Skip to content

Improve a few steps configuring SSO on Azure #1767

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 14 commits into from
Sep 12, 2024
Merged

Improve a few steps configuring SSO on Azure #1767

Changes from 7 commits
Commits
Show all changes
14 commits
Select commit Hold shift + click to select a range
fb893f8
Improve a few steps configuring SSO on Azure
NataliaIvakina Aug 14, 2024
8eac846
Rewrite the instructions
NataliaIvakina Aug 19, 2024
43b6df3
Update modules/ROOT/pages/tutorial/tutorial-sso-configuration.adoc
NataliaIvakina Aug 26, 2024
8700d53
Apply suggestions from code review
NataliaIvakina Aug 26, 2024
a32e541
Update tutorial-sso-configuration.adoc
NataliaIvakina Aug 27, 2024
98e4852
Apply suggestions from code review
lidiazuin Aug 27, 2024
9311b5b
Apply suggestions from code review
lidiazuin Aug 27, 2024
ad41817
One more attempt
NataliaIvakina Aug 30, 2024
da9c5da
Update modules/ROOT/pages/tutorial/tutorial-sso-configuration.adoc
NataliaIvakina Aug 30, 2024
d0b4e8e
Apply suggestions from code review
NataliaIvakina Aug 30, 2024
45c52a8
Add more details to the step *Add a scope*
NataliaIvakina Aug 30, 2024
11d7b31
Update tutorial-sso-configuration.adoc
NataliaIvakina Aug 30, 2024
c60988e
Update modules/ROOT/pages/tutorial/tutorial-sso-configuration.adoc
NataliaIvakina Sep 12, 2024
9238351
Update modules/ROOT/pages/tutorial/tutorial-sso-configuration.adoc
NataliaIvakina Sep 12, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
42 changes: 27 additions & 15 deletions modules/ROOT/pages/tutorial/tutorial-sso-configuration.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -132,29 +132,41 @@ image::sso-configuration-tutorials/okta-sign-on-tab.svg[title="Okta's sign-on ta

This example shows how to configure Entra ID for authentication and authorization using an access token.

. Set parameters to be `access_token`:
. Assuming that you have already created and registered your SSO application in Azure, you should now configure a token in Entra ID using the *Token configuration* tab.

. Next step is to go to the **Expose an API** tab and click the **Add a Scope** button.
+
You need to know your Essentials located in the GUID -- Globally Unique Identifier.
+
.The GUID is used to identify specific resources or instances within Azure. You can find it on the app registration page.
image::sso-configuration-tutorials/azure-id.svg[]
+
If you click the **Add a Scope** button for the first time, you see a new window stating that you need to add an _Application ID URI_ before proceeding:
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
If you click the **Add a Scope** button for the first time, you see a new window stating that you need to add an _Application ID URI_ before proceeding:

Copy link
Collaborator Author

@NataliaIvakina NataliaIvakina Aug 30, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

why do you want to remove this step but suggest to add the step 'Save and continue'? I don't understand the degree of detail.

+
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
+

[source]
----
api://4376dc8b-b5af-424f-9ada-c1c1b2d416b9/access-token
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think the screenshot is enough. We don't need to have it in a code format as well as it is different for every app.

----

. Next fill in all mandatory fields in the panel **Add a scope** and copy your scope which will be used for _neo4j.conf_ file.
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
. Next fill in all mandatory fields in the panel **Add a scope** and copy your scope which will be used for _neo4j.conf_ file.
. Fill in all mandatory fields in the window **Add a scope** and make a note of them.


. Configure Neo4j by adjusting the following settings in the _neo4j.conf_ file:
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
. Configure Neo4j by adjusting the following settings in the _neo4j.conf_ file:
. Configure Neo4j to use Entra ID for authentication by configuring the following settings in the _neo4j.conf_ file:


.. Set parameters to be `access_token`:
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
.. Set parameters to be `access_token`:

+
[source, properties]
----
dbms.security.oidc.azure.config=principal=unique_name;code_challenge_method=S256;token_type_principal=access_token;token_type_authentication=access_token
----

. Add the following parameter:
.. Add the following parameter:
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
.. Add the following parameter:

+
[source, properties]
----
dbms.security.oidc.azure.token_endpoint=https://login.microsoftonline.com/54e85725-ed2a-49a4-a19e-11c8d29f9a0f/oauth2/v2.0/token
----
+
[NOTE]
====
The GUID is the directory (tenant) ID.
You can find it on the app registration page:

image::sso-configuration-tutorials/azure-id.svg[]
====

. Include the issuer:
.. Include the issuer:
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
.. Include the issuer:

+
[source, properties]
----
Expand All @@ -163,20 +175,20 @@ dbms.security.oidc.azure.issuer=https://sts.windows.net/54e85725-ed2a-49a4-a19e-
+
[NOTE]
====
As previously mentioned, the GUID here is also the directory (tenant) ID.
As previously mentioned, the GUID here is also the Directory (tenant) ID.
Make sure you add the trailing slash (`/`) at the end or this operation might fail.
====

. Go to the "Expose an API" tab and click "Add a Scope" to include the following statement:
.. Include the following statement:
+
[source, properties]
----
dbms.security.oidc.azure.params=client_id=4376dc8b-b5af-424f-9ada-c1c1b2d416b9;response_type=code;scope=openid profile email api://4376dc8b-b5af-424f-9ada-c1c1b2d416b9/access-token
----

. Add the value in the scope column to the scopes in the configuration.
+
Note that the audience parameter for access tokens are typically set with` api://` at the front.


=== ID token

This example shows how to configure Entra ID for authentication and authorization using ID tokens.
Expand Down