ID.

You also need the credentials for your authentication method. If you provide both, the adapter uses the certificate and ignores the client secret. For details, see Choose a credential type.

• Client secret:
  • Itential Platform API Key ("secret"): Obtained during key setup in Azure AD > Itential Platform App > Keys.
• Certificate (Platform 6.6 and later):
  • Certificate path ("certPath"): The path to the PEM certificate file on your Platform servers.
  • Private key path ("keyPath"): The path to the private key file on your Platform servers.

Add the Azure AAA adapter to the active profile

Update the active IAP_Profile in the service configuration in Admin Essentials to add the Azure AAA adapter. Copy the JSON for your authentication method into the properties section of the Service_Config for the Azure AAA adapter.

{
  "id": "Azure AAA",
  "type": "azure_aaa",
  "properties": {
    "tenant": "a38145b3-f428-3645-cb19-ac6fe574ec71",
    "client": "d54381f6-43ae-33cd-bc79-112233dce3c6",
    "secret": "7hcq6sruo5GZAEDzRh6+S4LnKmL1Mb+KK2qlP6uT8w0=",
    "groupSync": {
      "interval": 3600,
      "method": "<all | master | account>",
      "masterGroup": "<object id of master group or empty for all>",
      "serviceAccount": "<object id of service account or empty for all>"
    }
  },
  "brokers": [
    "aaa"
  ]
}

Remove aaa from the Local AAA adapter brokers

Find the properties section of Service_Config for the Local AAA adapter. Remove the "aaa" value from the brokers section, leaving the array empty []. Make sure no other adapters are using the "aaa" broker config.

"brokers": []

Configure the login schema in IAP_Profile

Configure the uiProps login schema in IAP_Profile. This redirects to the Azure SSO page. The path is relative to the base Itential Platform directory.

"uiProps": {
  "login": "custom/sso.html"
}

Configure authenticationProps

Update authenticationProps in IAP_Profile to specify the administrator group or groups from the Azure adapter. Any user within these groups will have full administrator permissions in Itential Platform.

"authenticationProps": {
  "admins": [
    {
      "provenance": "Azure AAA",
      "group": "IAP-Administrator"
    }
  ]
}