Configuring AzureAD as RapidIdentity Trusted IDP

RapidIdentity Platform Documentation
Solution
Application
Content Type
Technical Documentation
Utilities & Services
ft:locale
en-US

You can configure AzureAD as RapidIdentity Trusted IDP. This will allow you to utilize your AzureAD password as an Authentication Method in Authentication Policies.

  1. Configure AzureAD:
    1. Login to your Azure portal at https://portal.azure.com
    2. At the top, search for and then click on Azure Active Directory.
    3. In the left pane, click on Enterprise applications
    4. Click New Application
    5. Click Create your own application
    6. Enter App Name: RapidIdentity
    7. Leave the "Integrate any other application you don't find in the gallery (Non-gallery) checked.
    8. Click Create
    9. On the Overview page of your new RapidIdentity Enterprise application, click on Assign users and groups to only apply this configuration to your test user(s).
    10. Back on the Overview page, click on 2. Set up single sign on
    11. In Azure, click Upload metadata file and upload the RapidIdentity SP metadata located: https://<tenant url>/idp/sp-metadata.xml.
      This will populate the Basic SAML Configuration box with the RapidIdentity Entity ID and ACS URL
    12. In the User Attributes & Claims, you can leave the defaults.
    13. Download the certificate in Base64 format, then copy the Login URL, and the Azure AD Identifier. You will need these for RapidIdentity configuration.
  2. Configure RapidIdentity:
    1. From RapidIdentity, browse to Configuration > General > Settings
    2. On the CORS page, set https://login.microsoftonline.com as an Allowed Origin
    3. Browse to Configuration > Security > Identity Providers > Trusted IDPs and click on Add Trusted Identity Provider.
    4. Plugin the Azure Entity ID, Login URL, and Certificate into the appropriate fields
      The value for Signing Certificate can be retrieved by opening the Azure certificate in Notepad or from the Azure Metadata XML. It will be enclosed in <X509Certificate></X509Certificate> tags in the Metadata file.
    5. On the attribute mappings, create mappings for user.givenname, user.surname, user.mail, and user.userprincipalname
    6. Click Save
    7. Browse to Configuration > Policies > Authentication to create an authentication policy to force your test user to use the Trusted IDP configuration.

You should now be ready to test logging in with your test account.

If you receive a page that only has the "Start Over" button, that means that either your attribute mappings are incorrect or the Signing Certificate you are using in RI's Trusted IDP config is incorrect.

  • For attribute mappings, try changing the nameID from user.userprincipalname to user.mail in your Azure Enterprise application configuration.
  • For the Signing Certificate, you can get the correct format for the certificate from the Azure Metadata XML file which is enclosed in the <X509Certificate></X509Certificate> tags.