Skip to main content

​
Configure SAML v2 for Azure

This documentation will guide you in configuring SAML v2 IdP for Azure. In this case, TrueFoundry will act as Service Provider (SP) to Azure (IdP).

​
Create an Application in Azure

  1. Log in into your Azure Portal navigate to Enterprise applications.
  2. At the top of the screen click on New Application.
  1. At Browse Microsoft Entra App Gallery page click on Create your own application
  1. Enter Application name and create application In What are you looking to do with your application? choose Integrate any other application you don't find in the gallery (Non-gallery)

​
Configure Your Azure Application

  1. In application go to Single Sign on and choose SAML
  1. Edit Basic SAML Configuration
  • Identifier (Entity ID): This is unique ID that identifies your application to Microsoft Entra ID. This is generally control plane URL.
     <control-plane-url>/deployments?tab=services
  • Reply URL (Assertion Consumer Service URL): This is ACS endpoint which can be obtained from truefoundry.
    <control-plane-url>/api/svc/v1/saml/acs
  • Relay State: This is endpoint where user will be redirected after being authenticated. This is generally control plane URL.
     <control-plane-url>/deployments?tab=services
once SSO is Configured download the SAML Certificates(Recommended Base64) it will be required later.
  1. Attributes & Claims:
  • Add Required Claim click and on Claim name Unique User Identifier set Name identifier format as Email address and Source attribute as user.userprincipalname
  • Add Additional Claims Please do not make changes to already predefined Additional Claims. Click on Add new claim at top left and add three new claims firstName, lastName and email one by one. Addition of firstName is illustrated in the below picture
our final list of claims should be like as shown below

​
Integrate with TrueFoundry

To integrate Azure application with TrueFoundry, Add the following configuration to env Variables
  • OAUTH_PROVIDER_TYPE : EXTERNAL_SAML
  • EXTERNAL_SAML_IDP_ENDPOINT: This is User access URL which can be obtained from application by navigating to properties tab.
  • EXTERNAL_SAML_CERTIFICATE: Encode the the Certificate that we download earlier by Base64 Encoder and set it here.
  • EXTERNAL_SAML_ACCESS_TOKEN_EXPIRY_SECONDS: This is duration of access token that will be asigned to user, so keep it as required.