en-US - - English

Azure AD Provider

To authenticate PassMan sign-in with Azure AD (Active Directory), you need access to the Azure portal (https://portal.azure.com/).

Registering the application

  1. Sign in to the Azure portal with a user with administrator rights: https://portal.azure.com/ (the language can be set with the gear icon at the top, in the Language + region section).
  2. Among the Azure services, choose Azure Active Directory.
  3. In the left panel, go to App registrations, and select New registration.
  4. Give the name of the API (for example, PassMan) and the relevant data. The redirect URI is needed if you want interactive authentication.

API permissions

Sign in to the Azure portal. In the left panel, go to App registrations, and choose your application. Then, on the left, choose API permissions.

  1. Go to Add a permission.
  2. Choose Microsoft Graph, and within it, Application permissions.
  3. Choose two permissions: Directory.Read.All (under Directory) and User.Read.All (under User).
  4. When they are selected, select Grant admin consent. (To revoke a permission later, use the ... option at the end of its row.)
  5. Two more permissions must be added. Go to Add a permission again, choose Microsoft Graph, and this time Delegated permissions. Choose GroupMember.Read.All (under GroupMember) and User.Read (under User). When they are selected, select Grant admin consent.
  6. Go to your application, and in the left panel, choose Authentication. At the bottom, in the Advanced settings section, set Allow public client flows to Yes. This is needed because the authentication runs through the public app.

Client secret

Sign in to the Azure portal. In the left menu, go to App registrations, and choose your application (in our case, PassMan). In the left panel, choose Certificates & secrets. At the bottom, in the Client secrets section, you can add a secret to your application: New client secret. This will be your client secret.

After the secret is created, note its Value at once, because it cannot be retrieved later.

Redirect URI

Sign in to the Azure portal (with administrator rights). In the left menu: Manage > App registrations. Select your application (here, PassMan). At the top right, go to Redirect URIs, and add a redirect URI.

  1. Choose Add a platform. A panel opens on the right: Configure platforms. Choose Web.
  2. Give the redirect URI like this: https://<PassMan URL>/redirect/<provider name>. The URI is added to the list. Redirect URIs can be deleted with the trash icon.
  3. Finally, select Save at the top of the page.

SAML2 application in Azure

In Azure, you can also create an application with SAML2 authentication. For this, stay in the Azure Active Directory section.

  1. On the left, under Manage, choose Enterprise applications (SAML2 can only be given to this type of application).
  2. Among the new options at the top, choose New application, then Create your own application.
  3. In the right panel, name your application (keep the third option), then select Create.
  4. After a while the application is created. Add users: only the users added here can sign in with the application created with SSO authentication.
  5. In the left panel, choose Single sign-on.
  6. Here, choose SAML.
  7. In Basic SAML Configuration, set Identifier, Reply URL and Sign on URL to PASSMAN_URL/api/authorize/saml2/PROVIDER_NAME.
  8. In Attributes & Claims, make sure that the name or the unique user identifier (UPN) is given. If name is given, make sure it comes back in UPN format.

Padmin

  1. Go to System settings > Authentication.
  2. With NEW, add an Azure AD provider. Its form has Name*, Tenant*, Client ID*, Credential* (the client secret), Redirect URI, SSO like login, Authentication groups and Permission groups.
  3. Turn on Use SAML auth; more fields appear.
  4. Fill in the sign-in and sign-out URLs and the Azure identifier of the service (in the SAML fields: Identity Provider Entity ID*, SSO Login URL*, SSO Logout URL). You can copy the values from Azure.
  5. Load the certificate: in Azure, under SAML Signing Certificate, download the Certificate (Base64) file. Open its content, for example in Notepad, and copy the body text (without the headers) into the IdP Signature certificate* field in Padmin.
  6. Fill in the name data too, which you can read from the Attributes & Claims section (edit): Azure lists all of them under Additional claims, Claim name. In Padmin, copy into UPN SAML attribute name*, for example, the claim (URL) shown in the second-to-last row.

When every required field is filled in, save the new provider with SAVE. From then on, Padmin keeps its data. PassMan validates sign-in based on the membership given in the authentication groups.