Versions Compared
Key
- This line was added.
- This line was removed.
- Formatting was changed.
If your organization integrates applications with Azure AD, you can manage those applications in EmpowerID, including assigning certificates to those applications. As a prerequisite to assigning a certificate to an Azure application, the private key for the certificate needs to be uploaded to the EmpowerID certificate store. This is necessary for EmpowerID to call the Graph API on your behalf.
The workflow used to assign certificates is the CreateAzureAppCertificate workflow. This workflow has a number of parameters that you can configure to alter the fields that appear when assigning certificates to your Azure applications. In this article, you do the following:
Configure the parameters of the CreateAzureAppCertificate workflow for your environment
Run the workflow to assign the certificate to an Azure application
Easy html macro | ||||
---|---|---|---|---|
| ||||
Configure workflow parameters
The workflow for creating Azure app client secrets is CreateAzureAppCertificate. The workflow has several parameters that affect field values. These parameters are listed in the below table. In this example, you set the DefaultAzureTenantID parameter to the Azure tenant with the applications for which you want to create secrets.
Excerpt | |||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| |||||||||||||||||||||||||||||||
|
To configure workflow parameters for your needs, do the following:
On the navbar, expand Object Administration and select Workflows.
Select the Workflow tab and search for Create Azure App Certificate.
Click the Display Name for the workflow.
Image ModifiedOn the Workflow Details page for the workflow, expand the Request Workflow Parameters accordion and click the edit button for the DefaultAzureTenantID parameter.
Image ModifiedEnter the Azure Tenant ID in the Value field and click Save.
Image ModifiedConfigure any other settings as needed.
Create the certificate for the application
From EmpowerID, append the base URL for the Web application with /#w/CreateAzureAppCertificate
. The full URL should look similar to https://api.empoweriam.com/ui/#w/CreateAzureAppCertificate
, where api.empoweriam.com
is the URL to your EmpowerID server.Navigate to the Resource Admin application portal for your environment.
Select Applications from the dropdown menu and then click the Workflows tab.
Click the Create Azure Application Certificate card.
Image Added
This opens the Create Azure Application Certificate wizard, which assists you with creating an Azure application certificate.
- Image Added
Select the Azure tenant where the target application is hosted.
Select the application
.
Click Submit.
Click Next.
Image AddedEnter the following information:
Certificate Name – Name of the certificate
Certificate Description – Description of the certificate
Secret Expiration – Select an expiration date for the secret
Certificate Base64 Encoded String – Paste in the base64 encoded string for the certificate you uploaded to EmpowerID
Select Location – Select a location for the certificate in EmpowerID. Default Organization is selected by default; if you wish to change this, click the Default Organization link and then search for and choose the desired location from the Location tree.
Vault this certificate – Select this option to store the certificate in EmpowerID
Enable sharing – Select this option to allow others to request access to the certificate; if this option is not selected, users cannot view or perform any actions against the certificate in EmpowerID
Client Secret Owner – Search for and select an EmpowerID Person to be the owner of the certificate. This is eternal to EmpowerID and has no meaning in Azure; however, the field is bound to people who have accounts in the specified Azure tenant.
Click
Next.
- Image Added
Review the information and click Submit.
You should see a fulfillment message stating that the certificate was successfully uploaded to Azure for the designated application.
Image ModifiedClick Submit to exit the wizard.
Verify the certificate in Azure
In your Azure tenant, navigate to Azure AD > App registrations.
Search for the application with the certificate you assigned in EmpowerID and click the Display Name link for it.
Image ModifiedUnder Manage, select Certificates & secrets and then select the Certificates tab.
Image Modified
You should see the new certificate.
View the certificate in EmpowerID
If you chose to vault and enable sharing for the certificate, the certificate owner can view the certificate and share it with others as needed.
On the navbar, expand Privileged Access and select Shared Credentials.
Select the All Shared Credentials tab and then search for the certificate you created.
You should see the record for the certificate.
Image Modified
Insert excerpt | ||||||
---|---|---|---|---|---|---|
|
Div | ||||||||||
---|---|---|---|---|---|---|---|---|---|---|
| ||||||||||
IN THIS ARTICLE
|