Microsoft Azure as an External Identity Provider

The steps to configure Azure as an External Identity Provider (IdP) for the 1Kosmos Service Provider (SP) using SAML (Security Assertion Markup Language) for authentication.

---

Roles in this integration

• Identity Provider (IdP): Microsoft Azure (Entra ID)

• Service Provider (SP): 1Kosmos

• Protocol: SAML

Introduction

The integration allows users to authenticate through Azure and access applications and services provided by 1Kosmos.

Prerequisites

• Access to the Azure portal.

• Access to 1Kosmos AdminX for configuring SP settings.

• A basic understanding of SAML configuration and identity management concepts.

Step 1: Configure Azure as the IdP

1. Navigate to the Azure portal.

2. Go to Azure Services > Enterprise Applications.

3. Select an existing application or create your own.

4. If creating a new application, provide a name, select Integrate any other application you don't find in the gallery (Non-gallery), then click Create.

5. Under Configure Single sign-on, select SAML as the single sign-on method.

6. Complete the Basic SAML Configuration:

   • Entity ID — enter the Entity ID from the IdP configured in 1Kosmos AdminX.

   • Reply URL — copy the ACS URL value from the IdP configured in 1Kosmos AdminX.

7. Click Save.

Step 2: Assign and set users

1. Navigate to the Azure portal.

2. Click Add users and groups.

3. Select the user(s) from the list to assign.

Step 3: Map claims and verify the authentication request

Claims mapping ensures accurate user information during authentication:

1. Go to Attributes & Claims in Azure.

2. Click Edit.

3. Configure the Unique User Identifier to the attribute containing the user's username on the 1Kosmos SP.

Authentication request verification:

1. Go to Verification certificates in Azure.

2. Edit the Required field to Yes.

3. Upload the 1Kosmos Request Signing certificate, downloaded from External IDP Config in AdminX.

Step 4: Configure 1Kosmos as the SP

1. Download the Federation Metadata XML from Azure:

   • Go to your application in the Azure portal.

   • Under SAML single sign-on, click Download Federation Metadata XML.

2. In 1Kosmos AdminX:

   • Go to Authentication > External IDP > Add a new Identity Provider.

   • In Core Configurations, enter the IDP Name.

   • Select Upload Metadata and upload the metadata XML downloaded from Azure. All configurations are auto-updated.

   • Click Save.

Step 5: Define routing policies

Define routing policies in 1Kosmos AdminX to specify when the Azure IdP should be used for authentication.

Routing policy with an IF condition only — route based on whether a username, group, application, or all users from the External Identity Provider meet specific criteria:

• is one of — username, group, or application exactly matches the specified value.

• is not one of — username or group does not exactly match the specified value.

• contains — username or group contains the specified substring.

• does not contain — username or group does not contain the specified substring.

• starts with — username or group starts with the specified prefix.

• does not start with — username or group does not start with the specified prefix.

• ends with — username or group ends with the specified suffix.

• does not end with — username or group does not end with the specified suffix.

Routing policy with IF + AND — create secondary criteria for groups. For example, if users belong to a specific group AND meet additional conditions, route them to the specified identity provider.

Routing policy with IF + AND + AND — all users from the External Identity Provider must meet an additional condition beyond the initial criteria. For example, if all users from the External IdP belong to a specific group AND meet further conditions, route them to the specified identity provider.

Each subsequent condition builds upon the previous ones, defining the specific criteria that determine which users are routed to the designated identity provider.

Step 6: Manage the user store

1. Create new external IdP users in 1Kosmos AdminX.

2. Enter all required information and click Create.

Note: Just-In-Time (JIT) provisioning is not supported. Users who need to be redirected to the external Identity Provider (IdP) must be pre-created within the IdP store or connected through a directory.

Step 7: Test the integration

Before deploying to production, thoroughly test the configuration:

• Expand the test scope to include different user scenarios, including users who meet the IdP condition.

• Log in with Azure credentials to access applications and services provided by 1Kosmos.

• Verify that routing policies are correctly applied.

Conclusion

By following these steps, administrators can set up Azure as an external IdP for the 1Kosmos SP using SAML authentication, effectively managing user authentication and access control in a hybrid cloud environment.