Skip to main content
Version: 96.2
Enterprise

Microsoft Entra ID

Microsoft Entra ID, formerly known as Azure Active Directory (Azure AD)

User authentication​

Configuring Microsoft Entra ID​

  1. Open the Microsoft Entra admin center and select the directory to use for single sign-on.
  2. Navigate to Enterprise apps
  3. Click New application and then Create your own application.
  4. Pick a name for the Kpow instance that you are securing and select the Integrate any other application you don't find in the gallery (Non-gallery) option.
  5. You should now be in the dashboard for the enterprise application for Kpow.
  6. Go to Manage > Single sign on, select SAML as the single sign-on method.

Basic SAML configuration​

  • Identifier (Entity ID): Set this to a suitable name for the instance you are securing, e.g. Kpow-UAT-1.
  • Reply URL (Assertion Consumer Service URL): The /saml endpoint for your Kpow instance, e.g., https://kpow.corp.com/saml
  • Leave the other fields blank

SAML certificates​

Download the Federation Metadata XML file.

Assign users and/or groups​

Assign users and/or groups to grant them access the Enterprise application, otherwise they'll receive an error after signing-in to their directory account rather than be redirected to your Kpow instance:

  1. Open the Microsoft Entra admin center and select the directory
  2. Navigate to Enterprise apps and select the Enterprise application created above
  3. Navigate to Manage > Users and groups and click Add user/group and complete the steps there

Product configuration​

Add the following configuration variables and start Kpow:

AUTH_PROVIDER_TYPE=saml
SAML_RELYING_PARTY_IDENTIFIER=[Identifier (Entity ID)]
SAML_ACS_URL=[Reply URL (Assertion Consumer Service URL)]
SAML_METADATA_FILE=[Path to downloaded Federation Metadata XML]

Kpow will now authenticate users with Microsoft Entra ID.

User authorization​

See the guide to Role Based Access Control for full configuration details.

Using Entra groups for RBAC​

Follow the guide to Add group claims to tokens for SAML applications using SSO configuration

Screenshot of adding a group claim within the Microfost Entra admin center with the "Add a group claim" button highlighted

Then set the role mapping in your RBAC configuration to:

saml:
  role_field: "http://schemas.microsoft.com/ws/2008/06/identity/claims/groups"

Entra groups overage claim​

warning

Entra's SAML token "groups" claim has a limit of 150 groups, after which a groups "overage" claim replaces the standard groups claim.

If the maximum number of Entra groups for any of your Kpow users exceeds 150, you'll need to create OAuth 2.0 client credentials for the Entra Enterprise app, grant it extra API permissions, obtain your directory's Tenant ID, and update your Kpow configuration

Create OAuth 2.0 client credentials​

Follow the guide to Add a client secret to your Enterprise app, ensuring you copy the client secret's value (not ID)

Screentshot of an Entra Enterprise app's regitration's Certificates & secrets

Add API permissions​

Follow the guide to Add permissions to an application to add these Microsoft Graph API permissions:

  • User.Read.All
  • GroupMember.Read.All

Ensure you also grant consent for the added permissions

Screentshot of an Entra Enterprise app's regitration's API permissions showing the User.Read.All and GroupMember.Read.All permissions both having been granted

Obtain tenant ID​

Follow the guide to finding your Microsoft Entra tenant ID

Switch to the saml-entra authentication provider​

Change to AUTH_PROVIDER_TYPE=saml-entra and provide values for MICROSOFT_GRAPH_CLIENT_ID, MICROSOFT_GRAPH_CLIENT_SECRET, and ENTRA_TENANT_ID as described below:

# NB Change from saml → saml-entra
AUTH_PROVIDER_TYPE=saml-entra

SAML_RELYING_PARTY_IDENTIFIER=[As previously configured]
SAML_ACS_URL=[As previously configured]
SAML_METADATA_FILE=[As previously configured]

MICROSOFT_GRAPH_CLIENT_ID=[Application (client) ID from the App registrations entry]
MICROSOFT_GRAPH_CLIENT_SECRET=[Client secret value from the Certificates & secrets entry]
ENTRA_TENANT_ID=[Tenant ID]
# Whether to return only security enabled groups (defaults to true)
ENTRA_SECURITY_ENABLED_ONLY=true

Using Entra assigned roles for RBAC​

  • Follow this Microsoft guide to populate user.assignedroles In your Enterprise Application, navigate to Single sign-on > Attributes & Claims > Edit:

  • Required Claim: Set Unique User Identifier (Name ID) to user.userprincipalname

  • Select Add new claim, set the Name to Roles, leave Namespace blank, and set the Source attribute to user.assignedroles

Assign users to roles​

Navigate to Users and groups, select a user, click Edit assignment, and assign the appropriate role.

Note: Microsoft Entra ID does not pass the default role (User) as an assigned role in the SAMLResponse.