Azure OIDC Configuration

This page details the steps to configure a new SSO instance using the Azure OIDC application.

Configure SSO in Azure

To create a new application and configure SSO for Azure OIDC, from the Enterprise Applications screen:

1. Create a new Enterprise Application by clicking New application and then Create your own application.
   

   

2. Fill in the name of the application (e.g.  "Axon") and click Register an application to integrate with Azure AD to use use Azure AD for OIDC authentication.
   

   

3. Enter a user-facing display name for this application in the Name field.
   

   

4. Select the relevant Supported account types.

5. (Optional.) Open the Select a platform drop-list and choose a Redirect URI platform, and then enter the redirect URI in the field.

   

   This can be left blank for now and filled in later.

6. Click Register.
   The application is successfully created.
7. Return to the Enterprise Applications screen and click Refresh.
   The new Axon application appears in the list.
   

   

8. Click the new Axon application.
   The application overview page appears.
   

   

9. Click Assign users and groups.
   The Users and groups page appears.
   

   

10. Click the Add user/group button to assign any users or groups who should be able to access the application.
    Repeat this step to continue adding users and groups as needed.
11. In the left-hand panel, click Single sign-on.
    

    

12. In the Configure application properties box, click Go to application.
    The App registrations overview page appears.
    

    

13. Copy the Application (client) ID and save it in a text file. This ID is needed later when configuring this IdP in Axon.
14. In the left-hand panel, click Certificates & secrets.
15. Click New client secret.
    

    

16. Enter a unique Description for this client secret, and then select an expiration date from the drop-list.
17. Click Add.
    The client secret is added to the Certificates & secrets screen.
18. Copy the client secret Value into a text document. This value is needed later when configuring IdP in Axon.
    

    

19. In the left-hand panel, click Authentication.
20. Click Add a platform.
    

    

21. Select Web.

22. Enter the Redirect URI in the following format:

    https://idp.na01.prod.boreas.cloud/auth/realms/your-axon-tenant-name/broker/axon-alias/endpoint

    

    The Redirect URI is the URI that is output by Axon when configuring this IdP. The "axon-alias" is the alias created within Axon.

    

    The "https://idp.na01.prod.boreas.cloud" part of the URL is dependent on the cluster to which your tenant belongs. The URL used above is only an example.

    

23. Click Configure.

24. (Optional.) In the left-hand panel, click Token configuration, and then click Add groups claim.
    This step is required to perform any automatic role mapping in Axon. Configure the groups claim as needed.
    

    

    Automatic role mapping is not yet available in Axon, but completing this step now will save time in the future.

    
    

    

25. In the left-hand panel, click Overview, and then click Endpoints.
    

    

26. Copy the URL in the OpenID Connect metadata document field and paste it into your browser.
27. From the list of endpoints, copy the authorization_endpoint, token_endpoint, userinfo_endpoint, issuer, and jwks_uri values into a text document. These will all be used to configure this IdP in Axon.

Configure Azure OIDC SSO in Axon

Once all of the steps above have been completed, you can configure the SSO settings for Azure OIDC in Axon.

To configure single sign-on, from the Single Sign-On screen in Axon:

1. Click Add SSO provider.
   The Single Sign-On Settings window appears.
   

   

   
   
2. Enter the Alias configured in Azure above.
3. Enter a unique Display Name to use when displaying the IdP within Axon.
4. Select OIDC as the SSO Configuration Type.
5. Enter the authorization_endpoint obtained in the previous section as the Authorization URL.
6. Enter the token_endpoint obtained in the previous section as the Token URL.
7. Enter the userinfo_endpoint obtained in the previous section as the User Info URL.
8. Open the Client Authentication drop-list and select CLIENT_SECRET_POST.
9. Enter the Application (client) ID obtained in the previous section as the Client ID.
10. Enter the client secret Value obtained in the previous section as the Client Secret.
11. Open the Prompt drop-list and select NOT_SPECIFIED.
12. Check the boxes for Validate Signature and Use JWKS URL.
13. Enter the jwks_uri obtained in the previous section as the JWKS URL.
    

    

    
    
14. Click Save and Enable.
15. Log out from Axon, and then click Return to Login.
    A button allowing for Azure SSO is available.