Configuring Azure Active Directory as an SAML Identity provider

In this procedure, you will configure Azure AD as an SAML Identity provider, and create and configure an Authentication server on an SMA appliance.

To configure Azure AD as an SAML Identity provider, do the following

1. In the AMC, navigate to System Configuration > Authentication Servers.

2. Click New.

   

3. Click SAML 2.0 Identity Provider.

4. Under Identity Provider Configuration, click Choose File and select the downloaded metadata.xml

   

5. Click Import.

   1. All the IDP configuration fields are filled with the respective values including IDP certificate.

      Options Server ID, Authentication service URL and Trust the following certificate is automatically filled based on uploaded file.

      When you are importing the metadata file under authentication server, the CA certificate for SAML verification is enabled by default. In addition, the imported CA certificates under SSL Settings > CA Certificate with SAML verification enabled will be displayed.

      The Logout service URL field is for logging out IDP and SAML together. However if you can keep this field empty, so that the IDP remains active and only SAML application gets logged out.

   2. SMA supports group membership details over SAML authentication and users without on-premise Active Directory can now have group level management. In the SAML claim containing user groups field, specify the name of the claim that contains the group information. For example: http://schemas.microsoft.com/ws/2008/06/identity/claims/groups.

      The SAML claim containing user groups field is configured with user group attribute name, for more information, refer to the Group Management with SAML IdP authentication server section.

   3. Enable Force users to re-authenticate in case they need to provide their credentials each time they log into SMA.

6. Click Save.