# External Identity Provider Configuration - Azure IDP

#### Service Provider Configuration

The page [here ](https://help.cymmetri.io/identity-hub/authentication/service-provider)shows how to configure a Service Provider.

#### Microsoft Entra Configuration

Now Login to the Microsoft Entra portal, <https://entra.microsoft.com/>

<figure><img src="https://3609793515-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FiOkb5tnBpg4wioRhBnTB%2Fuploads%2FSgKWWu6Q2uPUwS2q50Sb%2Fimage.png?alt=media&#x26;token=632d8822-fb18-474b-ad59-58a5d695dea4" alt=""><figcaption></figcaption></figure>

Navigate to Enterprise applications and select New Application.

<figure><img src="https://3609793515-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FiOkb5tnBpg4wioRhBnTB%2Fuploads%2FmpuSByFkdo6WPtGqdsHG%2Fimage.png?alt=media&#x26;token=f826e363-802c-4f1c-9f8e-a9deb656370d" alt=""><figcaption></figcaption></figure>

Click on Create your own application, Enter the Application Name and click on the Create button.

<figure><img src="https://3609793515-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FiOkb5tnBpg4wioRhBnTB%2Fuploads%2FG3F1J7JdDsFuBIGXmTaC%2Fimage.png?alt=media&#x26;token=d9be2741-3570-4554-bf6d-493df62e9234" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3609793515-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FiOkb5tnBpg4wioRhBnTB%2Fuploads%2FhY1t2cPqwJjwiTsDQpoH%2Fimage.png?alt=media&#x26;token=b5658be1-7ba0-4479-9f20-b9b36004769e" alt=""><figcaption></figcaption></figure>

Once the application is created click on the Single Sign On  menu and Set up Single Sign-On with SAML

<figure><img src="https://3609793515-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FiOkb5tnBpg4wioRhBnTB%2Fuploads%2FMivE8y94KrU4RlDNYixD%2Fimage.png?alt=media&#x26;token=79689c72-b6e2-44b8-a3d6-60ab6000dc60" alt=""><figcaption></figcaption></figure>

Download a metadata file from Cymmetri- Service Provider page (how to create service provider is shown above)

<figure><img src="https://3609793515-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FiOkb5tnBpg4wioRhBnTB%2Fuploads%2FpWG14jYi6xYxd39JMwHW%2Fimage.png?alt=media&#x26;token=03019b3e-f43e-4e0a-8ffb-d0d835a0623c" alt=""><figcaption></figcaption></figure>

Upload the downloaded metadata file here:

<figure><img src="https://3609793515-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FiOkb5tnBpg4wioRhBnTB%2Fuploads%2FvQw2J6qSmXm7cS3kgPx0%2Fimage.png?alt=media&#x26;token=bda44bb4-bf67-41a8-a9a9-cd2caf4accab" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3609793515-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FiOkb5tnBpg4wioRhBnTB%2Fuploads%2FUQ8qHusU5GQUFLU2KtD0%2Fimage.png?alt=media&#x26;token=a4d646eb-7df4-4fc3-846d-e802a1054f3c" alt=""><figcaption></figcaption></figure>

The Identifier (Entity ID) and Assertion Consumer Service URL from the XML file downloaded in  previous step are populated, then save the configuration.

<figure><img src="https://3609793515-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FiOkb5tnBpg4wioRhBnTB%2Fuploads%2FivFn2uIb0UqwPGYIORuv%2Fimage.png?alt=media&#x26;token=9e0e46d9-cd20-4111-95d3-afa2c1505369" alt=""><figcaption></figcaption></figure>

Download the Certificate (Base64) from SAML Certificates.

<figure><img src="https://3609793515-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FiOkb5tnBpg4wioRhBnTB%2Fuploads%2F4whMX4VRKkJM5oIeNL5g%2Fimage.png?alt=media&#x26;token=78ee0d51-21f7-483f-9ddd-3adbce8daa80" alt=""><figcaption></figcaption></figure>

#### Assigning Users to the Application

Assigning users to applications in Microsoft Entra Enterprise Application that we just created to allow users to use Azure(Microsoft Entra) as an External Identity provider&#x20;

Navigate to Enterprise applications and select the application you created above

Go to Users and Groups, and select Add user/group and add the user.

<figure><img src="https://3609793515-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FiOkb5tnBpg4wioRhBnTB%2Fuploads%2Fws3mw7QPPjV07TuugEKI%2Fimage.png?alt=media&#x26;token=8a7252fe-8075-4d08-b6af-478a4e88689a" alt=""><figcaption></figcaption></figure>

#### Cymmetri IDP Configuration

Navigate to External IDP in Identity Provider.

<figure><img src="https://3609793515-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FiOkb5tnBpg4wioRhBnTB%2Fuploads%2F0EajLHB3cI5URQXGs6MH%2Fimage.png?alt=media&#x26;token=fdbbda64-bd1e-4b80-b521-03c71f7a5497" alt=""><figcaption></figcaption></figure>

Select Azure-IDP.

<figure><img src="https://3609793515-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FiOkb5tnBpg4wioRhBnTB%2Fuploads%2FYEf6Bl0q7etMwQ603KPk%2Fimage.png?alt=media&#x26;token=b64d9654-cdb6-4723-826c-1c168a20a781" alt=""><figcaption></figcaption></figure>

Configure Azure AD for Creating Identity provider configuration

<figure><img src="https://3609793515-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FiOkb5tnBpg4wioRhBnTB%2Fuploads%2FjpWAgpNdpuXwdWULYoI9%2Fimage.png?alt=media&#x26;token=ac5c4ddd-7cbe-4b1f-8d6c-00a3dee7f25c" alt=""><figcaption></figcaption></figure>

Next, Continue the configuration of Identity Provider In Cymmetri Administration Console, copy Microsoft Entra Identifier from Set up,  navigate to azure-idp in Cymmetri, and paste it in Entity ID.&#x20;

<figure><img src="https://3609793515-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FiOkb5tnBpg4wioRhBnTB%2Fuploads%2FM2B5rAuvZvpaTfbcd2Do%2Fimage.png?alt=media&#x26;token=c348be1a-83e8-4f8f-ad15-b1ef3bb6fc41" alt=""><figcaption></figcaption></figure>

Similarly, copy the login URL and paste it into the Single Sign On Service URL in Cymmetri.

Replace the text "\<host-name>" as the URL of the Cymmetri deployment (e.g., [https://aktestidp.ux.cymmetri.in](https://aktestidp.ux.cymmetri.in/) in the *destination* field - "https\://*\<hostName>*/spsamlsrvc/samlSP/SingleSignOnService"  as "<https://aktestidp.ux.cymmetri.in/>spsamlsrvc/samlSP/SingleSignOnService".

Open the Base64 certificate downloaded in step 12, copy it, and then paste it into the x509Certifcate field in Cymmetri.

<figure><img src="https://3609793515-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FiOkb5tnBpg4wioRhBnTB%2Fuploads%2F6yMJ5DpQVBsluohB6xTz%2Fimage.png?alt=media&#x26;token=48032f15-fae6-47d8-acf3-4c597c827a87" alt=""><figcaption></figcaption></figure>

Select the created service provider in the Service Provider Id field dropdown and save the changes.

<figure><img src="https://3609793515-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FiOkb5tnBpg4wioRhBnTB%2Fuploads%2FtCWpQ2toKy7rkFNqRtYP%2Fimage.png?alt=media&#x26;token=1d38c8ad-798c-4f3c-bd28-eb1df0df4e35" alt=""><figcaption></figcaption></figure>

For enabling Azure IDP to be used as an IDP for a specific set of users an Authentication Rule needs to be configured. [Here ](https://help.cymmetri.io/identity-hub/authentication/authentication-rules)you can see the steps on how to configure Authentication Rules.

#### Configuring JIT provisioning in Cymmetri&#x20;

If JIT provisioning needs to be enabled for Azure AD(Microsoft Entra) as external Identity provider, we may set it up using the steps below.&#x20;

Navigate to JIT in external identity provider and enable JIT Configuration.

<figure><img src="https://3609793515-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FiOkb5tnBpg4wioRhBnTB%2Fuploads%2FIQUP3SSNp6xyXSguqlUI%2Fimage.png?alt=media&#x26;token=aa03c28e-21c5-4218-95c4-bba97d613de4" alt=""><figcaption></figcaption></figure>

The following fields are mandatory in Cymmetri - firstName, lastName, login, userType, displayName, and email.

<figure><img src="https://3609793515-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FiOkb5tnBpg4wioRhBnTB%2Fuploads%2Fgqavtnxs8M8J2XmKQOUL%2Fimage.png?alt=media&#x26;token=bdafe4b7-2918-4c4d-ad7e-4d3d111970e9" alt=""><figcaption></figcaption></figure>

For Azure JIT configuration, the following mapping needs to be done -&#x20;

| Label            | Application Field                                                 | Cymmetri Field |
| ---------------- | ----------------------------------------------------------------- | -------------- |
| First Name       | <http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname> | firstName      |
| Last Name        | <http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname>   | lastName       |
| Login (Username) | <http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name>      | login          |
| User Type        | any string                                                        | userType       |
| Display Name     | <http://schemas.microsoft.com/identity/claims/displayname>        | displayName    |
| Email Address    | <http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name>      | email          |

#### Checking the Azure Authentication

Login to cymmetri using Azure Email Address

<figure><img src="https://3609793515-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FiOkb5tnBpg4wioRhBnTB%2Fuploads%2FnxvVrKJHCMN33kL4sA1o%2Fimage.png?alt=media&#x26;token=6f716a5b-71a4-48fc-827e-9f0c58f24f88" alt=""><figcaption></figcaption></figure>

The user will be redirected to the Azure portal to enter the Azure credentials.

<figure><img src="https://3609793515-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FiOkb5tnBpg4wioRhBnTB%2Fuploads%2FSBu43pXmNcLgYQKarChd%2Fimage.png?alt=media&#x26;token=aa7623ac-1d81-4368-8334-c4844efc5e10" alt=""><figcaption></figcaption></figure>

Once the credentials have been entered properly in the Azure portal, the user will be redirected back to Cymmetri and will be logged in successfully.&#x20;

<figure><img src="https://3609793515-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FiOkb5tnBpg4wioRhBnTB%2Fuploads%2FVqRB8w6JT8R8LQlt70OL%2Fimage.png?alt=media&#x26;token=f7168f51-f6b1-46c4-b09e-3e731a74dd6e" alt=""><figcaption></figcaption></figure>