Azure AD SSO
Amazon Cognito integrates with Azure AD to enable existing AD users to sign-on to Amorphic Data Cloud. This section explains how to register and set up your application with Azure AD as an identity provider.
What is Single Sign-On?
Single sign-on (SSO) is an authentication method that enables users to securely authenticate with multiple applications and websites by using just one set of credentials. SSO works based upon a trust relationship set up between an application, known as the service provider, like Amorphic Data Cloud and an identity provider, like Azure AD. This trust relationship is often based upon a certificate that is exchanged between the identity provider and the service provider. This certificate can be used to sign identity information that is being sent from the identity provider to the service provider so that the service provider knows it is coming from a trusted source.
Pre-requisites for Azure AD Identity Provider
Before we proceed with the Azure AD IDP setup, we need the following pre-requisites:
- Azure account - https://portal.azure.com/
- Amorphic Application Deployed with Identity Provider option enabled
Steps to register Amorphic app with Azure AD
- Create a Non-Gallery Enterprise Application with SSO enabled under Azure Active Directory Service
- Get App Federation Metadata Url & Login URL
Create a Non-Gallery Enterprise Application under Azure Active Directory Service
Login to Azure portal using this link.
Search for Azure
Active Directory Service
as shown in below image and open it.
- Select
Enterprise applications
on the left menu panel of portal & SelectNew Application
as shown in below image:
- Click on
Create your own application
as shown in below image:
- Enter a custom name for your application & finally click on
Create
. Make sure to selectIntegrate any other application you don't find in the gallery (Non-gallery)
option as shown below:
Basic SAML configuration
- On the newly created Enterprise application page, select
Single sign-on
option on the left menu panel and selectSet up Single Sign-On
as shown below:
- choose
SAML
as the single sign-on method
- edit Basic SAML Configuration section and add
Identifier Entity Id
andReply URL
- Format of Identifier Entity Id:
urn:amazon:cognito:sp:<cognito-userpool-id>
- Format of Reply URL:
https://<cognito-domain>/saml2/idpresponse
Cloudwick Support Team will provide both cognito-userpool-id
and cognito-domain
values.
User Attributes and Claims
In User attributes and claims section, 3 attributes are important
- name
- username
- edit attributes and claims section
- Click on Add new claim and add values as shown in the image and save them after changes
use Transformation to extract mail prefix and alphabets from email attribute.
- after successfully updated, the attribute page shows all three newly added attributes as shown below:
Get App Federation Metadata Url & Login URL
- Copy
App Federation Metadata Url
andLogin URL
as shown below
Update Amorphic with credentials
- In Amorphic CMP (customer management portal), select IDP provider as SAML and update the values.
IDP Server URL
in cmp corresponds toLogin URL
retrieved from ADIDP Metadata URL
corresponds toApp Federation Metadata Url
from AD
Once the values are added, click on Update IDP Details
.
This will take around 45-60 mins to get reflected in the login page.
Frequently asked questions (FAQ)
1. Why is attribute mapping required?
a. When integrating with azure AD and cognito, Amorphic requires attributes such as username, name and email from azure to successfully register user.
2. To which value should the email be mapped?
a. In azure email
attribute need to be mapped to userprincipalname value.
3. To which value should the username be mapped?
a. In azure username
attribute need to be mapped to userprincipalname value
along with transformation to get a unique value. The transformations applied are ExtractMailPrefix
and ExtractAlpha
4. To which value should the name be mapped?
a. In azure name
attribute need to be mapped to displayname
value.