mirror of
https://github.com/zitadel/zitadel.git
synced 2025-12-07 07:16:54 +00:00
3c99cf82f8
# Which Problems Are Solved
Currently if a user signs in using an IdP, once they sign out of
Zitadel, the corresponding IdP session is not terminated. This can be
the desired behavior. In some cases, e.g. when using a shared computer
it results in a potential security risk, since a follower user might be
able to sign in as the previous using the still open IdP session.
# How the Problems Are Solved
- Admins can enabled a federated logout option on SAML IdPs through the
Admin and Management APIs.
- During the termination of a login V1 session using OIDC end_session
endpoint, Zitadel will check if an IdP was used to authenticate that
session.
- In case there was a SAML IdP used with Federated Logout enabled, it
will intercept the logout process, store the information into the shared
cache and redirect to the federated logout endpoint in the V1 login.
- The V1 login federated logout endpoint checks every request on an
existing cache entry. On success it will create a SAML logout request
for the used IdP and either redirect or POST to the configured SLO
endpoint. The cache entry is updated with a `redirected` state.
- A SLO endpoint is added to the `/idp` handlers, which will handle the
SAML logout responses. At the moment it will check again for an existing
federated logout entry (with state `redirected`) in the cache. On
success, the user is redirected to the initially provided
`post_logout_redirect_uri` from the end_session request.
# Additional Changes
None
# Additional Context
- This PR merges the https://github.com/zitadel/zitadel/pull/9841 and
https://github.com/zitadel/zitadel/pull/9854 to main, additionally
updating the docs on Entra ID SAML.
- closes #9228
- backport to 3.x
---------
Co-authored-by: Silvan <27845747+adlerhurst@users.noreply.github.com>
Co-authored-by: Zach Hirschtritt <zachary.hirschtritt@klaviyo.com>
(cherry picked from commit 2cf3ef4de4)
129 lines
4.5 KiB
Plaintext
129 lines
4.5 KiB
Plaintext
---
|
|
title: Configure Entra ID as a SAML Service Provider in ZITADEL
|
|
sidebar_label: Entra ID SAML
|
|
---
|
|
|
|
import GeneralConfigDescription from './_general_config_description.mdx';
|
|
import Intro from './_intro.mdx';
|
|
import CustomLoginPolicy from './_custom_login_policy.mdx';
|
|
import IDPsOverview from './_idps_overview.mdx';
|
|
import Activate from './_activate.mdx';
|
|
import PrefillAction from './_prefill_action.mdx';
|
|
|
|
<Intro provider="Entra ID (former Azure Active Directory)"/>
|
|
|
|
## Entra ID SAML Configuration
|
|
|
|
You need to have access to an Entra ID Tenant. If you do not yet have one follow [this guide from Microsoft](https://docs.microsoft.com/en-us/azure/active-directory/develop/quickstart-create-new-tenant) to create one for free.
|
|
|
|
### Register a new enterprise application in Entra
|
|
|
|
We start setting up the enterprise application.
|
|
|
|
1. Browse to the [Enterprise App registration menu](https://entra.microsoft.com/#view/Microsoft_AAD_IAM/AppGalleryBladeV2).
|
|
2. Search for "SAML Toolkit" and click on the "Microsoft Entra SAML Toolkit" card.
|
|
3. Change the name if wanted and click "Create"
|
|
|
|
|
|
|
|
### Disable required assignment
|
|
|
|
To allow all users to sign in using ZITADEL we need to manually disable required assignment:
|
|
|
|
1. Go to Manage > Properties
|
|
2. Set "Assignment required?" to No
|
|
3. Hit Save
|
|
|
|
|
|
|
|
### Setup SAML
|
|
|
|
Configure the sign-on method of the app.
|
|
|
|
1. Go to Manage > Single sign-on
|
|
2. Select SAML
|
|
3. You will be redirected to the Single Sign-On details page
|
|
4. Copy the URL of SAML Certificates > App Federation Metadata Url to your clipboard
|
|
|
|
|
|
|
|
## ZITADEL Configuration
|
|
|
|
### Go to the IdP Providers Overview
|
|
|
|
<IDPsOverview templates="SAML"/>
|
|
|
|
### Create a new SAML Service Provider (SP)
|
|
|
|
Now we configure the identity provider on ZITADEL.
|
|
|
|
1. Set a name like "Microsoft Entra"
|
|
2. Paste the previously copied URL into the "Metadata URL"-field. The metadata will automatically be fetched from the provided URL after creation.
|
|
3. Select the "SAML_POST_BINDING" as binding
|
|
4. Ensure that the "Signed Request"-box is ticked
|
|
5. Change the options if needed. Microsoft Entra works out of the box using the pre configured options.
|
|
6. Click Create
|
|
|
|
<GeneralConfigDescription provider_account="Microsoft account" />
|
|
|
|
|
|
|
|
## Configure Basic SAML Configuration
|
|
|
|
After you created the SAML provider in ZITADEL, you can copy the URLs you need to configure in your Entra ID application.
|
|
|
|
|
|
|
|
1. Go to Microsoft Entra > Manage > Single sign-on
|
|
2. Edit the "Basic SAML Configuration"
|
|
3. **Identifier (Entity ID)**: Paste the *ZITADEL Metadata URL*.
|
|
4. **Reply URL (Assertion Consumer Service URL)**: Paste the *ZITADEL ACS Login Form URL*
|
|
5. **Sign on URL**: Paste the *ZITADEL ACS Login Form URL*
|
|
6. **Logout URL**: Paste the *ZITADEL Single Logout URL*
|
|
7. Optionally, you can enable the "Federated Logout", which will log out the user from Entra ID once they terminate their session in ZITADEL using the OIDC End Session Endpoint.
|
|
8. Click Save
|
|
|
|
:::info
|
|
You can ignore the ZITADEL ACS Intent API URL for now.
|
|
This is relevant if you want to [programmatically sign users in at ZITADEL via a SAML Service Provider](/guides/integrate/login-ui/external-login).
|
|
:::
|
|
|
|
|
|
|
|
## Enable the Microsoft Entra Button in ZITADELs Login Page
|
|
|
|
Go back to ZITADEL and activate the IdP.
|
|
|
|
### Activate IdP
|
|
|
|
<Activate/>
|
|
|
|
|
|
|
|
### Ensure your Login Policy allows External IDPs
|
|
|
|
<CustomLoginPolicy/>
|
|
|
|
## Test the setup
|
|
|
|
<p>
|
|
To test the setup, use incognito mode and browse to your login page.
|
|
You see a new button which redirects you to Microsoft Entra screen.
|
|
</p>
|
|
|
|
By default, ZITADEL shows what you define in the default settings.
|
|
If you overwrite the default settings for an organization, you need to send the organization scope in your auth request.
|
|
|
|
|
|
|
|
Click **Microsoft Entra**
|
|
|
|
|
|
|
|
### Add Action to map user attributes
|
|
|
|
<PrefillAction fields="username, firstname, lastname, displayname, email and email verified" provider="Entra"/>
|
|
|
|
```js reference
|
|
https://github.com/zitadel/actions/blob/main/examples/entra_id_saml_prefil_register_form.js
|
|
``` |