Skip to main content

Create enterprise applications in Azure AD

Contributors netapp-lhalbert netapp-madkat netapp-perveilerk ssantho3
PDFs

You use Azure AD to create an enterprise application for each Admin Node in your system.

Before you begin

  • You have started configuring single sign-on for StorageGRID and you selected Azure as the SSO type.

  • Sandbox mode is selected on the Single sign-on page in Grid Manager. See Use sandbox mode.

  • You have the Enterprise application name for each Admin Node in your system. You can copy these values from the Admin Node details table on the StorageGRID Single Sign-on page.

    Note You must create an enterprise application for each Admin Node in your StorageGRID system. Having an enterprise application for each Admin Node ensures that users can securely sign in to and out of any Admin Node.

  • You have experience creating enterprise applications in Azure Active Directory.

  • You have an Azure account with an active subscription.

  • You have one of the following roles in the Azure account: Global Administrator, Cloud Application Administrator, Application Administrator, or owner of the service principal.

Access Azure AD

Steps

  1. Log in to the Azure Portal.

  2. Navigate to Azure Active Directory.

  3. Select Enterprise applications.

Create enterprise applications and save StorageGRID SSO configuration

To save the SSO configuration for Azure in StorageGRID, you must use Azure to create an enterprise application for each Admin Node. You will copy the federation metadata URLs from Azure and paste them into the corresponding Federation metadata URL fields on the StorageGRID Single Sign-on page.

Steps

  1. Repeat the following steps for each Admin Node.

    1. In the Azure Enterprise applications pane, select New application.

    2. Select Create your own application.

    3. For the name, enter the Enterprise application name you copied from the Admin Node details table on the StorageGRID Single Sign-on page.

    4. Leave the Integrate any other application you don't find in the gallery (Non-gallery) radio button selected.

    5. Select Create.

    6. Select the Get started link in the 2. Set up single sign on box, or select the Single sign-on link in the left margin.

    7. Select the SAML box.

    8. Copy the App Federation Metadata Url, which you can find under Step 3 SAML Signing Certificate.

    9. Go to the StorageGRID Single Sign-on page, and paste the URL in the Federation metadata URL field that corresponds to the Enterprise application name you used.

  2. After you have pasted a federation metadata URL for each Admin Node and made all other needed changes to the SSO configuration, select Save on the StorageGRID Single Sign-on page.

Download SAML metadata for every Admin Node

After the SSO configuration is saved, you can download a SAML metadata file for each Admin Node in your StorageGRID system.

Steps

  1. Repeat these steps for each Admin Node.

    1. Sign in to StorageGRID from the Admin Node.

    2. Select CONFIGURATION > Access control > Single sign-on.

    3. Select the button to download the SAML metadata for that Admin Node.

    4. Save the file, which you will upload into Azure AD.

Upload SAML metadata to each enterprise application

After downloading a SAML metadata file for each StorageGRID Admin Node, perform the following steps in Azure AD:

Steps

  1. Return to the Azure Portal.

  2. Repeat these steps for each enterprise application:

    Note You might need to refresh the Enterprise applications page to see applications you previously added in the list.

    1. Go to the Properties page for the enterprise application.

    2. Set Assignment required to No (unless you want to separately configure assignments).

    3. Go to the Single sign-on page.

    4. Complete the SAML configuration.

    5. Select the Upload metadata file button and select the SAML metadata file you downloaded for the corresponding Admin Node.

    6. After the file loads, select Save and then select X to close the pane. You are returned to the Set up Single Sign-On with SAML page.

  3. Follow the steps in Use sandbox mode to test each application.