/
Lab 2.6: Federation Configuration

Lab 2.6: Federation Configuration

Purpose

The purpose of this module is to understand how to configure SAML IdPs as authentication methods. This will enable applications to accept SAML federated identities.

Requirements

Access to Microsoft Entra ID (formerly Azure AD) test tenant. The credentials will be provided by your instructor.

 

Overview

The user will access the SmartPlan application (SP B) but will log in to City Group Entra ID (IDP A) using credentials issued by IDP A.

Part 1: Configure Entra ID authentication method

  1. Log in to the SSO admin console, go to Global Method Settings and click on "New Method". Enter the following data and click "Ok".
    Obs: Every student must have a unique "Name" such as entra.saml.yourname

    Title

    City Group AD

    Name*

    entra.saml.yourname

    Method Type

    SAML

    Directory

    CustomerID Directory

     

  2. image-20260703-110936.png

    Add the following configuration string in the "Compatibility Flags box": HttpPostResponseValidate AuthnRequestSign MetadataCertificate IdpProxyDelegate

    Then tick the "Enabled" box, and press "Update"

    image-20260703-111225.png

     

  3. On the "SAML" tab, right-click the "Download Metadata" link and save the metadata to the file "smartplan-sp.xml" on the Desktop. We will upload the IdP metadata later when it is available.

    image-20260703-111411.png



  4. Add the method entra.saml.yourname to sites eIDM Users and SmartPlan (use "Site Methods" tab)

  5. Allow Entra ID authentication for SmartPlan Application: On the SmartPlan site, go to Applications → SmartPlan Application → Allowed Methods, select the method entra.saml.yourname and click on "Update". 
    Note: We allow access only to CustomerID users, so we don't add any new groups on the "Allowed To" tab. To access the SmartPlan Application, the user's Entra ID identity must be present in the CustomerID user directory.  

Part 2: Configure Directory User Mapping

To link Entra ID identities to CustomerID user profiles, Directory User Mapping is configured as follows:

  1. Go to Home → Directory User Mappings, click on "New Mapping..."

  2. Enter "Entra-CID-Mapping" in the Name field and write a description, for example "Maps Entra identity to CID by using email address." Click the OK button.

    image-20260703-111924.png



  3. Go to the "User Mappings" tab and click on "Add". Give following data:

    Precondition

    <empty>

    Select

    Ubilogin Directory

    Server

    <filled in automatically>

    Distinguished Name

    <filled in automatically>

    Scope

    sub

    Filter

    (&(objectclass=ubiloginUser)(mail={method:http://schemas.xmlsoap.org/ws/2005/05/identity/claims/}))

    This mapping will search for a CustomerID user whose email address matches the "name" claim received from Entra ID.



  4. On the Methods tab, select Citigroup AD (entra.saml.yourname) and Update.

Part 3: Register application in Entra ID

To access the SmartPlan application using Entra ID authentication, it must be added to the Entra ID tenant.

  1. Go to http://portal.azure.com/ and log in with the credentials given by your instructor.

  2. Go to "Microsoft Entra ID" → Manage → Enterprise Applications

    image-20260703-113159.png



  3. Click "New Application" and then select "Create your own application".

     

    image-20260703-113440.png



    image-20260703-113801.png





  4. Give a unique application name, for example "SmartPlan Application" followed by your name, and select "Create".

    image-20260703-113941.png





  5. Select Manage → "Single sign-on" and "SAML".

    image-20260703-114229.png



  6. Select "Upload metadata file" and select the file you saved in Part 1, step 3 of this lab ("metadata.xml" on Desktop). The Entity ID and Assertion Consumer Service URL will be displayed.

    image-20260703-114508.png



  7. Save the changes.

    image-20260703-115228.png



  8. Copy the App Federation metadata URL to the clipboard.

    image-20260807-121116.png



  9. Go to "Users and Groups" and click on "Add user/group".

    image-20260807-121338.png



  10. First click on "None selected." When you see "Users", search for Jeremy, select "Jeremy Mills" and click "Select". Then click "Assign". Entra ID configuration is now complete.

    image-20260807-121933.png
    image-20260807-122032.png





Part 4: Complete Entra ID authentication method configuration

  1.  To complete the federation configuration, upload the Entra ID metadata to the Entra ID authentication method in SSO. First, open the Entra ID metadata URL (copied to the clipboard in task 8 of step 3 above). Right-click and select "View Page Source". On the page source tab, copy the metadata to the clipboard (Ctrl+A, Ctrl+C).

    image-20260807-125304.png



  2. Go to SSO admin console: Home → Global Method Settings → Citigroup AD. Then select SAML tab. Click "Upload" and paste the Entra ID metadata from the clipboard. Click the OK button.

    image-20260807-123241.png

  3. Save the changes by clicking the Update button. You can see the SAML Identity Provider ID on the SAML tab.

    image-20260807-123332.png

     

  4. Restart UbiloginServer now.

Part 5: Log in to SmartPlan application

  1. To test the federation from City Group AD, we must have a test user in Entra ID and a user profile with a matching email address in CustomerID. To do this, log in as Scott Long (the superuser) and modify Jeremy Mills's email address in CustomerID to match the test user in Entra ID: jeremy.mills@iamacademy.ubisecure.com. This is how it will look once you save the new email address:

    image-20260807-125700.png




  2. Log out of CustomerID and go to the SmartPlan application

  3. Select "City Group AD" authentication method





  4. Log in as Jeremy Mills:

    User ID

    jeremy.mills@iamacademy.ubisecure.com

    Password

    Will be given by the instructor

  5. Note that in SmartPlan application you see Jeremy's attributes from CustomerID, not from Entra ID.




  6. You have now completed the exercise.


Extra task 1

In addition to CustomerID user attributes, you may need user attributes from the federation source in your applications. In this exercise we will pass user's job title from Entra ID to SmartPlan Application.

  1. First we need to configure Entra ID to include the job title in the SAML assertion. Open your application in Entra ID Portal: go to Entra ID → Enterprise Applications → "SmartPlan Application Yourname"

  2. Select "Single sign-on" on the navigation pane

  3. On section "3. User Attributes" check "View and edit all other user attributes"



  4. Click on "Add attribute"

  5. Enter following values and click on "OK". Then save the changes.

    Name

    title

    Value

    user.jobtitle

    Namespace

    http://schemas.xmlsoap.org/ws/2005/05/identity/claims

  6. Next we modify the Authorization Policy to include user's job title from Entra ID. Go to SSO admin UI (https://login.smartplan.com:8443/ubilogin/) and navigate to Authorization Policies of site SmartPlan.



  7. Click on "SmartPlan policy" and select tab "Attributes".

  8. Add new attribute as follows and click on "Update":

    Group

    eIDM Users

    Name

    title

    Value

    method:http://schemas.xmlsoap.org/ws/2005/05/identity/claims/title

  9. Log on to SmartPlan Application (http://localhost:8090/smartplanapplication/) via City Group AD and verify that you now see Jeremy's job title:

Extra task 2

Sometimes it's useful to see all attributes received from a federation source e.g. for debugging purposes. This can be done by removing the Authorization Policy of SmartPlan Application.

  1. Go to SSO admin UI (https://login.smartplan.com:8443/ubilogin/) and navigate to Authorzation Policies of site SmartPlan: Home - SmartPlan - Authorization Policies.

  2. Select tab "Applications"

  3. Remove SmartPlan Application.

  4. Log on to SmartPlan Application (http://localhost:8090/smartplanapplication/) via City Group AD and you should see all attributes received from Azure AD: