diff options
| author | Dimitris Kavvathas <dimitris.kavvathas@sonarsource.com> | 2022-09-01 01:25:19 +0200 |
|---|---|---|
| committer | sonartech <sonartech@sonarsource.com> | 2022-09-01 20:03:03 +0000 |
| commit | bfeac6457711052954d7e14a658f04a25006cb2f (patch) | |
| tree | 3814186f5cad86fd4b3dc1e44af3dc644dd08598 /server/sonar-docs/src/pages/instance-administration | |
| parent | 39b92139dff11afde629d4f6d2b2af54f5d3cbbc (diff) | |
| download | sonarqube-bfeac6457711052954d7e14a658f04a25006cb2f.tar.gz sonarqube-bfeac6457711052954d7e14a658f04a25006cb2f.zip | |
SONAR-17229 Add Azure AD encryption and group mapping
Diffstat (limited to 'server/sonar-docs/src/pages/instance-administration')
| -rw-r--r-- | server/sonar-docs/src/pages/instance-administration/authentication/saml/azuread.md | 61 |
1 files changed, 39 insertions, 22 deletions
diff --git a/server/sonar-docs/src/pages/instance-administration/authentication/saml/azuread.md b/server/sonar-docs/src/pages/instance-administration/authentication/saml/azuread.md index 5a1c3044a89..fb757426f1c 100644 --- a/server/sonar-docs/src/pages/instance-administration/authentication/saml/azuread.md +++ b/server/sonar-docs/src/pages/instance-administration/authentication/saml/azuread.md @@ -3,7 +3,6 @@ title: How to setup Azure AD url: /instance-administration/authentication/saml/azuread/ --- -## Using Azure AD as a SAML Identity Provider The following content may be useful if you're using Azure AD as a SAML Identity Provider. To integrate Azure AD (Identity Provider) with SonarQube SAML configuration (Service Provider), both sides need to be configured. @@ -11,27 +10,27 @@ To integrate Azure AD (Identity Provider) with SonarQube SAML configuration (Ser For SonarQube, navigate to **Administration > Authentication > SAML**. For Azure AD, login to Azure and navigate to Azure AD. -### Set up the SonarQube application in Azure AD +## Set up the SonarQube application in Azure AD - In Azure AD, navigate to **Enterprise applications** and add a **New Application**. -  +  - Create your **own application** and fill in the **name**. -  +  -### Link SonarQube with Azure AD +## Link SonarQube with Azure AD - Navigate to **Single sign-on** and select **SAML**. -  +  - Edit the **Basic SAML Configuration** and fill in the **Identifier** and the **Reply URL**. The **Identifier** has to be the same as the **Application ID** in SonarQube. The **Reply URL** must have the format `<Your SonarQube URL>/oauth2/callback/saml`. -  +  - Fill in the corresponding SonarQube configuration. -  +  - In the Azure AD SAML configuration, navigate to **Set up "application name"** and copy the **Login URL** and **Azure AD Identifier** -  +  - Paste them into the corresponding fields in the SonarQube SAML configuration. -  +  -### Attributes and Claims +## Attributes and Claims - In the Azure AD SAML configuration, edit **Attributes & Claims** to view, edit or add attributes. -  +  SonarQube uses the following attributes: - **Login** (required) A unique name to identify the user in SonarQube. The default Azure AD attribute `emailaddress` is used in the example. - **Name** (required) The full name of the user. The default Azure AD attribute `givenname` is used in the example. @@ -39,20 +38,38 @@ For Azure AD, login to Azure and navigate to Azure AD. - **Group** (optional) Supports mapping to group names in SonarQube. These have to be the same as the group name passed by Azure AD. Otherwise, the default **sonar-users** group is assigned. **Note:** The **NameID** attribute is *not* used in SonarQube. - Corresponding configuration in SonarQube. The full namespace of the attribute should be used. -  +  -### Certificates & Signatures +## Certificates & Signatures - Navigate to **SAML Certificates** and download **Certificate (Base64)**. -  +  - The certificate should be copied into the **Identity provider certificate** field in the SonarQube SAML configuration. -  +  +- (Optional) Encryption for SonarQube requests can be activated by generating an asymmetric key pair. + + Add the private key in SonarQube. +  + Import the public key certificate (.cer) file in Azure AD and activate token encryption +  +- Azure AD, as an Identity Provider, does not verify signed requests from the Service Providers. SonarQube, however, offers the option for signing the SAML requests by adding a Service Provider private key and certificate. +  -### Users and Groups +## Users and Groups - In the Azure AD SonarQube application, navigate to **Users and groups** and assign users or groups to the application. -  +  + +## Group mapping +Group mapping between Azure AD and SonarQube can be achieved either by using the Azure AD roles or the Azure AD groups. +For either case, the corresponding group name should exist in SonarQube. -### Enabling and testing SAML authentication +- For mapping with the Azure AD groups, a group claim must be added with `sAMAccountName` as a source attribute. +  +  +- For mapping with the Azure AD roles, an application role should be assigned to the user. Azure AD sends the role claim automatically with `http://schemas.microsoft.com/ws/2008/06/identity/claims/role` as a key. +  + +## Enabling and testing SAML authentication - In the SonarQube SAML settings, enable SAML. -  -- Logout and try to log in again. If all the mandatory fields are filled in, the Azure SAML integration should appear. -  +  +- In the login form, the new button **Log in with SAML** (or a custom name specified in the `sonar.auth.saml.providerName` setting) allows users to connect with their SAML account. +  |