External Identity Provider Configuration - Azure IDP
Setting up Cymmetri Service Provider for External Identity Provider Configuration
The page here shows how to configure a Service Provider.
Navigate to External IDP in Identity Provider.
Select Azure-IDP.
![](https://help.cymmetri.io/~gitbook/image?url=https%3A%2F%2Fs3-ap-south-1.amazonaws.com%2Find-cdn.freshdesk.com%2Fdata%2Fhelpdesk%2Fattachments%2Fproduction%2F84016974038%2Foriginal%2FbgagnzXTPsiYUya2t8RMZ-95EX6Pmk-ukA.png%3F1665069625&width=768&dpr=4&quality=100&sign=40813bed&sv=1)
Configure Azure AD for Creating Identity provider configuration
Now Login to Azure portal and select Azure Active Directory.
![](https://help.cymmetri.io/~gitbook/image?url=https%3A%2F%2Fs3-ap-south-1.amazonaws.com%2Find-cdn.freshdesk.com%2Fdata%2Fhelpdesk%2Fattachments%2Fproduction%2F84016974039%2Foriginal%2FpB3MOVp9sPViaVsXIdBeD4Caaf6Okg2Ytg.png%3F1665069625&width=768&dpr=4&quality=100&sign=cda0581c&sv=1)
Navigate to Enterprise applications and select New application.
![](https://help.cymmetri.io/~gitbook/image?url=https%3A%2F%2Fs3-ap-south-1.amazonaws.com%2Find-cdn.freshdesk.com%2Fdata%2Fhelpdesk%2Fattachments%2Fproduction%2F84016974048%2Foriginal%2F9Mu--doH01hGLvDwvKKjOoupHPKGVOVYVQ.png%3F1665069629&width=768&dpr=4&quality=100&sign=6c2215f&sv=1)
Create your own application and enter the name of the application.
![](https://help.cymmetri.io/~gitbook/image?url=https%3A%2F%2Fs3-ap-south-1.amazonaws.com%2Find-cdn.freshdesk.com%2Fdata%2Fhelpdesk%2Fattachments%2Fproduction%2F84016974046%2Foriginal%2FRTHeq895zsrnGYAf_8ZJXums4A8JxaSTQA.png%3F1665069629&width=768&dpr=4&quality=100&sign=e4720983&sv=1)
Set up Single Sign On after creating the application using SAML.
![](https://help.cymmetri.io/~gitbook/image?url=https%3A%2F%2Fs3-ap-south-1.amazonaws.com%2Find-cdn.freshdesk.com%2Fdata%2Fhelpdesk%2Fattachments%2Fproduction%2F84016974052%2Foriginal%2F8oZlOSNd-N9MqwjL_CPzNZKTrmI-aIqYxA.png%3F1665069632&width=768&dpr=4&quality=100&sign=39c59d20&sv=1)
Click on Edit basic SAML configuration.
Add Identifier (Entity ID) and Assertion Consumer Service URL from the xml file downloaded in step 3 (For Azure, Sign on and ACS URL is the same) and save the configuration.
Download the Certificate (Base64) from SAML Certificates.
![](https://help.cymmetri.io/~gitbook/image?url=https%3A%2F%2Fs3-ap-south-1.amazonaws.com%2Find-cdn.freshdesk.com%2Fdata%2Fhelpdesk%2Fattachments%2Fproduction%2F84016974054%2Foriginal%2FIOfp9Cn8OZqpZnlg_b9tr34HuvFy4eocEQ.png%3F1665069634&width=768&dpr=4&quality=100&sign=18f76c58&sv=1)
Continue configuration of Identity Provider In Cymmetri Administration Console
Copy Azure AD Identifier from Set up, navigate to azure-idp in Cymmetri and paste it in Entity ID. Similarly, copy login URL and paste it in Single Sign On Service URL in Cymmetri.
Replace the text "<host-name>" as the URL of the Cymmetri deployment (e.g., https://aktestidp.ux.cymmetri.in) "aktestidp.ux.cymmetri.in" in the destination field - "https://<hostName>/spsamlsrvc/samlSP/SingleSignOnService" as "https://aktestidp.ux.cymmetri.in/spsamlsrvc/samlSP/SingleSignOnService".
Open the Base64 certificate downloaded in step 12, copy it and then paste it in x509Certifcate field in Cymmetri.
Select the created service provider in the Service provider Id field dropdown and save the changes.
![](https://help.cymmetri.io/~gitbook/image?url=https%3A%2F%2Fs3-ap-south-1.amazonaws.com%2Find-cdn.freshdesk.com%2Fdata%2Fhelpdesk%2Fattachments%2Fproduction%2F84016974055%2Foriginal%2FAqpu3G_w0RhjERSnsi0qyS6eqK4OgcAeUQ.png%3F1665069635&width=768&dpr=4&quality=100&sign=b1bccea7&sv=1)
For enabling Azure IDP to be used as an IDP for specific set of users an Authentication Rule needs to be configured. Here you can see the steps on how to configure Authentication Rules.
Assigning Users
Assigning user to application in Azure Administration Console for allowing users to use Azure as External Identity provider
Navigate to Enterprise applications and select the application you created in step 8.
Go to Users and groups and select Add user/group and add the user.
Configuring JIT provisioning in Cymmetri Administration Console
If JIT provisioning needs to be enabled for Azure AD as external Identity provider, we may set it up using the steps below.
Navigate to JIT in external identity provider and enable JIT Configuration.
The following fields are mandatory in Cymmetri - firstName, lastName, login, userType, displayName, and email.
For Azure JIT configuration, the following mapping needs to be done -
First Name -
Application Field - http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname
Cymmetri Field - firstName
Last Name -
Application Field - http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname
Cymmetri Field - lastName
Login (Username) -
Application Field - http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Cymmetri Field - login
User Type -
Application Field - any string
Cymmetri Field - userType
Default Value - <will be one of Employee, Vendor, Consultant>
Display Name -
Application Field - http://schemas.microsoft.com/identity/claims/displayname
Cymmetri Field - displayName
Email Address -
Application Field - http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Cymmetri Field - email
In Azure Administration Console
Login to cymmetri using Azure Email Address
The user will be redirected to the Azure portal to enter the Azure credentials.
Once the credentials have been entered properly in Azure portal, the user will be redirected back to Cymmetri and will be logged in successfully.