We have some applications that currently use Axiomatics for fine grain authorization and it uses the LDAP connector to check for user attributes / group membership. We are exploring the migration of on premise LDAP users to Azure AD B2C, however currently Axiomatics policy enforcement connects to this LDAP. Is it possible for Axiomatics to use Azure AD API instead of LDAP ??
Yes I believe there is an HTTP connector you can use to talk to rest services. You can combine it with the JSON parser to Parse the response from azure AD.
Related
How to secure your APIs using Azure Active Directory SSO Implementation using SAML 2.0?
You can Protect an API in Azure API Management using OAuth 2.0 authorization with Azure Active Directory
Hope this help!
We have an application running on Tomcat currently and using LDAP as the means to authenticate users to our enterprise AD.
It is required to migrate this application to cloud (on AWS EC2) and to integrate with ADFS over SAML for login with MFA enabled.
Wondering if there are any guides on the the steps to be followed to make this happen ? What are the configurations that I need to enable in ADFS for my application and what configuration changes are needed on tomcat server.xml to have the connector integrate with ADFS rather than LDAP. Thanks.
Regards,
Raunak
Not a Tomcat guru but from the point of view of ADFS and SAML:
You need to use a client-side SAML stack in your application. This provides the SAML plumbing.
You then need to add a SAML RP to ADFS.
For MFA, typically you use Azure AD to provide the MFA.
(There used to be an on-premises ADFS MFA Server - that is now deprecated).
If that is not an option, there are third-party providers.
I am looking for the LDAP settings I would use to access Azure AD. We do not use AD on premise, AD FS, nor the Azure AD Connector. I have a 3rd party application, zixcorp, that can utilize azure ad security groups. Settings I have found and I assume I can use would be;
Username & Password; I have configured in AD Azure users.
Domain: mydomain-com.protection.office.com ...possibly mydomain-com.ldap.protection.office.com
Port: 389 or 636
Search Base: ???? Not sure what to enter here
Domain: ????? office.com? Not sure here either.
Any help would be appreciated. thanks,
Azure AD, by itself, does not expose any LDAP endpoints. Azure AD is not Windows Server Active Directory, running on Azure.
If your application absolutely positively must use LDAP(S) (rather than the REST API or group claims), then you can deploy Azure AD Domain Services. This will sync your Azure AD tenant into a managed Window Server AD deployment which you can access via LDAP(S) for read operations: Configure secure LDAP for an Azure AD Domain Services managed domain.
I'm currently developing a API to commercialized in a B2B SAAS fashion.
The goal is to authenticate the worker of the company. We have an SDK that should be able to do that. There is the possibility to force each user to set credentials specific for our service, but that will hurt integration with companies applications.
The idea would be to have some kind of authentication (client independent) that make it easier to authenticate users.
The question is: There is a easy way to create an automatic process that does not depend on the client type of authentication methods, for this type of task?
Thanks in advance.
Have you taken a look at Azure AD? It specifically supports multi-tenant scenarios.
Tenants can use Azure AD Connect to sync their on-premise directory to the cloud. Clients can use ADAL to acquire a token which your service trusts. The issued token contains a tenant-id claim indicating via which tenant the user logged in.
Just to add to MvdD answer, in Azure AD support three ways to sign in:
Federated Single Sign-On enables applications to redirect to Azure AD
for user authentication instead of prompting for its own password.
This is supported for applications that support protocols such as SAML
2.0, WS-Federation, or OpenID Connect, and is the richest mode of single sign-on.
Password-based Single Sign-On enables secure application password
storage and replay using a web browser extension or mobile app. This
leverages the existing sign-in process provided by the application,
but enables an administrator to manage the passwords and does not
require the user to know the password.
Existing Single Sign-On enables Azure AD to leverage any existing
single sign-on that has been set up for the application, but enables
these applications to be linked to the Office 365 or Azure AD access
panel portals, and also enables additional reporting in Azure AD when
the applications are launched there.
I need to run .NET applications in Azure and have them authenticate against my on-premise directory (via PingFederate). It appears that ACS is the only way to do federated authentication from Azure, even though it has been deprecated for over a year. It also seems that ACS does not support OpenID Connect.
So am I correct in thinking it is not possible to do federated authentication via OpenID connect from Azure? And does anyone know when federation with external identity providers will be added to Azure AD?
Federated authentication is supported by Azure AD. Most of our enterprise customers connect their Azure Active Directory to their on-premises directory for federated authentication with Office 365 and other SAAS apps connected with Azure AD.
You can indeed federated your Azure AD with PingFederate and use Azure AD' OpenIDConnect protocol to configure single sign on for your cloud application.
Sign-up for a free trial Azure subscription and create a directory. Use the documentation here (http://msdn.microsoft.com/library/azure/jj673460.aspx) and the following sample app (https://github.com/AzureADSamples/WebApp-OpenIDConnect-DotNet) to connect your app' authentication with your directory using OpenIDConnect.
Then, add a verified domain to your directory and federate it with your PingFederate STS by following the guidance here (http://documentation.pingidentity.com/display/PFS/SSO+to+Office+365+Introduction).
We don't recommend using ACS for this scenario.
Hope this helps.