How To Setup Azure Active Directory (AD) for SSO (Single Sign-On)

Background

Many companies that use Microsoft services like Microsoft 365 (formerly known as Office 365) use Azure Active Directory for identity management.

We can use that for single-sign on to Y Meadows, so that users can login using their Microsoft identity at that company.

To do this we integrate Azure Active Directory as an Identity Provider with Keycloak. Keycloak manages identity at Y Meadows. Azure Active Directory support OpenID Connect (OIDC), so we will use that to connect. SAML is also an option.

Instructions

Step 1

Log in to Azure Portal (https://portal.azure.com/#home)

Select Azure Active Directory

Select your Azure Active Directory tenant

Go to App Registrations

Click + New Registration

For name, type Y Meadows.

For supported account types choose Accounts in this organizational directory only

For redirect URI enter https://SUBDOMAIN.ymeadows.com/auth/realms/tier0/broker/oidc/endpoint

Click Register

Step 2

Go to Certificates and Secrets in the app registration that you just created

On Client secrets, click on New client secret.

Set Expires to Never if it is an option. Otherwise use the longest period allowed.

Click Add

Copy the secret value and the client ID (not the ID of the secret). You will need them in a future step.

Step 3

Go to the overview page of the app registration

Click Endpoints

Copy the OpenID Connect metadata document URL you will need it in a future step

Step 4 (commonly performed by a Y Meadows staff member)

Go to https://SUBDOMAIN.ymeadows.com/auth/admin/tier0/console/#/tier0/identity-providers

Click Add Provider

Choose OpenID Connect

Under Discovery Endpoint enter the URL you got in step 3.

Under Client ID and Client Secret enter the values you got in step 2.

For Display Name enter the name of the client (e.g. Acme Corp.)

Keep alias as oidc, the default.

Click Add

You should be able to login from the login page now!