Microsoft Entra ID (Azure AD) Without Key Vault
This article describes how to integrate OvalEdge with Microsoft Entra ID (formerly Azure Active Directory) using the SAML 2.0 protocol without Azure Key Vault. The integration enables Single Sign-On (SSO), allowing users to authenticate through Microsoft Entra ID and access OvalEdge using their enterprise credentials.
The configuration process includes creating and configuring an Enterprise Application in Microsoft Entra ID, setting up SAML-based authentication, configuring user and group claims, creating and assigning application roles, and updating OvalEdge configuration settings to establish trust between Microsoft Entra ID and OvalEdge.
In this deployment model, SAML metadata and authentication settings are configured directly within the application environment without using Azure Key Vault for certificate or secret management. After the integration is completed, user authentication is managed through Microsoft Entra ID, while authorization is controlled through configured roles and group assignments.
Purpose
This document enables administrators to:
Configure Microsoft Entra ID as the Identity Provider (IdP) for OvalEdge.
Enable SAML 2.0-based Single Sign-On (SSO) authentication.
Configure user, group, and role claims in Microsoft Entra ID.
Create and assign Microsoft Entra ID application roles for OvalEdge users and groups.
Configure OvalEdge to consume Microsoft Entra ID SAML metadata without Azure Key Vault integration.
Verify successful authentication and role assignment within OvalEdge.
The Setup
Please follow the steps below to integrate the OvalEdge application with Azure Active Directory and run the OvalEdge application with https.
Example: https://<DNS>:8443/ovaledge
Create an Enterprise application in Azure: It is used to authenticate Azure users in the OvalEdge application.
Authentication and Authorization: This section explains how to create roles and groups in the AD and add members to the group.
Tomcat Configuration: It is used to configure Azure with the OvalEdge Application.
1. Create an Enterprise application in Azure
To create an Enterprise application in Azure, complete the following steps:
Step#1: Navigate to Azure Active Directory and click on the Azure Active Directory.
Step#2: Click on the Enterprise Applications to display the Enterprise applications page.
Step#3: On the Enterprise applications page, click + New Application, which will display the Browse Azure AD Gallery Page.
Step#4: On the Browse Azure AD Gallery page, click on Create your own application.
Step#5: Name the application and click on Create.
Step#6: Open the application you have created, click on ‘Single Sign-on’ and select ‘SAML’.
Step#7: Click on Edit to edit 'Basic SAML Configuration'.
Step#8: Enter https://<DNS>/ovaledge/saml/metadata for identifier, https://<DNS>/ovaledge/saml/SSO for 'Reply URL (Assertion Consumer Service URL)' and https://<DNS>/ovaledge/saml/SingleLogout for 'Logout Url (Optional)'. Click on Save.
Please mention the port if such a configuration is made.
Step#9.1: Click on Edit to configure 'Attributes & Claims'.
Step#9.2: Click on '+ Add a group claim' and select 'Groups assigned to the application' and then click save.
Step#9.3: Click on Edit to edit 'SAML Signing Certificate'.
Step#10: Select 'Signing Algorithm' as 'SHA-1' and click 'Save' to display the SAML-based Sign-on Page.
Step#11: On the SAML-based Sign-on Page, click on the Copy icon to copy the metadata URL.
2. Authentication and Authorization for Remote Configuration
If the authorization is Hybrid can skip this step.
Please follow the steps below to authenticate and authorize with Azure AD to log in to the OvalEdge application.
Step#1: Navigate to APP registration corresponding to the enterprise application and click on the 'Token Configuration'. Click on '+ Add optional claim', and select 'SAML'. Under SAML, select email and up and click on 'Add.'
Step#2: Enable 'Turn on the Microsoft Graph email, profile permission (required for claims to appear in token)' and click on add.
Step#3: Click on '+ Add groups claim'. select security groups and under ID select 'sAMAccountName', under Access select 'sAMAccountName', under SAML select 'Group ID'. And then click on 'add'.
Step#04: Navigate 'App roles'. Click on '+ Create app role', enter display name as 'OE_ADMIN,' select 'Allowed member types' as 'Both (Users/Groups + Applications),' give value as 'OE_ADMIN,' enter Description as 'OE_ADMIN' and click on apply.
Step#05: Navigate to the Enterprise application and search for the application.
Step#06: Click on assign and user groups
Step#07: Click on + add user/group
Step#08: Click on none selected search user and click on add.
Step#09: The user selects assign a role that was already created under Step#04.
3. Tomcat Configuration
Please follow the below steps to configure Tomcat the Azure AD with OvalEdge app.
Step#1: In the oasis.properties configure the below information.
samlHTTPMetadataProvider=<AzureADmetadata>
entityBaseURL=https://<DNS NAME>/ovaledge
Step#2: Start the Tomcat.
After running the Tomcat configuration, go to the web browser and enter the URL to log in to the OvalEdge application, which will display the Login page below.
Step#3: Click on Login to see the Sign-in page. Enter the required credentials to enter into the OvalEdge application.
Step#4: User can view the new user role on the Administration > User’s & Roles > Roles page.
Copyright © 2025, OvalEdge LLC, Peachtree Corners, GA, USA.
Last updated
Was this helpful?