|
| 1 | +--- |
| 2 | +title: Enabling Azure AD SSO connections with your OVHcloud account |
| 3 | +slug: connect-saml-sso-azure-ad |
| 4 | +excerpt: "Find out how to associate your Azure Active Directory to your OVHcloud account using SAML 2.0" |
| 5 | +section: 'Advanced use' |
| 6 | +order: 02 |
| 7 | +updated: 2023-04-05 |
| 8 | +--- |
| 9 | + |
| 10 | +**Last updated 5th April 2023** |
| 11 | + |
| 12 | +## Objective |
| 13 | + |
| 14 | +You can use **Single Sign-On** (SSO) to connect to your OVHcloud account. To enable these connections, your account and your Azure AD have to be configured using SAML (*Security Assertion Markup Language*). |
| 15 | + |
| 16 | +**This guide explains how to associate your OVHcloud account with an external Azure AD.** |
| 17 | + |
| 18 | +## Requirements |
| 19 | + |
| 20 | +- Belong to the **Application Administrator** and **User Administrator** roles of an Azure AD service |
| 21 | +- An [OVHcloud account](https://docs.ovh.com/asia/en/customer/create-ovhcloud-account/) |
| 22 | +- Access to the [OVHcloud Control Panel](https://ca.ovh.com/auth/?action=gotomanager&from=https://www.ovh.com/asia/&ovhSubsidiary=asia) |
| 23 | + |
| 24 | +## Instructions |
| 25 | + |
| 26 | +> [!primary] |
| 27 | +> |
| 28 | +> In order for a service provider (i.e. your OVHcloud account) to establish an SSO connection with an identity provider (i.e. your Azure AD), the essential part is to establish a mutual trust relationship by registering the SSO connection in both services. |
| 29 | +> |
| 30 | +
|
| 31 | +### Azure AD Users and Groups |
| 32 | + |
| 33 | +Your Azure AD acts as your identity provider. Authentication requests by your OVHcloud account will only be accepted if it is declared as a trusted party first. |
| 34 | + |
| 35 | +Let's focus for a moment on the identities on the identity provider side. |
| 36 | + |
| 37 | +#### Azure AD Users |
| 38 | + |
| 39 | +To start, go to your Azure AD dashboard. |
| 40 | + |
| 41 | +{.thumbnail} |
| 42 | + |
| 43 | +Then click on `Users`{.action} from the left-hand menu. |
| 44 | + |
| 45 | +{.thumbnail} |
| 46 | + |
| 47 | +Create as many users as you need, or you can just check your users clicking on them. |
| 48 | + |
| 49 | +For this example, the user **John Smith** will be used. |
| 50 | + |
| 51 | +{.thumbnail} |
| 52 | + |
| 53 | +When an SSO authentication is performed, **John Smith**'s identity will be provided by Azure AD to the OVHcloud account. However, it is necessary that this identity contains at least one group. If no group exists, let's look at how to create one to add **John Smith** to it. |
| 54 | + |
| 55 | +#### Azure AD Groups |
| 56 | + |
| 57 | +Click on `Groups`{.action} from the left-hand menu. |
| 58 | + |
| 59 | +{.thumbnail} |
| 60 | + |
| 61 | +Click on `New group`{.action} in the top menu, and fill in all the necessary information. |
| 62 | + |
| 63 | +For this example, the group **manager@ovhcloudsaml** will be used. |
| 64 | + |
| 65 | +{.thumbnail} |
| 66 | + |
| 67 | +Click on the `Create`{.action} button to display all information about this group. |
| 68 | + |
| 69 | +{.thumbnail} |
| 70 | + |
| 71 | +Now, users who will be used for SSO authentication must be added to a group. |
| 72 | + |
| 73 | +In this example, let's link the user **John Smith** with the group **manager@ovhcloudsaml**. |
| 74 | + |
| 75 | +In the selected group interface, click on `Members`{.action} from the left-hand menu, then click `Add members`{.action} in the top menu. |
| 76 | + |
| 77 | +{.thumbnail} |
| 78 | + |
| 79 | +Select the user to be added to this group, then click on the `Select`{.action} button. |
| 80 | + |
| 81 | +{.thumbnail} |
| 82 | + |
| 83 | +Now we have a user assigned to a group. |
| 84 | + |
| 85 | +In order to perform SSO authentications, an Azure AD application must be created. |
| 86 | + |
| 87 | +SSO must be configured on this application. |
| 88 | + |
| 89 | +### Azure AD applications |
| 90 | + |
| 91 | +First of all, it is necessary to create an application if one does not yet exist. |
| 92 | + |
| 93 | +#### Create an Azure AD application |
| 94 | + |
| 95 | +Click on `Enterprise applications`{.action} from the left-hand menu. |
| 96 | + |
| 97 | +{.thumbnail} |
| 98 | + |
| 99 | +Click on `New application`{.action} in the top menu. |
| 100 | + |
| 101 | +{.thumbnail} |
| 102 | + |
| 103 | +Click on `Create your own application`{.action} in the top menu. |
| 104 | + |
| 105 | +{.thumbnail} |
| 106 | + |
| 107 | +Select the `Non-gallery`{.action} from the left-hand menu, and click on the `Create`{.action} button. |
| 108 | + |
| 109 | +{.thumbnail} |
| 110 | + |
| 111 | +The details of the application will then be displayed. |
| 112 | + |
| 113 | +{.thumbnail} |
| 114 | + |
| 115 | +The Azure AD application is now created. Users who want to perform SSO authentications via this application must now be added to it. |
| 116 | + |
| 117 | +#### Azure AD application - User assignment |
| 118 | + |
| 119 | +> [!primary] |
| 120 | +> |
| 121 | +> In order for a user to perform an SSO authentication from an Azure AD application, it must be added to that application. It is therefore shown here how to add a user to an Azure AD application. |
| 122 | +> |
| 123 | +> However, it is better to add a user group instead of users if you have **Azure AD Premium**. |
| 124 | +> |
| 125 | +
|
| 126 | +Click on `Users and groups`{.action} from the left-hand menu, then click `Add user/group`{.action} in the top menu. |
| 127 | + |
| 128 | +Click then on the `Users`{.action} section, select the user to add to the application, and click on the `Select`{.action} button. |
| 129 | + |
| 130 | +{.thumbnail} |
| 131 | + |
| 132 | +{.thumbnail} |
| 133 | + |
| 134 | +The application is created, a user has been assigned, all that remains is to set up the SSO via SAML. |
| 135 | + |
| 136 | +#### Azure AD application SSO |
| 137 | + |
| 138 | +Get back to the overview via the `Overview`{.action} button from the left-hand menu, then click on the `Set up single sign on`{.action} section. |
| 139 | + |
| 140 | +{.thumbnail} |
| 141 | + |
| 142 | +Click on the `SAML`{.action} section. |
| 143 | + |
| 144 | +{.thumbnail} |
| 145 | + |
| 146 | +Click on `Upload metadata file`{.action} in the top menu. |
| 147 | + |
| 148 | +{.thumbnail} |
| 149 | + |
| 150 | +Click on the `Select a file`{.action} icon button, select the OVHcloud Service Provider metadata file and click on the `Add`{.action} button. |
| 151 | + |
| 152 | +You can obtain the appropriate metadata file via the following links: |
| 153 | + |
| 154 | +- [EU region metadata](https://www.ovh.com/auth/sso/saml/sp/metadata.xml) |
| 155 | +- [CA region metadata](https://ca.ovh.com/auth/sso/saml/sp/metadata.xml) |
| 156 | + |
| 157 | +Download the metadata file, it will be necessary later. |
| 158 | + |
| 159 | +{.thumbnail} |
| 160 | + |
| 161 | +The SAML configuration will be displayed. |
| 162 | + |
| 163 | +{.thumbnail} |
| 164 | + |
| 165 | +In the `Attributes & Claims`{.action} section, click on the `Edit`{.action} button. |
| 166 | + |
| 167 | +{.thumbnail} |
| 168 | + |
| 169 | +Click on `Add a group claim`{.action} in the top menu. |
| 170 | + |
| 171 | +{.thumbnail} |
| 172 | + |
| 173 | +Select `Security groups`{.action}, and **Group ID** from the `Source attribute`{.action} and click on the `Save`{.action} button. |
| 174 | + |
| 175 | +{.thumbnail} |
| 176 | + |
| 177 | +The **groups** claim should now appear in the list. |
| 178 | + |
| 179 | +Copy and save the **Claim name** value somewhere (i.e a notepad), it will be necessary later. |
| 180 | + |
| 181 | +{.thumbnail} |
| 182 | + |
| 183 | +In the `SAML certificates`{.action} section, copy the `App Federation Metadata Url`{.action} field value. |
| 184 | + |
| 185 | +Use this link to download the Azure AD application metadata file in order to use it later in the OVHcloud account. |
| 186 | + |
| 187 | +{.thumbnail} |
| 188 | + |
| 189 | +### Establishing OVHcloud account trust and configuring the connection |
| 190 | + |
| 191 | +Adding your Azure AD application as a trusted identity provider is done in the [OVHcloud Control Panel](https://ca.ovh.com/auth/?action=gotomanager&from=https://www.ovh.com/asia/&ovhSubsidiary=asia) where you can provide the identity provider metadata. |
| 192 | + |
| 193 | +#### Establish OVHcloud trust |
| 194 | + |
| 195 | +[Log in](https://ca.ovh.com/auth/?action=gotomanager&from=https://www.ovh.com/asia/&ovhSubsidiary=asia) and click on your profile in the top-right corner. |
| 196 | + |
| 197 | +{.thumbnail} |
| 198 | + |
| 199 | +Click on your name to access your profile management page. |
| 200 | + |
| 201 | +{.thumbnail} |
| 202 | + |
| 203 | +Open the `User management`{.action} tab. |
| 204 | + |
| 205 | +{.thumbnail} |
| 206 | + |
| 207 | +Click on the `SSO connection`{.action} button. |
| 208 | + |
| 209 | +{.thumbnail} |
| 210 | + |
| 211 | +Fill in the **Group Attribute Name** field with the Azure AD application groups **Claim name** value saved before. |
| 212 | + |
| 213 | +Fill in the XML metadata of your Azure AD application from the file saved before. |
| 214 | + |
| 215 | +Click on the `Confirm`{.action} button. |
| 216 | + |
| 217 | +{.thumbnail} |
| 218 | + |
| 219 | +The trust of your Azure AD application as identity provider is thus established but you still have to add groups to your OVHcloud account. |
| 220 | + |
| 221 | +> [!warning] |
| 222 | +> If you try to connect at this stage via SSO, you will probably receive a `Not in valid groups` error message. |
| 223 | +> |
| 224 | +> That is because your OVHcloud account checks if the authenticating user belongs to a group that actually exists on the account. |
| 225 | +> |
| 226 | +
|
| 227 | +To resolve this, check the "Group" attribute that your Azure AD application returns: the **Object Id** field. |
| 228 | + |
| 229 | +#### OVHcloud groups declaration |
| 230 | + |
| 231 | +{.thumbnail} |
| 232 | + |
| 233 | +Add it by clicking on the `Declare a group`{.action}. |
| 234 | + |
| 235 | +{.thumbnail} |
| 236 | + |
| 237 | +Fill in the fields, then click on the `Confirm`{.action} button. |
| 238 | + |
| 239 | +{.thumbnail} |
| 240 | + |
| 241 | +The created group should appear on the list. |
| 242 | + |
| 243 | +{.thumbnail} |
| 244 | + |
| 245 | +### Connect via SSO |
| 246 | + |
| 247 | +On the [OVHcloud login page](https://ca.ovh.com/auth/?action=gotomanager&from=https://www.ovh.com/asia/&ovhSubsidiary=asia), enter your [NIC handle](https://docs.ovh.com/asia/en/customer/create-ovhcloud-account/#what-is-my-nic-handle) followed by **/idp** without entering a password, and click the `Login`{.action} button. |
| 248 | + |
| 249 | +{.thumbnail} |
| 250 | + |
| 251 | +You are then redirected to your Azure AD application login page. Select `Use another account`{.action}. |
| 252 | + |
| 253 | +{.thumbnail} |
| 254 | + |
| 255 | +Enter the Azure AD application user email and click on the `Next`{.action} button. |
| 256 | + |
| 257 | +{.thumbnail} |
| 258 | + |
| 259 | +Enter the Azure AD application user password and click on the `Sign In`{.action} button. |
| 260 | + |
| 261 | +{.thumbnail} |
| 262 | + |
| 263 | +You are now logged in with the same [NIC handle](https://docs.ovh.com/asia/en/customer/create-ovhcloud-account/#what-is-my-nic-handle), but via your Active Directory user and using your Azure AD application SSO. |
| 264 | + |
| 265 | +{.thumbnail} |
| 266 | + |
| 267 | +## Go further |
| 268 | + |
| 269 | +Join our community of users on <https://community.ovh.com/en/>. |
0 commit comments