Create application groups in AD FS for OIDC in StorageGRID
Suggest changes
PDFs
You must use Active Directory Federation Services (AD FS) to create an application group for each Admin Node for OpenID Connect (OIDC) in your system.
-
You have the fully qualified domain name (or the IP address) and the relying party identifier for each Admin Node in your system.
Each Admin Node in your StorageGRID system must have an application group. This ensures that users can securely sign in to and out of any Admin Node. You can create a single application group for all Admin Nodes (recommended) or a different application group for each Admin Node. -
You have experience creating application groups in AD FS, or you have access to the Microsoft AD FS documentation.
-
You are using the AD FS Management snap-in, and you belong to the Administrators group.
These instructions apply to Windows Server 2022 AD FS. If you are using a different version of AD FS, you will notice slight differences in the procedure. See the Microsoft AD FS documentation if you have questions.
Step 1: Create an application group
You can use Windows PowerShell to quickly create an application group.
-
From Windows Server Manager, select Tools > AD FS Management.
-
Select Application Groups > Add Application Group
-
For Name, enter the relying party identifier.
-
Under Template, select Client-Server applications > Server application accessing a web API.
-
Select Next.
-
Record the Client Identifier value.
-
Under Redirect URI, enter the FQDN (or IP address)
callbackandlogged-outURIs for the Admin Node:Enter the URIs for each Admin Node if you are using one application group for all Admin Nodes. If you are using a different application group for each Admin Node, only enter the URIs for the corresponding Admin Node.
-
Select Add.
-
Select Generate a shared secret, record the value for Secret, then select Next.
-
Enter the client identifier for Identifier.
-
Select Add, then select Next.
-
Select Permit everyone.
-
Verify that the server application is selected under Client application (caller).
-
Under Permitted scopes, verify that only the following options are selected:
-
allatclaims
-
email
-
openid
-
profile
-
-
Select Next > Next.
-
Select Close.
Step 2: Configure issuance transform rules
Configure the issuance transform rules for each application group.
-
In the AD FS Management page, right-select the application group, then select Properties.
-
Select the previously created web API, then select Edit.
-
Select Issuance Transform Rules > Add Rule ….
-
Under Claim rule template:, select Send LDAP Attribute as Claims.
-
Select Next.
-
Enter a Claim rule name.
-
Select Active Directory for Attribute store.
-
Add the LDAP attribute mappings to the outgoing claim types:
-
E-Mail Addresses - E-Mail Address -
Token-Groups - Unqualified Names - Group
-
-
Select Finish.
-
Select Apply > OK > OK.
After creating application groups, configure SSO using OIDC.