Introduction

This playbook will talk you through the procedure to setup integration between your on-premise Active Directory (AD) Instance, Azure AD and the Haventec IAM. Using LDAP sync and federation techniques your master AD Forest will synchronize user records into Azure AD and Haventec IAM. Using a SAML 2.0 trust the Haventec IAM will then be setup with Identity Provider Service privilege enabling you AD users to login using the Haventec Authenticate single step always on Multi-Factor Authentication engine.

Integration Overview

The following steps will be performed to configure Haventec into the Microsoft Azure authentication flow:

1. Configure Active Directory sync to Azure
2. Setup Azure ImmutableID sync  to Active Directory
3. Configure Active Directory sync to Haventec IAM
4. Configure Haventec Authenticate OIDC Application
5. Configure Haventec IAM OIDC Identity Provider
6. Configure Haventec IAM Admin Client
7. Configure IAM Admin User
8. Configure Haventec IAM SAML Client
9. Configure Active Directory SAML federation

Azure AD Federation Background

It is assumed that there is an Active Directory service running which is the source of truth of users. Our test domain is referenced below as an example:

In this case the users are part of the Active Directory domain: demo.haventec.net

Azure AD supports SAML 2.0 SP-Lite integration.

As per the Microsoft (https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-fed-saml-idp) there is limited client SAML support.

Integration Steps

1. Configure Active Directory Sync to Azure

• Create a Synchronisation User, this user will be used to synchronise from Azure back to the Active Directory domain. The user will need sufficient privileges to be able to update users within the Active Directory domain, ie: Domain Administration Group 

• Find a user with tenant administrator privileges in Azure for the synchronisation to Azure.

• Download Azure Connect and configure following the prompts to fill in the information.
• Your final configuration for Azure Synchronisation should look similar to the below.

• An example of the configured AD to Azure AD synchronisation process is shown below.
• Active Directory users will be synchronised with Azure AD and should appear in Azure, this is normally on a 30 min cycle so may take a while for changes to appear. 
  • The synchronisation process can be forced using "Synchronization Manager Service".

• An example of the synchronised user is shown below:

2. Azure ImmutableID Sync to Active Directory

• Open "Synchronization Rules Editor", select direction outbound and click add new Rule.
  • • Enter a name for the rule and select the Active Directory domain (not the Azure Active Directory).
    • Complete the rest of the form details as per the image below, remembering to select your configured domain name from step 1 and click next.

• Do not add any Scoping filters

• Do not add any joining rules

• Add transformations, to link a directory attribute with the immutableID, in this case we have chosen to link with 'msDS-cloudExtensionAttribute10'

• Force a synchronisation via the manager service or wait for it to complete at a regular interval.

• Check the user has had the Immutable ID synchronised to msDS-cloudExtensionAttribute10.

3. Configure Active Directory sync to Haventec IAM

• Create a Synchronisation user in the Active Directory domain controller. The same AADConnect user can be used as above but it is recommended a user with less privileges is used. In this example we are using ADKeycloak.

• Login to the Haventec IAM and select your realm and select user federation

• Select ldap and fill out the required settings:

• Select the mapper tab click create:

• Add the following and save:

• Back on the settings page enable "Periodic Full Sync" and then click "Synchroinize all users" button

4. Configure Haventec Authenticate OIDC Application

• Login to Haventec console and select applications.
• Click Add application:

• Select the application setup settings as follows:
  • • I'd like to use Haventec IAM
    • Self-service but only existing Haventec IAM users
• The logo image file must be png format and under 1MB in size
• The background file must be jpeg format and under 1MB in size.
• Click the "Add Application" button

• Once the application is added the following information will be displayed.
  
  • Keep this tab open on your browser as this information is used later to configure the Havenctec IAM OIDC Identity Provider.

5. Configure Haventec IAM OIDC Identity Provider

• Login to the Haventec IAM, select your realm and then select Identity Provider
• Add a new ODIC Identity provider with the following configuration settings

• Save new OIDC Identity Provider configuration

6. Configure Haventec IAM Admin Client

• Login to the Haventec IAM, select your realm and then select Clients
• Add a new openid-connect client with the following configuration settings:

• Save new Client configuration settings

• Select the "Service Account Roles" tab and assign the following "Client Roles" to "realm-management"
  • • manage-users
    • view-clients
    • view-realms
    • view-users
• The final Client Roles configuration should look like to the below image.

• Under the Credentials tab, make a note of the client secret it will be required in the next section

7. Configure IAM Admin User

• Login to the Haventec IAM, select your realm and then select Users
• Add a new IAM admin user

• Under the credentials tab set a strong password which will be needed later in this section.
• Select the "Roles" tab and assign the following "Client Roles" to "realm-management"
  • • manage-users
    • view-clients
    • view-realms
    • view-users
• The final "realm-management" role configuration should look like the below image.
• Login into the Haventec console, select the configured application and enable the Haventec IAM Admin interface.

• Populate the Havenetec IAM configuration settings as below

8. Configure Haventec IAM SAML Client

• Login to the Haventec IAM and select your realm and select Clients
• Add a new saml client with the following configuration:

• Populate the SAML client configuration settings as below

• Under the mappers tab "create" a new mapper

• Populate the SAML Client mapper as below

9. Configure Active Directory SAML federation

Federate the domain

• All commands are run through an Administrator Powershell.
• Install the MSOnline Module for Powershell:

• Login to Azure platform:

• You will be prompted to enter your Azure admin username and password (eg: <Azure-Admin>@<mydomain>.onmicrosoft.com)
• Check the domain configuration, this will be the domain of your AD service

• Turn on federation for the domain. The MySigningCert value can be found at "/auth/realms/<your_realm_name>/protocol/saml/descriptor"
  • NB: <your_realm_name> is the name of the IAM realm