Microsoft Entra ID (Azure AD)

Maverics Identity Orchestrator provides a prebuilt, no-code connector for Microsoft Entra ID. This Connector lets you create users in Entra ID using Microsoft’s Graph API and supports user authentication using either OpenID Connect or SAML.

While Microsoft has rebranded Azure AD to Entra ID, please note that the orchestrator currently only recognizes azure in the configuration.

Configuration options

The following values can be provided to the Entra ID connector via the Maverics configuration file.

Auth Type

authType defines the protocol used to authenticate against Entra ID. The Entra ID connector supports both saml or oidc for user authentication. When not defined, a default of oidc is used.

OIDC Well-known URL

oidcWellKnownURL defines the location at which the client requests configuration from Azure AD’s OpenID Provider. This must be set (along with graphURL) when using the connector as an attribute provider.

OAuth Client ID

oauthClientID defines the client ID used to identify the Maverics application to Entra ID.

OAuth Client Secret

oauthClientSecret defines the client secret used to authenticate the Maverics application with Entra ID.

OAuth Login Redirect

oauthLoginRedirect is used to define login redirect callback URLs.

It defines the urls that the OIDC provider will use to redirect the client back to after authentication. The urls must be absolute URLs and match exactly with one of the registered URLs on the provider. If no matches are found during the auth flow, the first URL from the urls list will be used.

The orchestrator will serve the callback handlers on all URLs specified in the urls field under this section.

ℹ️

The urls paths should not conflict with the path of any application resources. The path can be arbitrary (e.g. /maverics-oidc or /oidc-handler).

OAuth Logout Redirect

oauthLogoutRedirect is used to define urls that an OIDC provider will use to redirect the client back to the application after logging out the user.

The urls must be absolute URLs and match exactly with one of the registered URLs on the provider. If no matches are found during the logout flow, the first URL from the urls list will be used.

The orchestrator will serve the callback handlers on all URLs specified in the urls field under this section.

ℹ️

The urls paths should not conflict with the path of any application resources. The path can be arbitrary (e.g. /oidc-logout or /logout-handler).

Disable PKCE

disablePKCE is an optional field used to disable the OIDC Proof Key for Code Exchange (PKCE) extension (enabled by default).

SAML Entity ID

samlEntityID is the unique application entity ID assigned to the application.

SAML Metadata URL

samlMetadataURL is the metadata URL from the application configured in the SAML provider. The samlMetadataURL setting will accept a file:/// URI if the metadata file is saved on a filesystem accessible to the Orchestrator user.

SAML Consumer Service URL

samlConsumerServiceURL is the URL that the SAML provider will use to POST the SAML response back to. The Maverics SAML ACS handler will be served on this URL, as such it should not conflict with the path of any application resources. The samlConsumerServiceURL path can be arbitrary (e.g. /maverics-saml or /saml-handler), but must match the provider’s configuration for the specified samlEntityID.

SAML Logout Callback URL

samlLogoutCallbackURL is an optional field used to define the URL to which the SAML provider will call back once logout is successful. This will initialize an endpoint on Maverics to listen for the callback. The URL’s domain must match the domain Maverics is on. The samlLogoutCallbackURL path can be arbitrary (e.g. /logout-maverics-saml or /logout-saml-handler), but must match the provider’s configuration for the specified samlEntityID.

SAML SP Cert Path

samlSPCertPath is an optional configuration to the path to the certificate that will be used to sign SAML authentication requests. Must be used with samlSPKeyPath.

SAML SP Key path

samlSPKeyPath is an optional configuration to the path to the private key that will be used to sign SAML authentication requests. Must be used with samlSPCertPath.

IDP-Initiated Login

samlIDPInitiatedLogin is an optional field used to define the IDP-initiated login settings.

Enabled

enabled defines whether the connector will accept unsolicited SAML responses from the configured IDP. IDP-initiated login is disabled by default as it is inherently less secure than the alternative SP-initiated flow.

Allowed Redirect URLs

allowedRedirectURLs are the set of URLs that the connector can redirect to after processing an IDP-initiated SAML response. The IDP must pass one of the listed URLs via the relay state when it initiates a login. For more info on why a set of URLs are required, please see the OWASP guide on IdP Initiated SSO and the importance of mitigating the Open Redirect attack.

Domain Hint

domainHint is an optional field used to indicate to Entra ID that this request should be handled by the federated IdP sign-in page, or the branded Entra ID sign-in page for the tenant.

Graph URL

graphURL is an optional field that defines the Entra ID endpoint used to make calls to the Microsoft Graph API. The oidcWellKnownURL must also be configured.

Cache

cache is an optional field that defines the cache settings for the connector. If left undefined, the connector will use the default in-memory cache.

ℹ️

At the moment cache is only supported for SAML connectors.

Health Check

healthCheck defines an optional health check for the connector. This option is required when using the connector in an IDP-continuity scenario. For more info on how to define the health check, please see the docs.

Examples

SAML Connector Configuration

The Maverics Identity Orchestrator SAML Connector for Entra ID may be configured as gallery app or non-gallery web app in your Entra ID tenant. Consult the Connector Tutorial to add your SAML Connector from the Entra ID app gallery.

connectors:
  - name: azure
    type: azure
    authType: saml
    samlMetadataURL: https://login.microsoftonline.com/<tenantID>/federationmetadata/2007-06/federationmetadata.xml?appid=<appid>
    samlConsumerServiceURL: https://example.com/acs
    samlLogoutCallbackURL: https://example.com/logout
    samlEntityID: https://example.com

SAML Connector Configuration with SAML metadata file

This sample assumes the SAML metadata was downloaded and saved in /etc/maverics/samlmetadata.xml.

connectors:
  - name: azure
    type: azure
    authType: saml
    samlMetadataURL: file:///etc/maverics/samlmetadata.xml
    samlConsumerServiceURL: https://example.com/acs
    samlLogoutCallbackURL: https://example.com/logout
    samlEntityID: https://example.com
    cache: redis

OIDC Connector Configuration

connectors:
  - name: azure
    type: azure
    authType: oidc
    oidcWellKnownURL: https://login.microsoftonline.com/<tenantID>/v2.0/.well-known/openid-configuration
    oauthClientID: <client-id>
    oauthClientSecret: <client-secret>
    oauthLoginRedirect:
      urls:
        - https://host1.example.com/oidc
        - https://host2.example.com/oidc
    oauthLogoutRedirect:
      urls:
        - https://host1.example.com/logout
        - https://host2.example.com/logout
    disablePKCE: false

LDAP and Active Directory MySQL