Ctrlk
AcademyCustomer Portal
For the complete documentation index, see llms.txt. This page is also available as Markdown.

Microsoft Entra ID (Azure AD)

This article explains how to integrate the OvalEdge application with Microsoft Entra ID (formerly Azure Active Directory) to enable SAML-based Single Sign-On (SSO) and centralized identity management. It covers the complete configuration process, including creating an enterprise application, configuring SAML authentication, optionally securing application secrets in Azure Key Vault, registering the application, assigning users and roles, and updating the Tomcat configuration required for the integration.

Microsoft has recently renamed Azure Active Directory (also called Azure AD or AAD) to Microsoft Entra ID. This is not to be confused with Windows Server Active Directory, which remains unchanged.

Purpose

The purpose of this document is to guide administrators through configuring Microsoft Entra ID authentication for the OvalEdge application. By completing the steps in this guide, you can:

  • Enable Single Sign-On (SSO) using the SAML 2.0 protocol.

  • Authenticate users through Microsoft Entra ID instead of managing local application credentials.

  • Configure role-based access by mapping Microsoft Entra ID users and groups to OvalEdge roles.

  • Secure sensitive application configuration, such as database credentials and encryption keys, using Azure Key Vault (optional).

  • Register the application to securely access Azure resources, including Key Vault.

  • Configure the Tomcat application server to support Microsoft Entra ID authentication, with or without Azure Key Vault integration.

  • Provide users with a secure and centralized sign-in experience while simplifying identity and access management across the organization.

The Setup

Follow the steps below to integrate the OvalEdge application with Microsoft Entra ID and run the OvalEdge application with HTTPS.

Example:

https://<DNS>:8443/ovaledge

  • Create an Enterprise application in Azure: Used to authenticate Azure users in the OvalEdge application.

  • Create Key Vault Secrets: Used to store the MySQL database details and the SAML certificate.

  • App Registration: Used to authenticate the OvalEdge application with Azure Key Vault.

  • Authentication and Authorization: Explains how to create roles and groups in Active Directory and add members to the groups.

  • Tomcat Configuration: Used to configure Azure with the OvalEdge application.

Create an Enterprise Application in Azure

To create an Enterprise application in Azure, complete the following steps:

  1. Navigate to Azure Active Directory and click Azure Active Directory.

  2. Click Enterprise Applications to display the Enterprise Applications page.

  3. On the Enterprise Applications page, click + New Application to display the Browse Azure AD Gallery page.

  4. On the Browse Azure AD Gallery page, click Create your own application.

  5. Enter the application name and click Create.

  6. Open the application that was created, click Single Sign-on, and select SAML.

  7. Click Edit to edit Basic SAML Configuration.

  8. Enter the following values and click Save.

    1. Identifier:

    2. Reply URL (Assertion Consumer Service URL):

    3. Logout URL (Optional):

Specify the port if such a configuration is used.

  1. Click Edit to configure Attributes & Claims.

  2. Click + Add a group claim, select Groups assigned to the application, and then click Save.

  3. Click Edit to edit SAML Signing Certificate.

  4. Select Signing Algorithm as SHA-1 and click Save to display the SAML-based Sign-on page.

  5. On the SAML-based Sign-on page, click the Copy icon to copy the metadata URL.

Creating Key-Value Secrets (Optional)

The purpose of this section is to store database and Elasticsearch (ES) details that should not be shared publicly.

To create Key Vault secrets in Azure, complete the following steps:

  1. Navigate to Azure Key Vaults.

  2. On the Key Vaults page, click Create.

  3. Enter the Resource group and Key vault name.

  4. In the Access Policy tab, select Vault access policy for Permission Model, provide Key, Secret, and Certificate permissions to the required users, and click Review + Create.

  5. Verify the entered details and click Create.

  6. After the deployment is complete, click Go to resource to open the Key Vault | Overview page.

  7. Click Secrets.

  8. Click + Generate/Import.

  9. To create the first secret:

    1. Select Upload options as Manual.

    2. Enter Name as jdbcstring.

    3. Enter Value as:

    4. Click Create.

  10. Create the next secret.

    1. Select Upload options as Manual.

    2. Enter the Name as the database username.

    3. Enter the Value as the username used to access the database.

    4. Click Create.

  11. Enter the Name as password, enter the Value as the database password, and click Create.

  12. Enter the Name as ovaledgeencryptdecryptkey, enter the desired value, and click Create.

  13. Navigate to Access control (IAM), select Role assignments, and click + Add.

  14. Select Add role assignment on the Access Control page.

  15. On the Add role assignment page, click Role and select Owner.

  16. Click Select members, click + Select members, and select the required application and users.

  17. Click Review + Assign to display the Access Policies page.

  18. On the Access Policies page:

    1. Select the check boxes for:

      1. Azure Virtual Machines for deployment

      2. Azure Resource Manager for template deployment

      3. Azure Disk Encryption for volume encryption

    2. Select Vault access policy as the permission model.

    3. Click Create to create the policy.

  19. Set the following permissions and click Next.

    1. Key permissions: Get

    2. Secret permissions: Get

    3. Certificate permissions: Get

  20. Search for the username, assign permissions, select the user, then click Next.

  21. Select the application that was created and click Next.

  22. Review the configuration and click Create to create the access policy.

App Registration

Follow the steps below for App Registration.

  1. Navigate to App Registrations.

  2. Select All Applications, search for the application created in the Enterprise Application section (for example, devatestapp), and click the application.

  3. Navigate to Certificates & secrets, select Client secrets, and click New Client Secret.

  4. Enter any name in the Description field and click Add.

  5. Copy the Value ID and save it in a document.

  6. Click Overview, copy the Client ID and Tenant ID, and save them in a document.

Authentication and Authorization

Follow the steps below to authenticate and access the OvalEdge application.

  1. Navigate to the App Registration for the Enterprise Application, then click Token Configuration. Click + Add optional claim, select SAML, select email and upn, and then click Add.

  2. Enable the Microsoft Graph email and profile permissions (required for claims to appear in the token), and click Add.

  3. Click + Add groups claim. Select Security groups, and then configure the following:

    1. Under ID, select sAMAccountName.

    2. Under Access, select sAMAccountName.

    3. Under SAML, select Group ID.

    4. Click Add.

  4. Navigate to App roles. Click + Create app role and configure the following:

    1. Display name: OE_ADMIN

    2. Allowed member types: Both (Users/Groups + Applications)

    3. Value: OE_ADMIN

    4. Description: OE_ADMIN

    5. Click Apply.

  5. Navigate to the Enterprise Application and search for the application.

  6. Click Assign users and groups.

  7. Click + Add user/group.

  8. Click None selected, search for the user, and click Add.

  9. After selecting the user, assign the role that was created in Step #4.

Tomcat Configuration

There are two different scenarios for Tomcat configuration.

Without Key Vault

In this scenario:

Follow the steps below to configure Tomcat.

  1. In the oasis.properties file, configure the following information.

  1. Start Tomcat.

With Key Vault

In this scenario:

Follow the steps below to configure Tomcat.

  1. In the Tomcat setenv.sh file, add:

  2. Place the following files in the saml folder.

    1. keystore.jks

    2. azureAD.cer

    3. keyvault.jar

  3. Add the following information to the oasis.properties file.

The secret keys referenced above are the keys created in Chapter 2.

Example:

  1. Start Tomcat.

    1. After completing the Tomcat configuration, open a web browser and enter the OvalEdge application URL. The Login page is displayed.

    2. Click Login to open the Sign-in page. Enter the required credentials to access the OvalEdge application.

    3. You can view the new user role on the Administration > Users & Roles > Roles page.

Copyright © 2026, OvalEdge LLC, Peachtree Corners, GA, USA.

PreviousMicrosoft Active DirectoryNextMicrosoft Entra ID (Azure AD) Without Key Vault

Was this helpful?