Skip to main content

Configure SSO for Azure

Before you begin

  • You must have a Moogsoft Cloud Login Redirect URL. To obtain a URL, go Settings > Single Sign-On (SSO).

  • Familiarize yourself with this procedure for disabling SSO to prevent locking users out of Moogsoft if the SSO configuration fails.

Create an application in Azure

Before you configure the OIDC properties, you need to create an Azure application that represents Moogsoft. See also Quickstart: Add an enterprise application in the Azure docs.

  1. Navigate to Azure Active Directory > Enterprise Applications > Add Enterprise Application. This opens the Active Directory Gallery.

  2. In the Azure Active Directory Gallery, click create your own application. and do the following:

    1. Select Register an application to integrate with Azure AD (App you're developing) , enter the application name (Moogsoft), and then click create.

    2. Select Accounts in this organizational directory only (Moog-test only - Single tenant) to restrict the accessibility.

    3. For Redirect URI, select Web type and paste the login redirect URL from the Single Sign On page in Moogsoft.

    4. Click Register.

  3. Navigate to Azure Active Directory > Enterprise Applications > Moogsoft and copy the Application (client) ID in the properties section. You will need this when you set up SSO in Moogsoft.

Configure users, groups, and roles for the application

By default, the application has no users or permissions defined. It is good practice to configure your application to allow only authorized users to perform authorized actions, and that Azure users have received their emails set in their Azure user profiles.

Note

For more information on creating app roles in Azure, see the Microsoft article Add app roles to your application and receive them in the token.

Azure does not expose groups by default so the values in the application manifest must be overriden, as shown here: Configuring optional claims .

  1. Under Azure Services, click Active Directory.

  2. Under Manage, click App Registrations.

  3. In the Display name list, click the link to your app.

  4. Under Manage, click App Roles.

  5. Click Create app role.

    1. Enter a display name.

    2. Select User/Groups.

    3. Add any preferred information in the Value and Description fields.

    4. Ensure that Do you want to enable this app role is selected.

    5. Repeat steps a through d for each app role your organization requires.

Add the app role to the application:

  1. Navigate back to Azure Active Directory.

  2. Under Manage, click All applications.

  3. Select the application that you want to use from the list.

  4. Under Manage, click Users and groups.

  5. Add a user group:

    1. Click +Add user/group.

    2. Enter a name for the group.

    3. Select Group as the object type.

    4. Select the app role for the group (created in the previous section).

Configure the roles in Moogsoft:

  1. In Moogsoft, navigate to Settings > Single Sign On (SSO), and then click Configure in the OpenID Connect box.

  2. Click the Configuration tab and complete the optional setup sections:

    Note

    It is a best practice to complete the rest of your SSO configuration first, test your setup, and then add scopes and mappings after you have confirmed SSO is working correctly.

Configure redirection and secrets

To configure redirection, go to Azure Active Directory > App registrations.

  1. Click All Applications and select the application (Moogsoft) you just created.

  2. You can obtain Directory (tenant) ID from the overview > essentials section.

  3. Click Authentication and verify that the Redirect URL is correct.

  4. Click Certificates & secrets > new client secret for creating client secret. This opens a wizard tab for specifying the secret description and expiration. Click Add to add secrets.

  5. Copy the value of the secret for future use.

Moogsoft configuration

  1. In the Moogsoft UI, go to Settings > Single Sign-On (SSO), and then click Configure in the OpenID Connect (OIDC) box.

  2. For Issuer URL, paste the following URL and replace {tenant} with your Azure Active Directory (tenant) ID:

    https://login.microsoftonline.com/{tenant}/v2.0/.well-known/openid-configuration

  3. Paste your application ID into the Client ID field.

  4. Paste the Azure AD application secret value to Client Secret.

  5. Add your email domain to the Domains list and click Save.

  6. Click Test and then Test Now. This takes you to the Microsoft login page. Enter your credentials and Sign in. If you have configured all the previous steps, you should then see the “it works” page in the Moogsoft UI.

  7. In the Moogsoft UI, click Enable.

Configure SSO to support multiple tenants

If you have multiple Moogsoft instances and want to use the same SSO configuration with all of them, you must complete an additional procedure for supporting multiple tenants.

In this section: