Set up SAML with Microsoft Azure Active Directory#
This article explains how to set up SAML with Microsoft Azure Active Directory (AD) for an organization in Aiven. For more information on SAML and instructions for other identity providers, see the Set up SAML authentication article.
Prerequisite steps in Aiven Console#
In the organization, click Admin.
Click Add authentication method.
Enter a name and select SAML. You can also select the groups that users will be added to when they sign up or log in through this authentication method.
You are shown two parameters needed to set up the SAML authentication in Microsoft Azure AD:
Configure SAML on Microsoft Azure#
First, you set up the application on Azure. Then, you add a claim and users.
Set up an Azure application#
Log in to Microsoft Azure.
Got to Enterprise applications.
Select All applications.
Click New application.
Select the Add from the gallery search bar and use the Azure AD SAML Toolkit.
Go back to the Enterprise applications list.
The newly created application might not be visible yet. You can use the All applications filter to see the new application.
Click on the name of the new application. The configuration opens.
Select Single sign-on configuration.
Select SAML as the single sign-on method.
Add the following parameters to the Basic SAML Configuration:
Create a claim and add users#
In the User Attributes & Claims, click Add a new claim.
Create an attribute with the following data:
Download the Certificate (Base64) from the SAML Signing Certificate section.
Go to Users and groups and click Add user.
Select the users that you want to use Azure AD to log in to Aiven.
Finish the configuration in Aiven#
Go back to the Authentication page in Aiven Console to enable the SAML authentication method:
Select the name of the Azure AD method that you created.
In the SAML configuration section, click Edit.
Add the configuration settings from Azure:
SAML IDP URLto the
Login URLfrom Azure.
SAML Entity IDto the
Azure AD Identifierfrom Azure.
Paste the certificate from Azure into the
Click Edit method to save your changes.
Toggle on Enable authentication method at the top of the page.
In the Signup and link accounts URLs section, copy the appropriate link and send it to your users to switch them to the new IdP:
Signup URL: For users that don’t have an Aiven user account and need to create a new Aiven user linked to this IdP.
Account link URL: For users that already have an Aiven user account to link their existing Aiven user with the configured IdP.
If you set up a SAML authentication method before and are now switching to a new IdP, existing users need to log in with the new account link URL to finish the setup.
Error: contact your administrator#
If you get an error message suggesting you contact your administrator, try these steps:
Go to the Microsoft Azure AD user profile for the users.
In Contact Info, check whether the Email field is blank.
If it is blank, there are two possible solutions:
In User Principal Name, if the Identity field is an email address, try changing the User Attributes & Claims to
email = user.userprincipalname.
In Contact Info, if none of the Alternate email fields are blank, try changing the User Attributes & Claims to
email = user.othermail.