Microsoft Azure

Prerequisites

The following steps in this document requires that you have a working Active Directory within Microsoft Azure. It can be a federation with a local Active Directory or your main Active Directory. Read more about how to Deploying Active Directory Federation Services in Azure https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/deployment/how-to-connect-fed-azure-adfs

Setting up an Azure Active Directory app to work with Naviga Login

1. Login to https://portal.azure.com/ and click on Azure Active Directory and the on App registrations (Preview)

2. Click on New registration

   • Name: <Your choice of name> Proposal: Naviga Login

   • Supported account types: Accounts in this organizational directory only (Standardkatalog)

   • Redirect URI (optional): Web / https://imas.imid.infomaker.io

3. Go to Authentication within your new created app and then following URLs under Redirect URIs as Web types (organization name will be provide to you by Infomaker/Newscycle):

   https://imas.stage.imid.infomaker.io/v1/org/<OrganizationName>/login-callback

   https://imas.imid.infomaker.io/v1/org/<OrganizationName>/login-callback

4. Go to API permissions and enable the following:

   • openid

   • email

   • offline_access

   • profile

You can read more about user permissions and OpenId in the Azure documentation.

1. Go to Certificates & secrets and add a new Client secret

   • Description: client_secret

   • Expires: Your choice. But remember that you need to provide Naviga with a new Client Secret before the expiry date runs out otherwise your users will not be able to login with Naviga ID after the expiry date.

3. Go to Manifest and replace the following items:

"groupMembershipClaims": "All"

This will include user groups in tokens

"optionalClaims": {
    "idToken": [
        {
            "name": "given_name",
            "source": null,
            "essential": false,
            "additionalProperties": []
        },
        {
            "name": "family_name",
            "source": null,
            "essential": false,
            "additionalProperties": []
        }
    ],
    "accessToken": [],
    "saml2Token": []
},

This will include given name and last name in tokens

You are now done with configuration

Add permissions for Naviga ID to read group names

By default, Azure AD only provides group IDs in the token and in order for Naviga ID to fetch the names of those groups, additional configuration is required.

Under API permissions add the following delegated permission:

• GroupMember.Read.All

This allows Naviga ID to list groups, read basic group properties and read membership of all groups the signed-in user has access to.

Gather The Required Information and Speak With Your Naviga Contact