Your suggested change has been received. Thank you.

close

Suggest A Change

https://thales.na.market.dpondemand.io/docs/dpod/services/kmo….

Thales Logo

All

  • All
back

Thales Authenticator Lifecycle Manager

External IDP and Identity Broker setup

search

Please Note:

External IDP and Identity Broker setup

Before users can register FIDO devices through the self-service registration portal, administrators must configure an external identity provider (IDP) and register it with the OneWelcome Identity Broker. These configurations are required to enable user authentication through the Identity Broker and the external IDP that manages user identities.

To enable self-service registration, complete the following prerequisite tasks:

Configure an External IDP (Microsoft Entra ID)

Perform the following steps:

  1. Register the application

  2. Obtain the configuration values

  3. Add the email optional claim

  4. Grant Microsoft Graph permissions

Register the application

  1. In the Azure portal, on the Azure services page, select Microsoft Entra ID.

  2. On the Microsoft Entra ID Overview page, review the tenant details, such as the Name and Tenant ID, and then open App registrations.

  3. On the App registrations page, click New registration.

  4. On the Register an application page, perform the following steps:

    1. In the Name field, enter a name for the application.
    2. Under Supported account types, select the Accounts in this organizational directory only (Single tenant) option.
    3. Under Redirect URI, select Web and enter the Identity Broker callback URL, for example https://<identity-broker-host>/broker/authentication/callback.
    4. Click Register.

Obtain the configuration values

Obtain the following configuration values required by the OneWelcome Identity Broker:

You will need these values while adding Microsoft Entra ID in the OneWelcome Identity Broker.

Client ID and OpenID Connect (OIDC) metadata endpoint

  1. After the application registration, the application Overview page displays the Essentials details.

  2. Copy the Application (client) ID and paste it in a text editor.

  3. On the Overview page, click Endpoints.

  4. Under Endpoints, copy the OpenID Connect metadata document URL and paste it in the text editor. The Identity Broker uses this URL to discover the IDP endpoints.

Client secret

  1. On the Overview page, in the Essentials section, click on the Client credentials link.

  2. On the Certificates & secrets page, go to the Client secrets tab, and then click New client secret.

  3. Under Add a client secret, enter a Description, select an expiry period, and then click Add.

Caution

When you create the client secret, the portal displays its Value only once. Copy the Value immediately and store it securely, because it cannot be retrieved later.

The Secret ID is not required for the remaining configuration. The Identity Broker uses the application (client) ID and the client secret Value.

Add the email optional claim

To include the user's email address in the ID token, add the email optional claim.

  1. In the left menu, under Manage, select Token configuration.

  2. Click Add optional claim. Under Add optional claim, for Token type select ID, select the email claim, and then click Add.

  3. The email claim is added and appears in the Optional claims list.

Note

If a testing tool reports that the auth_time claim is not set in the ID token, add the auth_time optional claim in the same way that you added the email claim.

Grant Microsoft Graph permissions

  1. In the left menu, under Manage, select API permissions.

  2. On the API permissions page, under Configured permissions, click Add a permission.

  3. Under Request API permissions, on the Microsoft APIs tab, select Microsoft Graph.

  4. Select Delegated permissions.

  5. Under OpenId permissions, select the email and openid checkboxes, and then add the permissions.

  6. The configured Microsoft Graph delegated permissions (email, openid, and User.Read) appear in the Configured permissions list.

  7. Click Grant admin consent for your tenant. The Status column shows Granted for each permission.

Configure the OneWelcome Identity Broker

Note

Configuring the Identity Broker requires the role_broker_write permission.

Perform the following steps to add the Microsoft Entra ID IDP to the OneWelcome Identity Broker:

  1. On the Thales console, click Settings > Authentication > External IDPs. The External identity providers page lists the configured providers.

  2. Click Add identity provider.

  3. In the provider list, select OpenID Connect.

  4. On the Edit identity provider - OpenID Connect page, complete the Basic information and Connection details:

    1. In Display name field, enter a name for the provider.
    2. In the Description field, enter a decsription.
    3. (Optional) In Domain aliases field, add the domains that use this identity provider when a login_hint parameter is included in the authentication request.
    4. Select the Active checkbox so that users can select the provider.
    5. Note the broker redirect URI that must be whitelisted in the external identity provider.
    6. In the Client ID field, enter the Application (client) ID that you obtained in step 2 of Client ID and OpenID Connect (OIDC) metadata endpoint.
    7. Under Authentication method, select Client secret post.

  5. Continue with the connection endpoints:

    1. In the Client secret field, enter the client secret that you obtained earlier while configuring from Microsoft Entra ID.
    2. In the Well-known configuration endpoint field, paste the OpenID Connect metadata document URL, and then click Load to populate the Issuer, Authorization endpoint, Token endpoint, and User information endpoint.
    3. Set Signature type to Asymmetric.
    4. Set Identity provider certificates to Dynamic via JWKs URI.

  6. (Optional) Confirm the Identity provider JWKs URI, by selecting Encrypted JWT, JWT-Secured Authentication Request, or Single logout.

  7. Under Variants,

    1. In the Variant name field, enter a name (for example, authentication).
    2. In the Scope names field, add the scopes (for example, openid and profile).
    3. In the ACR values field, enter the authentication context class references, if required.

  8. (optional)Under Attribute mappings, perform the following steps:

    1. Select the Return original assertion checkbox.

    2. In the User identifier field, enter oid, the Microsoft Entra ID claim that uniquely identifies the user.

    3. Click Add attribute mapping to map additional identity provider claims.

    4. Click Submit.

  9. The External identity providers list displays the provider with its type and status. Expand the provider to view each variant and its ACR value, for example, urn:onewelcome:broker:v1:talmtest:authentication.

Note

The ACR value identifies the broker configuration. The application passes this value in the acr_values parameter of the authorization request so that the Access server can route the user to the correct identity provider for authentication.

After you complete both prerequisite configurations, enable self-service on the identity provider and configure the required self-service settings. Users can then authenticate through the self-service registration portal and register their FIDO devices.

For more information, see:

On this page