Implement SSO with Azure AD in existing application

What is Azure AD & How to use Azure Active Directory?

Azure Active Directory (Azure AD) stands as an innovative cloud-driven identity as a service (IDaaS) solution, carving a path into the future of secure digital identity management. Operating as a fortified online repository, it not only houses individual user profiles but also orchestrates collections of user profiles into seamlessly integrated groups. This dynamic platform has been meticulously crafted to wield its authority in governing access to a spectrum of cloud-based applications and servers.

Azure AD distinguishes itself through its adept utilization of cutting-edge authentication protocols. These protocols include the robust Security Assertion Markup Language (SAML) 2.0, the versatile OpenID Connect, the authorization powerhouse OAuth 2.0, and the interoperable WS-Federation. Through the adoption of these modern authentication standards, Azure AD ensures that the access management landscape is not only secure but also aligned with the evolving needs of contemporary digital ecosystems.

In essence, Azure AD emerges as a pivotal force, harmonizing the delicate balance between robust security measures and the fluidity demanded by cloud-based applications. This platform is not merely a guardian of user identities; it is a forward-looking enabler, empowering organizations to navigate the complexities of the digital realm with confidence and efficiency.

Table of Content:
1. What is Azure active directory
2. MFA in Active directory
3. Azure AD Use case
4. Azure AD SSO Setup
Step1 : Prerequisites
Step2 : Enable the SSO Feature
Step3 : Verify
5. FAQs

What is Azure AD SSO?

What is SSO with Azure AD – Azure AD Single Sign-On (SSO) represents a distinctive feature within Azure AD, facilitating users in effortlessly accessing SaaS applications. This functionality empowers each user with a holistic entry to their requisite suite of applications, eliminating the need for repetitive logins into each distinct application. Azure AD orchestrates the generation of an access token, serving as a cryptographic key securely housed on the user’s device. These tokens boast a customizable expiration, introducing a time-sensitive dimension to their validity.

Multi-Factor Authentication Option in Azure AD

In the pursuit of bolstering security measures, Azure AD stands out by introducing the option to mandate multi-factor authentication (MFA). This fortified authentication method necessitates users to validate their identity through a combination of diverse factors, ranging from passwords and biometrics to verification codes. In essence, Azure AD’s commitment to security extends beyond the conventional, ensuring a multi-layered defense against unauthorized access.

Azure AD SSO Use case

Imagine a person who needs to use a business app at their workplace, and it’s located on the company’s own servers. To make things smoother, the company uses two systems: one on their premises called Microsoft Active Directory and another online called Azure AD. They’ve cleverly set up a mix of both by using Azure AD Seamless Single Sign-On (SSO) with the help of Azure AD Connect.

In this setup, the system on the premises (Microsoft Active Directory) and the online one (Azure AD) work together seamlessly. Thanks to Azure AD Seamless SSO, the person doesn’t have to remember different passwords. Instead, they can use the same login details they use at work to easily get into the business app through Azure AD.

Hybrid SSO authentication process

1. The person types the business app’s address into their web browser while using a computer in the company office.
2. They are taken to the Azure AD login page.
3. On this page, the person enters their username.
4. Azure AD then asks the web browser to show a Kerberos ticket.
5. The web browser, in turn, requests a Kerberos ticket specific to the local Azure AD SSO account on the computer. This account is made in Microsoft Active Directory during the setup of Azure AD Seamless SSO.
6. Microsoft Active Directory hands over the Kerberos ticket for the local Azure AD SSO account. It’s encrypted with a secret tied to that local account.
7. The browser sends the encrypted Kerberos ticket back to Azure AD.
8. Azure AD unlocks the Kerberos ticket using a shared key established during the initial configuration of Azure AD Seamless SSO.
9. If the ticket is okay, Azure AD allows access and sends back an authentication token to the browser.
10. Now, the person can log into the business app without having to type in their password again.

Azure Single Sign-On Options

Various methods exist to set up Single Sign-On (SSO) for applications, and the one you choose depends on how the specific application handles authentication.

For instance, cloud applications might utilize OAuth, OpenID Connect (OIDC), or SAML for authentication, whether SSO is turned on or off. In contrast, an on-premises application could rely on authentication through headers, passwords, IWA SSO, or linked SSO. If you’re dealing with on-premise options, it’s necessary to configure the application for Azure Application Proxy.

Azure AD supports Single Sign-On (SSO) through various authentication protocols, providing flexibility for different application scenarios:

1- OAuth/OpenID Connect: Opt for the OIDC option based on OAuth 2.0 for applications supporting this mechanism. Detailed information about these options is available in the OpenID Connect and OAuth 2.0 protocols. Additional insights can be found in the guide to OAuth flows.

2- SAML: This is the preferred choice for applications that don’t support OIDC/OAuth. The SSO SAML protocol furnishes details about this alternative. Further guidance is available in the guide to SAML.

3- Password-based SSO: Suited for applications with HTML sign-in pages, this method, known as password vaulting, empowers administrators to manage users’ access permissions and passwords for web apps lacking federated identities. It proves useful for handling a single account shared by multiple users (e.g., a social media account). Password-based SSO accommodates applications with multiple sign-in fields, offering customization for field labels beyond the standard username and password.

4- IWA SSO (Integrated Windows Authentication): Utilize single sign-on with Integrated Windows Authentication for applications employing IWA or claims-aware.

5- Header-based SSO: This option is suitable for applications relying on headers for authentication.

6- Linked SSO: Employ the linked SSO method for applications configured for single sign-on in a third-party identity provider. This allows administrators to configure the target location when users select an application in the organization’s portal. Links to custom web applications already using identity federation (e.g., Active Directory Federation Services) can be added. It’s also possible to add links to specific web pages appearing on the user’s access panel. However, this option doesn’t support SSO functionality using Azure AD user credentials.

7- Disabled SSO: An admin may choose to disable SSO if the application isn’t ready for SSO configuration.

Setting up Azure AD Single Sign-On (SSO)

How to Set Up Azure AD SSO, Setting up Single Sign-On (SSO) in Azure AD involves several steps. Below is a high-level overview of the key step.

How to configure SSO with Azure Active Directory.

Step 1: Set Up the Prerequisites

Setting up Single Sign-On (SSO) in Azure AD typically begins with configuring the prerequisites. Here are the key steps for this initial phase:

1. Azure AD Subscription:
   • Ensure you have an active Azure AD subscription. If not, sign up for Azure AD and create a new directory if needed.
2. Administrative Access:
   • Have administrative access to the Azure portal with the necessary permissions to configure SSO settings.
3. Application Access:
   • Identify the application for which you want to set up SSO. Make sure you have access to the application’s configuration settings or admin console.
4. Application Integration Support:
   • Verify that the chosen application supports SSO integration with Azure AD. Review the application’s documentation or contact the vendor for compatibility information.
5. Authentication Method:
   • Decide on the authentication method for SSO (e.g., SAML, OAuth, OpenID Connect). The method may depend on the application’s capabilities and requirements.
6. User Attributes and Claims Mapping:
   • Understand the user attributes and claims required by the application. Plan how these attributes will map between Azure AD and the application during the SSO process.
7. Network and Firewall Configuration (if applicable):
   • If the application is hosted on-premises, ensure that network and firewall configurations allow communication between Azure AD and the application.
8. Secure Connection (HTTPS):
   • Ensure that the application supports a secure connection (HTTPS) for SSO. This is a common requirement for secure authentication.
9. Application URL and Sign-Out URL:
   • Gather the application’s URL and sign-out URL. These will be needed during the SSO configuration process in Azure AD.
10. Review Documentation:
    • Review the Azure AD documentation specific to the chosen SSO method and the documentation provided by the application vendor.
11. Communication Plan:
    • Plan for communication with end-users. Inform them about the upcoming SSO implementation, any changes they might experience, and provide relevant training or documentation.

By completing these prerequisites, you establish a solid foundation for the subsequent steps in configuring SSO in Azure AD. Each application and SSO method may have specific requirements, so be sure to consult the documentation for detailed guidance.

Step 2: Enable the SSO Feature in Azure AD

This step involves enabling seamless SSO via Azure AD Connect. If freshly installing Azure AD Connect, select the custom installation option. Select Enable single sign-on on the User sign-in page.

Image Source: Azure

If Azure AD Connect is already installed, go to Change user sign-in in Azure AD Connect and choose Next. The default selection is Enable single sign-on for versions 1.1.880.0 and up of Azure AD Connect. For older Azure AD Connect versions, it is necessary to select this option explicitly.

Step3 – Use the following steps to verify that seamless SSO is working correctly.

1. Log in to the Azure AD admin center using the main admin credentials.
2. Click on “Azure Active Directory” on the left side.
3. Select “Azure AD Connect.”
4. Verify that the “Seamless single sign-on” option is marked as Enabled.

Image Source: Azure

FAQ’s

Q1. What are the benefits of Azure AD SSO?

Azure AD simplifies access for users by allowing them to use a single set of credentials to access various services and applications. This eliminates the hassle of remembering and managing different usernames and passwords for each application. This streamlined approach enhances convenience and productivity for users.

Q2. What is SSO and how it works?

Single sign-on (SSO) is a technology that merges multiple application login screens into one. With SSO, users only need to enter their login credentials (such as username and password) once on a single page. This grants them access to all their Software as a Service (SaaS) applications without having to repeatedly log in for each application.

Q3. What is an example of a single sign-on?

The user only needs to sign in once, and this is why it’s called Single Sign-On (SSO). As an illustration, when you log in to a Google service like Gmail, you are automatically authenticated for other Google applications such as YouTube, AdSense, Google Analytics, and more. SSO simplifies the login process and provides a seamless experience across multiple interconnected services.

Q4. How does SSO work in AD?

The Active Directory Single Sign-On (SSO) process operates as follows:

1. SSO Agent Initiates Contact:
   • The SSO Agent initiates communication with the Exchange Monitor, a component likely managing user-related information.
2. User Information Exchange:
   • The Exchange Monitor responds by providing user details to the SSO Agent. This information typically includes the user’s identity.
3. User Verification:
   • The SSO Agent checks whether the user is presently logged in to the Exchange Server, referring to a maintained list of active users.
4. Authentication Notification:
   • If the user is indeed logged in, the SSO Agent signals the Firebox, a network security device, to confirm the user’s authentication status.
5. User Authentication Acknowledgment:
   • The Firebox acknowledges the user’s authentication status received from the SSO Agent, enabling the user’s access to secure resources.

In summary, the SSO Agent, Exchange Monitor, and Firebox collaborate to verify and authenticate users seamlessly. The process involves exchanging user information, checking login status, and notifying network security components to permit access based on authenticated user status.

Q5. What are the disadvantages of SSO?

Using a single password increases the chances of password vulnerability. Reduces the load of memorizing several passwords. When SSO fails, access to all related systems is lost.

Q6. Is SSO a security risk?

With Single Sign-On (SSO) implemented, the convenience for users lies in logging in once, gaining automatic access to all linked applications, systems, data sets, and environments provisioned for the authenticated user. However, this very feature that makes SSO advantageous for users also introduces significant security risks. If a malicious user obtains initial access to an authenticated SSO account, they inherently gain access to the entirety of linked resources, amplifying the potential for unauthorized activities and data breaches.

Q7. What are the 4 types of Azure AD?

Visit Microsoft Azure AD for details

Q8. What is the difference between AD and Azure AD?

Azure AD manages access for external partners and customer-facing applications while AD focuses on internal user management.

Q9. Does Azure AD SSO use SAML?

Yes, user can set up SAML single sign-on (SSO) in Password Manager Pro for Azure AD users.