> For the complete documentation index, see [llms.txt](https://docs.ovaledge.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.ovaledge.com/release8.2/installation-and-settings/authentication-and-sso-setup/microsoft-entra-id-azure-ad.md). # Microsoft Entra ID (Azure AD) This article explains how to integrate the **OvalEdge** application with **Microsoft Entra ID** (formerly Azure Active Directory) to enable **SAML-based Single Sign-On (SSO)** and centralized identity management. It covers the complete configuration process, including creating an enterprise application, configuring SAML authentication, optionally securing application secrets in **Azure Key Vault**, registering the application, assigning users and roles, and updating the Tomcat configuration required for the integration. {% hint style="warning" %} Microsoft has recently renamed **Azure Active Directory** (also called **Azure AD** or **AAD**) to **Microsoft Entra ID**. This is not to be confused with **Windows Server Active Directory**, which remains unchanged. {% endhint %} ## Purpose The purpose of this document is to guide administrators through configuring **Microsoft Entra ID** authentication for the OvalEdge application. By completing the steps in this guide, you can: * Enable **Single Sign-On (SSO)** using the SAML 2.0 protocol. * Authenticate users through Microsoft Entra ID instead of managing local application credentials. * Configure role-based access by mapping Microsoft Entra ID users and groups to OvalEdge roles. * Secure sensitive application configuration, such as database credentials and encryption keys, using **Azure Key Vault** (optional). * Register the application to securely access Azure resources, including Key Vault. * Configure the Tomcat application server to support Microsoft Entra ID authentication, with or without Azure Key Vault integration. * Provide users with a secure and centralized sign-in experience while simplifying identity and access management across the organization. ## The Setup Follow the steps below to integrate the OvalEdge application with Microsoft Entra ID and run the OvalEdge application with HTTPS. **Example:** ``` https://:8443/ovaledge ``` * **Create an Enterprise application in Azure:** Used to authenticate Azure users in the OvalEdge application. * **Create Key Vault Secrets:** Used to store the MySQL database details and the SAML certificate. * **App Registration:** Used to authenticate the OvalEdge application with Azure Key Vault. * **Authentication and Authorization:** Explains how to create roles and groups in Active Directory and add members to the groups. * **Tomcat Configuration:** Used to configure Azure with the OvalEdge application. ### Create an Enterprise Application in Azure To create an Enterprise application in Azure, complete the following steps: 1. Navigate to **Azure Active Directory** and click **Azure Active Directory**.
2. Click **Enterprise Applications** to display the **Enterprise Applications** page.
3. On the **Enterprise Applications** page, click **+ New Application** to display the **Browse Azure AD Gallery** page.
4. On the **Browse Azure AD Gallery** page, click **Create your own application**.
5. Enter the application name and click **Create**. 6. Open the application that was created, click **Single Sign-on**, and select **SAML**.
7. Click **Edit** to edit **Basic SAML Configuration**.
8. Enter the following values and click **Save**.
1. **Identifier:** ``` https:///ovaledge/saml/metadata ``` 2. **Reply URL (Assertion Consumer Service URL):** ``` https:///ovaledge/saml/SSO ``` 3. **Logout URL (Optional):** ``` https:///ovaledge/saml/SingleLogout ``` {% hint style="info" %} Specify the port if such a configuration is used. {% endhint %} 10. Click **Edit** to configure **Attributes & Claims**. 11. Click **+ Add a group claim**, select **Groups assigned to the application**, and then click **Save**.
12. Click **Edit** to edit **SAML Signing Certificate**. 13. Select **Signing Algorithm** as **SHA-1** and click **Save** to display the **SAML-based Sign-on** page. 14. On the **SAML-based Sign-on** page, click the **Copy** icon to copy the metadata URL.
### Creating Key-Value Secrets (Optional) The purpose of this section is to store database and Elasticsearch (ES) details that should not be shared publicly. To create Key Vault secrets in Azure, complete the following steps: 1. Navigate to **Azure Key Vaults**.
2. On the **Key Vaults** page, click **Create**.
3. Enter the **Resource group** and **Key vault name**. 4. In the **Access Policy** tab, select **Vault access policy** for **Permission Model**, provide **Key**, **Secret**, and **Certificate** permissions to the required users, and click **Review + Create**. 5. Verify the entered details and click **Create**. 6. After the deployment is complete, click **Go to resource** to open the **Key Vault | Overview** page. 7. Click **Secrets**. 8. Click **+ Generate/Import**.
9. To create the first secret:
1. Select **Upload options** as **Manual**. 2. Enter **Name** as `jdbcstring`. 3. Enter **Value** as: ``` jdbc:mysql://:3306/ovaledgedb ``` 4. Click **Create**. 10. Create the next secret.
1. Select **Upload options** as **Manual**. 2. Enter the **Name** as the database username. 3. Enter the **Value** as the username used to access the database. 4. Click **Create**. 11. Enter the **Name** as `password`, enter the **Value** as the database password, and click **Create**.
12. Enter the **Name** as `ovaledgeencryptdecryptkey`, enter the desired value, and click **Create**.
13. Navigate to **Access control (IAM)**, select **Role assignments**, and click **+ Add**. 14. Select **Add role assignment** on the **Access Control** page.
15. On the **Add role assignment** page, click **Role** and select **Owner**.
16. Click **Select members**, click **+ Select members**, and select the required application and users.
17. Click **Review + Assign** to display the **Access Policies** page.
18. On the **Access Policies** page:
1. Select the check boxes for: 1. **Azure Virtual Machines for deployment** 2. **Azure Resource Manager for template deployment** 3. **Azure Disk Encryption for volume encryption** 2. Select **Vault access policy** as the permission model. 3. Click **Create** to create the policy. 19. Set the following permissions and click **Next**.
1. **Key permissions:** Get 2. **Secret permissions:** Get 3. **Certificate permissions:** Get 20. Search for the username, assign permissions, select the user, then click **Next**.
21. Select the application that was created and click **Next**.
22. Review the configuration and click **Create** to create the access policy.
### App Registration Follow the steps below for App Registration. 1. Navigate to **App Registrations**. 2. Select **All Applications**, search for the application created in the Enterprise Application section (for example, **devatestapp**), and click the application. 3. Navigate to **Certificates & secrets**, select **Client secrets**, and click **New Client Secret**. 4. Enter any name in the **Description** field and click **Add**. 5. Copy the **Value ID** and save it in a document. 6. Click **Overview**, copy the **Client ID** and **Tenant ID**, and save them in a document. ### Authentication and Authorization Follow the steps below to authenticate and access the OvalEdge application. 1. Navigate to the **App Registration** for the Enterprise Application, then click **Token Configuration**. Click **+ Add optional claim**, select **SAML**, select **email** and **upn**, and then click **Add**.
2. Enable the Microsoft Graph email and profile permissions (required for claims to appear in the token), and click Add.
3. Click **+ Add groups claim**. Select **Security groups**, and then configure the following:
1. Under **ID**, select **sAMAccountName**. 2. Under **Access**, select **sAMAccountName**. 3. Under **SAML**, select **Group ID**. 4. Click **Add**. 4. Navigate to **App roles**. Click **+ Create app role** and configure the following: 1. **Display name:** `OE_ADMIN` 2. **Allowed member types:** `Both (Users/Groups + Applications)` 3. **Value:** `OE_ADMIN` 4. **Description:** `OE_ADMIN` 5. Click **Apply**. 5. Navigate to the **Enterprise Application** and search for the application. 6. Click **Assign users and groups**. 7. Click **+ Add user/group**.
8. Click **None selected**, search for the user, and click **Add**.
9. After selecting the user, assign the role that was created in **Step #4**.
### Tomcat Configuration There are two different scenarios for Tomcat configuration. #### Without Key Vault In this scenario: ``` azure-dbkeyvault=false ``` Follow the steps below to configure Tomcat. 1. In the `oasis.properties` file, configure the following information. ``` samlHTTPMetadataProvider=entityBaseURL=https://:/ovaledgeazure-dbkeyvault=falseazure-tenantid=azure-clientid=azure-clientsecret=azure-resource=https://vault.azure.net ```
2. Start Tomcat. #### With Key Vault In this scenario: ``` azure-dbkeyvault=true ``` Follow the steps below to configure Tomcat. 1. In the Tomcat `setenv.sh` file, add: ``` export CATALINA_OPTS="-DOVALEDGE_SECURITY_TYPE=saml" ``` 2. Place the following files in the `saml` folder. 1. `keystore.jks` 2. `azureAD.cer` 3. `keyvault.jar` 3. Add the following information to the `oasis.properties` file. ``` samlHTTPMetadataProvider=entityBaseURL=https://:8443/ovaledgeSAML_PATH=azure-dbkeyvault=trueazure-keyvaulturi=azure-tenantid=azure-clientid=azure-clientsecret=azure-resource=https://vault.azure.netazure.secretname.jdbcstring=azure.secretname.username=azure.secretname.password=azure.secretname.encryptdecryptkey= ``` {% hint style="info" %} The secret keys referenced above are the keys created in **Chapter 2**. {% endhint %} **Example:** ``` azure.secretname.jdbcstring=jdbcstringazure.secretname.username=usernameazure.secretname.password=passwordazure.secretname.encryptdecryptkey=ovaledgeencryptdecryptkeyKEY=devatestappcertificate ``` ![](/files/TDTdesMpl7yHHiBPLgRT) 4. Start Tomcat. 1. After completing the Tomcat configuration, open a web browser and enter the OvalEdge application URL. The **Login** page is displayed.
2. Click **Login** to open the **Sign-in** page. Enter the required credentials to access the OvalEdge application.
3. You can view the new user role on the **Administration > Users & Roles > Roles** page.
*** Copyright © 2026, OvalEdge LLC, Peachtree Corners, GA, USA. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.ovaledge.com/release8.2/installation-and-settings/authentication-and-sso-setup/microsoft-entra-id-azure-ad.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.