Azure Active Directory

To integrate the Axon Ivy Engine with Azure Active Directory as an Identity Provider, you first need to create an application in Azure Active Directory. From which you need at least the following settings:

  • the TenantId (Directory (tenant) ID)

  • the ClientId (Application ID) and

  • the ClientSecret (Secret Value).

It is sufficient to copy the following template and adjust the values. The Engine Cockpit offers a detailed configuration page to connect to Azure Active Directory.

Template

 1# Azure Active Directory as an Identity Provider for the 'default' Security System
 2# [engineDir]/configuration/ivy.yaml 
 3SecuritySystems:
 4  default:
 5    IdentityProvider:
 6      Name: azure-active-directory
 7      Config:
 8        TenantId: 03a6b499-b98a-4e6e-b422-00a84144c5e0
 9        ClientId: cd5b4637-9be8-4008-94ea-23ed80c56820
10        ClientSecret: "${encrypt:1234}"
11        GroupFilter: y4zb4273-gbr7-6068-66da-11ac414hc5e2
12
13        Roles:
14          Manager: 208e37b6-f34c-4026-bae5-c3aa40bec705
15          Employee: 903a8e76-2922-4fde-92e5-fb361cf3bc4e
16
17        UserAttribute:
18          FullName: displayName
19          Properties:
20            phoneNumber: mobilePhone
21
22        Proxy:
23          Url: https://proxy.local
24          UserName: proxyUser
25          Password: "${encrypt:proxyPassword}"

Reference

 1# Azure AD Tenant ID
 2TenantId: ""
 3
 4# Client ID provided by Azure AD when registering the application
 5ClientId: ""
 6
 7# Client key provided by Azure AD when registering the application
 8ClientSecret: ""
 9
10# Object ID of a group which users needs to belong to
11# [directoryBrowser]
12GroupFilter: ""
13
14# Role mapping that is considered by the user synchronization.
15# Users are added to the roles to which they are assigned in.
16# The left side, e.g. Manager, specifies the unique name of the role defined in Axon Ivy.
17# On the right side, e.g. 208e37b6-f34c-4026-bae5-c3aa40bec705, the UUID of the role in Azure AD.
18# The synchronization adds all users to Manager that are assigned to 208e37b6-f34c-4026-bae5-c3aa40bec705
19# [keyvalue:Ivy Role,Azure Group GUID]
20# [directoryBrowser]
21Roles:
22  #Manager: 208e37b6-f34c-4026-bae5-c3aa40bec705
23
24UserAttribute:
25  # Microsoft Entra ID property which will be mapped to the Ivy User FullName
26  # You also can concatenate multiple Microsoft Entra ID properties here, like "surname givename"
27  # Attributes are described here: https://learn.microsoft.com/en-us/graph/api/resources/user?view=graph-rest-1.0
28  FullName: displayName
29  # User property mapping of Azure AD attributes that are imported and available as user properties (IUser.getProperty).
30  # The left side, e.g. phone, specifies the unique name of the user property in Axon Ivy.
31  # On the right side, e.g. mobilePhone, the name of the attribute of a user in Azure AD. All available
32  # attributes are described here: https://learn.microsoft.com/en-us/graph/api/resources/user?view=graph-rest-1.0
33  # You can also use onPremisesExtensionAttributes 1-15. Therefore you need to define the Azure Property specific
34  # extension attribute with the number e.g. extensionAttribute3 or extensionAttribute14
35  # [keyvalue:User Property,Azure Property]
36  Properties:
37    #phoneNumber: mobilePhone
38    #homeTown: extensionAttribute14
39
40Proxy:
41  # Url of the forward proxy
42  Url: ""
43  # Username to authenticate against the forward proxy 
44  UserName: ""
45  # Password to authenticate against the forward proxy
46  Password: ""