Docking Azure AD

If you host an Active Directory (AD) instance in Azure, you can refer to this article to dock Azure AD to the platform, allowing your users to log in to the platform using their Microsoft accounts.

Prerequisites

• Obtain the following field information from the configuration page of Azure AD in advance:

  • clientID
  • clientSecret
  • tenant
  • redirectURI

• Ensure that the dex service has been deployed on the control node of the global cluster where the command is executed.
  Tip: When the platform is deployed, the dex service is deployed for the global cluster by default.

Procedure

1. Log in to the control node of the global cluster where the dex service is deployed with an account that has root permissions.

2. Execute the command line to generate the config field value that has been encrypted by base64 based on the clientID, clientSecret, tenant, and redirectURI fields.

   The command line is as follows. When executing it, please enter the actual values of the fields:

   $ echo '{"clientID":"abde786d-eaa6-4ea5-88f2-69ebc4f14d11","clientSecret":"LmVgiceuCn1tbf?UAW4dry55oU?ppg@/", "tenant": "1aeac33e-b82d-4f70-918f-96e4b6a39e6b", "redirectURI": "https://192.168.16.52/dex/callback"}' | base64

   The example of the output value of the config field is as follows:

   eyJjbGllbnRJRCI6ImFiZGU3ODZkLWVhYTYtNGVhNS04OGYyLTY5ZWJjNGYxNGQxMSIsImNsaWVudFNlY3JldCI6IkxtVmdpY2V1Q24xdGJmP1VBVzRkcnk1NW9VP3BwZ0AvIiwgInRlbmFudCI6ICIxYWVhYzMzZS1iODJkLTRmNzAtOTE4Zi05NmU0YjZhMzllNmIiLCAicmVkaXJlY3RVUkkiOiAiaHR0cHM6Ly8xOTIuMTY4LjE2LjUyL2RleC9jYWxsYmFjayJ9Cg==

   Note: The output values of the config field may be displayed with line breaks. When entering, make sure to concatenate the field values into a single line.

3. Execute the command line to create a Microsoft type dex Connector.

   The command line example and key parameter instructions are as follows. Please enter the actual values of the fields when executing:

   $ cat <<EOF | kubectl apply -f -
   apiVersion: dex.coreos.com/v1
   kind: Connector
   metadata:
     name: microsoft
     namespace: cpaas-system
   config: eyJjbGllbnRJRCI6ImFiZGU3ODZkLWVhYTYtNGVhNS04OGYyLTY5ZWJjNGYxNGQxMSIsImNsaWVudFNlY3JldCI6IkxtVmdpY2V1Q24xdGJmP1VBVzRkcnk1NW9VP3BwZ0AvIiwgInRlbmFudCI6ICIxYWVhYzMzZS1iODJkLTRmNzAtOTE4Zi05NmU0YjZhMzllNmIiLCAicmVkaXJlY3RVUkkiOiAiaHR0cHM6Ly8xOTIuMTY4LjE2LjUyL2RleC9jYWxsYmFjayJ9Cg==
   id: microsoft               
   name: microsoft
   type: microsoft
   EOF

   Parameter Description:

• kind: Must be Connector.

• type: Must be microsoft.

• id and metadata.name must be consistent.

• metadata.namespace: The name of the system namespace. Please fill in according to the actual situation. The default is cpaas-system.

• name: The display name of the IDP configuration, which is also the name of the login button.

• config: The field value generated in the previous step. If the output value is displayed in multiple lines, it needs to be manually concatenated into one line when entering here.

Validation of results

After completing the above steps, there are two ways to verify whether the docking is successful:

• On the platform login page, if a login method button named after the name field value in the configuration appears, it indicates that the docking is successful.

• Log in to the platform with an administrator account, click Platform Management > User Role Management > IDP Configuration on the left navigation bar to enter the IDP configuration list page. If there is already an IDP of type MICROSOFT, it indicates that the docking is successful.