Relying Party: Entra ID

The IDMS can relay certificate information to Microsoft Entra ID to enable immediate certificate based authentication (CBA). Setup requires the 2 following phases, 1) Registering the IDMS as an Application within Azure, 2) Configuring the relying party within the IDMS.

How to Add an Azure Active Directory Application in IDMS

This guide provides a step-by-step procedure for registering a new application in Azure Active Directory (Azure AD), which can then be integrated with the IDMS.

Step-by-Step Procedures

1. Navigate to the Azure Active Directory Portal:

   • Log in to the Azure Portal.

   • In the left-hand navigation menu, select Azure Active Directory.

   • On the Azure Active Directory overview page, click on App registrations.

2. Register a New Application:

   • On the "App registrations" page, click the "+ New registration" button at the top.

   • In the "Register an application" form, fill in the following:

     • Name: Enter a user-facing display name for the application (e.g., "PIV IDMS").

     • Supported account types: Select the option that corresponds to your organization's security tenant. In the video, "Accounts in this organizational directory only" is selected.

   • Click the "Register" button at the bottom of the page.

   • Result: The application will be created, and you will be redirected to the application's overview page.

3. Configure API Permissions:

   • From the new application's overview page, locate the left-hand navigation menu.

   • Under the Manage section, click on "API permissions".

   • Click the "+ Add a permission" button.

   • In the "Request API permissions" dialog, select Microsoft Graph.

   • Select "Application permissions".

   • In the search bar, type "user" to filter the permissions.

   • Expand the "User" dropdown.

   • Check the box for "User.Read.All" and then click the "Add permissions" button.

   • Result: The permission will be added to the list. You will need to grant administrator consent for the permissions to take effect.

   • Click the "Grant admin consent for [Your Organization]" button, and then click "Yes" in the confirmation dialog.

4. Create a Client Secret:

   • In the left-hand navigation menu, click on "Certificates & secrets".

   • On the "Certificates & secrets" page, click the "New client secret" button.

   • In the "Add a client secret" dialog, enter a Description (e.g., "PIV IDMS secret") and select an expiration time.

   • Click the "Add" button.

   • Result: The client secret will be generated. You must immediately copy the secret's Value and store it securely, as it will not be shown again.

How to Add a Relying Party Connection (Entra ID)

This guide provides a step-by-step procedure for adding Entra ID as a Relying Party. A Relying Party is a third-party system that can use information from the IDMS to authenticate a user.

Step-by-Step Procedures

1. Navigate to System Connections:

   • From the main dashboard, click on the Administration dropdown menu in the top navigation bar.

   • In the dropdown menu, select System Connections.

2. Add a New System Connection:

   • On the "System Connection Management" page, click the "+ System Connection" button located above the connections table.

   • In the dropdown list that appears, select Relying Party.

3. Configure the Relying Party Type:

   • On the "Relying Party" configuration page, select "Entra ID (Azure)" from the Directory Type dropdown menu.

4. Enter Relying Party Details:

   • Fill in the configuration details using the information from your Azure AD application:

     • Friendly Name: Enter a descriptive name for the connection (e.g., "Entra ID Relying Party").

     • DNS Name: Enter the DNS name provided by your Azure AD application (e.g., graph.microsoft.com).

     • Client Secret: Paste the client secret you copied from the Azure AD application.

     • Tenant ID: Paste the Tenant ID from the Azure AD application.

     • Client ID: Paste the Client ID from the Azure AD application.

     • Mapping: Enter the mapping attribute (e.g., "mail") that will be used to look up users in the IDMS and send to Entra ID.

5. Save the Configuration:

   • Click the "Add" button at the bottom of the page.

   • A pop-up will confirm, "Directory add successful." Click "Close" to dismiss it.

   • Result: The new Relying Party will appear in the System Connections table.