Azure Native Authentication

EmpowerID can be configured to enable users to authenticate using their Azure credentials and access EmpowerID, as well as single sign-on (SSO) into other applications where EmpowerID functions as the Identity Provider (IdP). Once a user authenticates, they can use SSO to access Service Provider applications like Salesforce or ServiceNow, streamlining the login experience. Additionally, EmpowerID supports seamless single logout (SLO), allowing users to sign out of all connected applications by logging out from any one of them.

Flow Overview

Login Scenario

1. The user navigates to Service Provider 1 (SP1) and is redirected to the EmpowerID login page.

2. The user selects Azure Native Authentication and logs in using their Azure credentials.

3. Once authenticated, the user can perform SSO into SP1, SP2, and SP3 without additional logins.

Open

Logout Scenario

When the user logs out from SP1, a series of coordinated logout requests and responses ensure that the user is logged out from all applications. The steps involved in this process are:

1. SP1 sends a logout request to EmpowerID.

2. EmpowerID sends a logout request to Azure.

3. Azure sends a logout response back to EmpowerID.

4. EmpowerID sends a logout request to SP2.

5. SP2 sends a logout response to EmpowerID.

6. EmpowerID sends a logout request to SP3.

7. SP3 sends a logout response to EmpowerID.

8. EmpowerID sends a final logout response to SP1, completing the process.

Open

Procedure

Step 1 – Set up Azure Native Auth

1. On the navbar, expand Apps and Authentication > SSO Connections and click OAuth / OpenID Connect.

2. Select the External OAuth Services tab and then search for AzureAD.

3. Click the Provider link for AzureAD.
   
   

    

   This directs your browser to the View One page for the AzureAD External OAuth Provider.
   
   

    

4. If you are not using EmpowerID SaaS do the following:

   1. On the View One page, click the Edit link for the AzureAD Provider.
      
      

       

   2. Replace the default values for the below endpoints with those you copied for your Azure app registration in the above Prerequisites steps.

      • Authorize URL (V1) – Replace the default with the OAuth 2.0 authorization endpoint (V1) for your Azure app

      • Request URL – Replace the default with the OAuth 2.0 token endpoint (V1) for your Azure app

      • Login URL (V2) – Replace the default with the OAuth 2.0 authorization endpoint (V2) for your Azure app

      • Access URL – Replace the default with the OAuth 2.0 token endpoint (V2) for your Azure app

      • Logout URL – Replace the default with https://login.microsoftonline.com/<TenantID>/oauth2/v2.0/logout?post_logout_redirect_uri={0} (Replace <TenantID> with your tenant's ID.)
        
        

         

      • Save your changes.

5. Back in the View One page, click the Edit button for the AzureAD record in the grid.
   
   

    

6. If you are not using EmpowerID SaaS, do the following:

   • Update the Consumer Key field with the Application (client) ID of the Azure app registration you created in the above Prerequisites steps.

   • Update the Consumer Secret field with the Secret ID of the secret you created for the Azure app registration in the above Prerequisites steps.

7. Update the Callback Url field with the FQDN of your EmpowerID server. The value entered should look similar to https://sso.empoweriam.com/WebIdPForms/OAuth/V2, where sso.empoweriam.com, is the FQDN of the EmpowerID web server in your environment.
   
   

    

8. Click Save.

9. On the navbar, expand Admin > Miscellaneous and click Lists.

10. From the Lists tab, search for Whitelisted and then click the Display Name link for the Azure Multi-Tenant Whitelisted Domains record.
    
    

     

11. Expand the Items accordion and then click the Add button in the grid header.
    
    

     

12. Add your domain as a List Item. Enter the domain name in all three fields.
    
    

     

13. Click Save.

14. On the navbar, expand Admin > Applications and Directories and click Account Stores and Systems.

15. Search for AzureGlobalIdP and then click the Account Store link for the record.
    
    

     

16. On the Account Store Details page that appears, click the Edit link to put the account store in edit mode.
    
    

     

17. From the Settings tab of the Edit Account Store page, go to the Provisioning Settings pane and locate the Default Person Business Role and Default Person Location settings.
    
    

     

18. Under Default Person Business Role, click the Select a Business Role link and then search for and select the desired Business Role for the Person objects EmpowerID provisions from the account store.

19. Click Save.

20. Under Default Person Location (leave blank to use account container, click the Select a Location link and then search for and select the desired location for the Person objects EmpowerID provisions from the account store.

21. Click Save.

Sep 2 – Configure domain-specific Business Role and Locations

1. On the navbar, expand Admin > Miscellaneous and click Lists.

2. From the Lists tab of the find ListDataItemSet page that appears, search for FQN and then click the Display Name link for FQN to BusinessRoleLocationMapping.
   
   

    

3. On the ListDataItemSet page, expand the Items accordion and click the Add button on the grid header.

4. In the List Items pane, add the following information:

   • Name / Key – Name of your domain

   • Display Name – Display name for your domain

   • Value – The OrgRoleOrgZoneID of the Business Role and Location combination in which you want people to be placed in.
     
     

      

5. Click Save.

Step 3 – Add a Login Button for Azure Native Authentication

1. On the navbar, expand Single Sign-On > SSO Connections and click SSO Components.

2. Select the IdP Domains tab and then click the IdP Domains link for the IDP Domain where you want the Login button to appear.
   
   

    

3. Select the External OAuth Providers tab and then select the Azure Native Authentication provider.
   
   

    

4. Click Save.