Setting Up authentication for OpenID Connect with Microsoft Azure

adding a microsoft azure application log into https //portal azure com https //portal azure com/ select azure active directory create a new active directory or use an existing active directory from app registration , create a new application registration and provide the following information name a contextual name for the application, such as prod redirect uri select the option web and enter the tenant url in the format https // /handlers/sso/oidc/authresulthandler ashx configuring a microsoft azure application open the microsoft azure application you just created in the previous section and provide the following information field description branding name displays the application name you provided when you created the application in the previous section home page url enter the tenant url the format should be https //( tenant url)/handlers/sso/oidc/authresulthandler ashx authentication redirect uris same as the home page url all other fields in this section are set by default, change them as required certificates and secrets create a new client secret after creating, copy the secret key and save it somewhere you will need this key while configuring openid connect in and this secret key will be hidden after this step is completed api permissions add a new permission of type microsoft graph and delegate the following permission for it directory read all user manageidentities all user read user read all after delegating permissions, select grant admin consent expose an api application id uri provide the tenant id in the format https //( tenant id)/oidc once the above configuration is done, go to overview > endpoints , you need to refer to these endpoints while configuring openid connect in for more information on microsoft azure setup, refer to microsoft help documents https //docs microsoft com/ creating a neurons for itsm authentication provider to set up users for authentication via the , refer to setting up itsm users for authentication via the neurons platform docid\ wnkkhhscs2a4b5njr5ng4 and authentication https //help ivanti com/ht/help/en us/cloud/vnow/authentication htm this feature is early access only and may not be available in your environment for more information, please contact your customer success manager from the , click configure > security controls > authentication providers to open the authentication providers workspace from the new record menu drop down list, select new openid connect enter data into the fields field description default specifies if this authentication provider is called automatically set by the application you change this in the list to make this authentication provider as the default value, you must first change the default setting for all other authentication providers to false and then change the default setting for this authentication provider to true disabled specifies if this authentication provider is disabled name the name of the openid connect provider this can be any value you want and will get displayed to the end users on the login page authentication url enter the value from the oauth 2 0 authorization endpoint from the microsoft azure application created in the above section must be able to initiate an outbound https (port 443) connection to this url token verification url enter the value from the oauth 2 0 token endpoint from the microsoft azure application created in the above section note must be able to initiate an outbound https (port 443) connection to this url logout url enter https //login microsoftonline com//oauth2/logout https //login microsoftonline com/{active directory id}/oauth2/logout get this input from the azure active directory properties created in adding a microsoft azure application docid 7cd3xae15lpe1hhl arok section session renewal url the url to request to renew the session if this field is empty, the application uses the value of the authentication url field for azure ad, this can normally be left blank note must be able to initiate an outbound https (port 443) connection to this url client id enter the microsoft azure client id get this information from the application id field of the microsoft azure application created in the above client secret enter the secret key that you copied and saved while configuring certificates and secrets for the microsoft azure application created in the above section oidc hosted domain not applicable oidc realm not applicable certificate url the url of the certificate used to verify the signature of the authentication response currently, azure uses this url https //login microsoftonline com/common/discovery/keys https //login microsoftonline com/common/discovery/keys note must be able to initiate an outbound https (port 443) connection to this url certificate issuer the name of the certificate authority who issued the certificate enter this hyperlink https //sts windows net/{active directory id}/ https //sts windows net/active directory id/ get this input from the azure active directory properties created in the adding a microsoft azure application docid 7cd3xae15lpe1hhl arok section expiration date the expiration date of the certificate not used in this release of auto provisioning check to enable profile information url not used for microsoft azure auto provision role role associated with the new user auto provision status status of the new user auto provision team team associated with the new user auto provision user business object type of user record to create can be either employee or external contact optional to be redirected to an application url after successful logout, append ?post logout redirect uri={redirect uri} to the logout url for example, enter https //login microsoftonline com/ /oauth2/logout?post logout redirect uri=https //my tenant1 saasitdev com/handlers/sso/oidc/authresulthandler ashx click save your auth provider page should look similar to the image below to verify the authentication, click test authentication (note you must have an employee record with an appropriate external auth linking it to this provider before the test will be fully successful) if a line appears stating "receiving external login", use sub as external login as e mail is not available at this step " you may also be prompted to consent to the needed access and will need to log in as an azure ad admin to accept on behalf of your organization a successful test will look similar to the following screenshot security considerations when using microsoft azure application servers must be able to initiate outbound connections to the following endpoints token verification url certificate url all urls have the following url pattern https //login microsoftonline com/