Skip to content

Configure Microsoft Entra ID (Azure AD) as an Identity Provider (IdP) for Accops HySecure

Purpose of the Document

This document provides step-by-step instructions to configure Microsoft Entra ID (formerly Azure AD) as a SAML Identity Provider (IdP) for Accops HySecure.

The configuration consists of the following two stages:

  1. Configure Microsoft Entra ID

  2. Configuring the SAML Identity Provider in HySecure

Note

The configuration values in this document are examples and may differ from those in your deployment.

Prerequisites

Before you begin, ensure the following prerequisites are met.

  1. Microsoft Entra ID user account: Ensure you have one of the roles listed below:

    • Global Administrator

    • Cloud Application Administrator

    • Application Administrator

    • Owner of the service principal

  2. Accops HySecure Gateway: Ensure you have the following details ready.

    • The public DNS name of the Accops HySecure Gateway

    • Valid SSL certificate installed on the gateway

  3. Management console access: You should have access to the Accops HySecure Gateway management console using a Security Officer Account.

Configure the Microsoft Entra ID Application

To configure the Active Directory in Azure. Follow the steps given below:

  1. Access the Azure Portal

    1. Log in to Azure Portal.

    2. Navigate to Microsoft Entra ID > Enterprise applications.

      image-20240715174308422

  2. Create a new application

    1. Select New Application.

    2. Select Create your own application, specify an application name, and then click Create.

      image-20240715174926261

  3. Configure Single Sign-On (SSO)

    1. Navigate to Manage > Single sign-on.

    2. Choose SAML to open the SSO configuration page.

      image-20240715180750248

  4. Configure Basic SAML

    1. Select Edit, configure the Basic SAML settings as shown below, and then save the configuration.

      image-20240715180907919

      Field Example
      Identifier (Entity ID) https://hysecure.accops.xyz
      Reply URL (Assertion Consumer Service URL) https://hysecure.accops.xyz/saml-idp/EntraID
      Sign on URL https://hysecure.accops.xyz/saml-login/EntraID
      Relay State (Optional) https://hysecure.accops.xyz
      Logout URL (Optional) https://hysecure.accops.xyz/saml-slo/EntraID

    2. Save the configuration and verify the configured SAML settings before proceeding.

      image-20240715181134631

  5. Download the SAML Certificates

    1. Download the Certificate (Raw) and Federation Metadata XML files for use during the HySecure configuration.

    2. Record the following values for use when configuring HySecure:

      • Login URL

      • Microsoft Entra Identifier

      • Logout URL

        image-20240715181306203

  6. Assign User/Group

    1. Assign users or groups who require access via SAML Single Sign-On (SSO).

      image-20240716123842039

  7. Copy Application Details

    1. Navigate to Microsoft Entra ID > App Registrations, select the application you created and copy the following values:

      • Application (client) ID

      • Object ID

      • Directory (tenant) ID

        image-20240716123925249

  8. Create Secrets

    1. Create a Client Secret for the application.

      image-20240716123949919

  9. Copy the client secret value immediately after it is created.

    image-20240716124009951

  10. Configure Token Claims

    1. Navigate to Token Configuration. Select Add groups claim.

    2. Under the Add groups claim section, select Security groups.

      image-20240716124031303

  11. Configure Microsoft Graph API permissions.

    1. Select API permissions > Add a permission.

    2. Select Request API permissions > Microsoft Graph.

      image-20240716124100379

  12. Configure the necessary API permissions.

    1. Select Delegated permissions and Application permissions, as shown below.

      image-20240716124548952

    2. Application permissions: Allow the application to access resources directly without a signed-in user.

      Application Permissions Description
      Group.Read.All Read all groups.
      GroupMember.Read.All Read group memberships.
      User.Read.All Read all users' basic profiles.

      Note

      When an on-premises Active Directory is synchronized with Microsoft Entra ID using Microsoft Entra ID Connect or Entra Cloud Sync, the application requires OnPremisesSynchronization.Read.All permission. This permission allows the application to read the on-premises directory synchronization settings without granting the ability to modify them.

    3. Delegated Permissions: Allow the application to access resources on behalf of a signed-in user.

      Delegated Permissions Description
      Email Access the user’s email address.
      Profile Access the user’s basic profile information.

  13. Grant admin consent

    1. Once the permissions are added, select Grant admin consent for [Your Organization] to grant admin consent for the permissions. It authorizes the application to access the specified resources on behalf of all users in the organization.

    2. Confirm the consent request when prompted.

      image-20240716125140643

    3. The permissions Status will change to Granted for [Your Organization].

      image-20240716125206814

This completes the Microsoft Entra ID configuration. Next, configure HySecure to use Microsoft Entra ID as the SAML Identity Provider.

Configure the SAML Identity Provider in HySecure

  1. Access the HySecure Management Console

    1. Log in to the HySecure Management Console.

    2. Navigate to Settings > Authentication > Authentication Servers to create a new Authentication Server for the SAML Identity Provider (IdP). For more information, click here.

    3. Enter the details as shown below.

      image-20240716125508499

      General Settings:

      Field Sample value Description
      Upload IdP Metadata Accops-HySecure.xml Metadata downloaded from the Microsoft Entra ID single sign-on application.
      Identity Provider Name EntraID Name of the IdP.
      Identity Provider Protocol SAML 2.0 SAML Version.

      Note

      Ensure the Identity Provider Name matches the one in the IdP Basic SAML Configuration and is used as the post-suffix for the Reply URL (Assertion Consumer Service URL), Sign-on URL, and Logout URL (Optional).

      SAML Protocol Settings:

      Field Sample value Description
      IdP Issuer URI https://sts.windows.net/56f6bxxx-04xx-41xx-83xx-43xxxxxxxxxx/ Microsoft Entra ID Identifier
      IdP Single Sign-On URL https://login.microsoftonline.com/56f6bxxx-04xx-41xx-83xx-43xxxxxxxxxx/saml2 IdP Login URL
      IdP Signature Certificate - IdP SAML Certificate
      Request Binding HTTP-POST -
      Request Signature - -
      Response Signature Verification Assertion -
      Response Signature Algorithm SHA-1 SHA-1 or SHA-256 algorithm can be used

      Service Provider Settings:

      Field Sample value Description
      SP Issuer URI https://hysecure.accops.xyz Accops HySecure Gateway Address
      Assertion Consumer Service URL https://hysecure.accops.xyz/saml-idp/EntraID -
      SP Initiated URL https://hysecure.accops.xyz/saml-login/EntraID -
      Name ID Format Unspecified -

      User Attribute Mapping:

      User Attribute Name Directory Attribute
      LoginID NameID
      EmailID Email
      PhoneNo Mobile
      GroupsName Group

      User Directory Services: Enable this option to retrieve users and user groups from Microsoft Entra ID when creating user- or user group-specific access policies using the configured SAML Identity Provider as the Authorization Server. Configure the following settings:

      • Tenant ID: Enter the Directory (Tenant) ID recorded while registering the application in the Azure portal.

      • Client ID: Enter the Application (Client) ID recorded while registering the application in the Azure portal.

      • Client Secret: Enter the client secret generated during Microsoft Entra ID application configuration.

      • API version: Select v1.0.

      • Cloud Endpoint: Select Global.

      • User Search Attribute: Select the Microsoft Entra ID user attribute that HySecure will use to search and retrieve users.

      • Group Search Attribute: Select the Microsoft Entra ID group attribute that HySecure will use to search and retrieve user groups. If the SAML Identity Provider is used only for authentication, leave this option disabled.

  2. Verify the SAML Connection

    1. Click Test Connection in the HySecure Management Console to verify connectivity between Microsoft Entra ID and Accops HySecure.

    2. Ensure the test completes successfully and confirm that the SAML integration is functional.

  3. Configure Authentication Domain

    1. Navigate to Settings > Authentication > Authentication Domain in the HySecure Management Console, then click Add to create a new Authentication Domain or modify an existing one.

    2. Under the Server at Priority 1 field, select the respective Authentication Server (EntraID). For more information, click here.

      image-20240716130828226

  4. Configure HySecure Domain

    1. Navigate to Settings > Authentication >HySecure Domain, click Add to create a new or modify an existing HySecure domain.

    2. Select the respective Authentication Domain (EntraID) under the Select Authentication Domain field. For more information, click here.

      image-20240716133319150

  5. Configure Application and Application Access ACL

    1. Navigate to Apps > Apps, then click Add to create an application to assign to end users and user groups.

    2. Navigate to Apps > App Groups, click Add to create an application group, and add the required applications to the App Group.

    3. Navigate to Policies > ACL and click Add to create a new Application Access ACL.

    4. Configure the ACL with the following settings:

      • ACL Type: Application Access.

      • HySecure Domain: Select the HySecure domain created earlier.

      • Authorization Server: Select the SAML Identity Provider.

      • Users/User Groups: Search for and add the required users or user groups.

      • Application Group: Select the appropriate application group

      For more information, click here.

      image-20240716133409995

      Field Sample value Description
      Select HySecure Domain EntraID The domain within Accops HySecure uses Microsoft Entra ID for authentication.
      Select Authentication Domain EntraID The domain for verifying user credentials is configured for Microsoft Entra ID.
      Selected Group - A specific group of users within HySecure with access to the resources, mapped to Microsoft Entra ID security groups.
      Select User Group - The user group within HySecure is used to manage and assign collective permissions corresponding to Microsoft Entra ID user groups.
      Select Application Group - A group of applications within HySecure is assigned collective access permissions, facilitating efficient management.

  6. Configure Sites

    1. Configure the required site in the HySecure gateway so it is accessible via SAML authentication. For more information, click here.

    image-20240716133438821

This completes the HySecure configuration for Microsoft Entra ID-based SAML authentication.

Users can now authenticate to HySecure using Microsoft Entra ID through SAML and access the configured resources based on the assigned authentication domain, HySecure domain, and ACL policies.