Skip to main content

Create enterprise applications in Entra ID for OIDC in StorageGRID

Contributors netapp-pcarriga
PDFs

Use Entra ID to create an enterprise application for each Admin Node for OpenID Connect (OIDC) in your system.

Before you begin

  • You have the relying party identifier and fully qualified domain name (FQDN) or IP address for each Admin Node in your system.

    Note Each Admin Node in your StorageGRID system must have an enterprise application. This ensures that users can securely sign in to and out of any Admin Node. You can create a single enterprise application for all Admin Nodes (recommended) or a different enterprise application for each Admin Node.

  • You have experience creating applications in Entra ID.

  • You have an Entra ID account with an active subscription.

  • You have one of the following roles in the Entra ID account: Global Administrator, Cloud Application Administrator, Application Administrator, or owner of the service principal.

Step 1: Access Entra ID

Steps

  1. Log in to the Azure Portal.

  2. Select Microsoft Entra ID.

  3. Select App registrations.

Step 2: Register a new application

Register a new enterprise application for each Admin Node in your system.

Steps

  1. In the Entra ID Enterprise applications pane, select Application registrations > New registration.

  2. For Name, enter the relying party identifier.

  3. Under Supported account types, select the account types that can use the application or access the API, for example, Single tenant only - <tenant_name>.

  4. Under Redirect URI, select Select a platform > Web.

  5. Enter the FQDN (or IP address) redirect URI for the Admin Node: https://<FQDN>/api/v4/oidc-callback or https://<IP_address>/api/v4/oidc-callback

    Enter the URI for each Admin Node if you are using one enterprise application for all Admin Nodes. If you are using a different enterprise application for each Admin Node, only enter the URI for the corresponding Admin Node.

  6. Select Register.

  7. On the Overview page for the new application registration, record the Application (client) ID and Directory (tenant) ID.

Step 3: Configure a client secret

Register a client secret for each new application.

Steps

  1. On the Overview page for the new application registration, select Manage > Certificates and secrets > New client secret.

  2. Enter the client secret and set a desired expiry date.

  3. Select Add to create the client secret.

  4. Copy the secret Value.

    Note The secret value is not visible after you refresh or navigate from the client secret page.

Step 4: Set up the API permissions

Set up the API permissions for each new application.

Steps

  1. On the Overview page for the new application registration, select Manage > API permissions > Add a permission.

  2. Select Microsoft APIs > Microsoft Graph > Delegated permissions.

  3. Expand OpenId permissions, then select email, offline_access, openid, and profile.

  4. Select Add permissions.

  5. Select Grant admin consent for <tenant>, then select Yes.

Step 5: Add the logged-out redirect URI

Add the logged-out redirect URI for each new application.

Steps

  1. On the Overview page for the new application registration, select Manage > Authentication.

  2. Select Add Redirect URI > Web.

  3. Enter the FQDN (or IP address) redirect URI for the Admin Node: https://<FQDN>/api/v4/oidc-logged-out or https://<IP_address>/api/v4/oidc-logged-out

    Enter the URI for each Admin Node if you are using one application group for all Admin Nodes. If you are using a different application group for each Admin Node, only enter the URI for the corresponding Admin Node.

  4. Select Configure.

What's next

After creating enterprise applications, configure SSO using OIDC.