Configuring single sign-on for Microsoft Azure AD
As the Organization Administrator, setting up single sign-on (SSO) is crucial to managing access to various applications. SSO allows for a seamless sign-on experience, and gives centralized and streamlined access control to security operations teams.
Prerequisites
To manage SSO settings, you must have the Read External Auth and the Write External Auth permissions. These permissions are included in the Organization Administrator role.
Ensure you map the following attributes in your IdP. They are required for Astra to identify your account and JIT provision new accounts.
-
email - Must be in email format and map to an attribute which matches the users Astra account ID (or desired account ID for JIT provisioning)
-
firstName - The user’s first name/given name
-
lastName - The user’s last name/surname
Click the claim, Unique User Identifier, and click its Value.
Ensure the Source Attribute is in email format and maps to an attribute which matches the user’s Astra account ID (or desired account ID for JIT provisioning.) The Namespace field must also remain empty.
Set up a Microsoft Azure AD Enterprise Application account to collect and add information for your IdP.
Adding identity provider
-
From any page from Astra DB, select the Organizations dropdown. Select the organization for which you want to configure your SSO.
-
Go to the left navigation and select Settings. Select Security Settings.
If this is your first time configuring SSO, no identity providers (IdP) will be listed for your organization.
-
Select Add Identity Provider.
-
The Configure SSO page opens. Select Microsoft Azure AD as your IdP.
The following fields display information you need to provide your IdP:
-
Reply URL
-
Identifier (Entity ID), also called "SP Identity ID"
-
Relay State, also called "Default Relay State"
-
-
Copy and paste the provided Reply URL, Identifier (Entity ID), and Relay State into your Azure AD Enterprise App. For more information on configuring SSO, see the Azure AD documentation.
-
From Azure AD, get your Login URL, Azure AD Identifier, and SAML Signing Certificate. To learn where to find this information, see the Azure AD documentation.
-
Enter your Description, Login URL, Azure AD Identifier, and SAML Signing Certificate (Base64) for Azure AD into your Astra DB SSO configuration.
-
After confirming all the information is correct, scroll down and select Test Configuration.
A new tab opens in the browser window housing your IdP log-in screens and flow. When you complete the login, the window closes.
The Test Configuration is deemed successful when a confirmation icon appears beside the Test Configuration button.
If the test was unsuccessful, review the SSO settings in Astra DB and your IdP console. If still unsuccessful, contact DataStax Support.
-
Select Activate SSO when your test configuration is successful. A message appears confirming the SSO is now active for your selected organization.
Disabling your configuration
You can suspend any active configuration from your organization. The Disable option deactivates your active configuration.
|
If you disable your SSO configuration, users can access your organization without SSO authentication. |
-
Select the ellipsis (…) next to your active configuration. Select Disable.
-
A dialog box appears to confirm you want to disable this configuration. Type "disable" and select Disable SSO Configuration.
Using identity provider drafts
To complete your configuration later, select Esc in your configuration to save the current information as a draft. All drafts and the active configuration appear on the table of the Single Sign-on (SSO) page.
-
Select the ellipsis (…).
-
Select either Edit or Delete:
-
Edit returns to the Configure SSO page to continue editing the draft and complete the SSO configuration.
-
Delete removes the row from the table and is permanent. This choice displays a dialog box. To delete the draft, type "delete" and select Delete SSO Authentication.
-
|
An organization can have have multiple configuration drafts, but only one active configuration. |
The Astra Icon
Optionally, the administrator can add the DataStax Astra logo to be recognizable to all users. Use the instructions below to download and add the logo.
Downloading the Astra Logo
-
Open your Astra account and go to Settings in the left navigation.
-
Select Security Settings. Scroll down to the Single Sign-on (SSO) box and click Add Identity Provider. Successfully complete the IdP configuration.
-
Go to Advanced Settings and click Download Astra Logo.
|
You can only add the logo during configuration. When you successfully complete configuration, you are not able to return here to the logo. |
Adding the Astra Logo
-
Open Microsoft Azure AD and select Properties.
-
There are several options to make changes here; the logo option is available.
-
Click the blue folder and select the Astra logo.
-
Click Save.
What’s next?
As needed, Update user permissions from the default JIT provision role.