Microsoft Internal

Microsoft (Internal) OpenID Setup

This guide walks through a basic setup allowing Microsoft users to authenticate with your Kasm deployment.

Reference Docs:

• https://docs.microsoft.com/en-us/azure/active-directory/develop/quickstart-register-app
• https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-v2-protocols
• https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-fed-group-claims

Creating a Microsoft OAuth App

1. Login to the Microsoft Azure Portal: https://portal.azure.com/

2. Select Azure Active Directory.

Azure Active Directory

3. Select App Registrations.

App Registration

4. Select New Registration.

5. Give the app a Name (e.g Kasm)

6. In the Supported account types select Accounts in this organizational directory only....

Register App

7. On the next page, the Application (client) ID is shown, save this value as the Client ID to be used in the next section.

8. Select Endpoints. Note the OAuth 2.0 authorization endpoint (v2), OAuth 2.0 token endpoint (v2), and OpenID Connect metadata document values to be used in the next section.

9. Select Add a certificate or secret next to Client credentials.

Client Credentials

10. Select the Client secrets tab, then slick New client secret.

11. Enter a description and expiration then click Add.

12. The credentials are shown, save the Value as the Client Secret to be used in the next section.

Client Secret

13. Select Token configuration.

14. Select Add groups claim.

15. Check Security groups, then click Add.

Group Claims

16. Select Add Optional Claim

17. Under Token Type select ID, then check the box for sid. Click Add.

:align: center
**SID Claim**

Claims Configured

18. Select Authentication

19. In Front-channel Logout URL, provide the Kasm /api/oidc_frontchannel_logout endpoint as shown. Click Save.

Front-channel Logout URL

18. In another browser tab, navigate to the OpenID Connect metadata document URL value saved from earlier. Find and save off the value for the "issuer" field in the response, to be used in the next section.

Kasm OpenID Config

1. Log into the Kasm UI as an administrator.

2. Select Access Management -> Authentication -> OpenID -> Add Config.

3. Update the form with the following entries, using the Client ID and Client Secret gathered in the previous section.

Property	Value
Enabled	Checked
Display Name	Continue with Microsoft
Logo URL	https://www.microsoft.com/favicon.ico
Auto Login	Unchecked
Hostname	<Empty>
Default	Checked
Client ID	<Client ID from Microsoft OAuth App>
Client Secret	<Client Secret from Microsoft OAuth App>
Authorization URL	<OAuth 2.0 authorization endpoint (v2) value from Microsoft OAuth App>
Token URL	<OAuth 2.0 token endpoint (v2) value fom Microsoft OAuth App>
User Info URL	https://graph.microsoft.com/oidc/userinfo
Scope	openid email profile
Username Attribute	email
Groups Attribute	groups
Debug	Unchecked
Redirect URL	https://<Kasm hostname>/api/oidc_callback
OpenID Connect Issuer	<Issuer value from the OpenID Connect metadata document>
Logout with OIDC Provider	Checked
Enable OIDC SLO Frontchannel Endpoint	Checked

Kasm OIDC Configurations

6. Click Save to save the changes.

Microsoft Login Test

1. Logout of the Kasm to display the login screen. The OpenID configuration should be shown.

Login Screen

2. Click Continue with Microsoft

3. The user is redirected to Microsoft for auth.

Microsoft Auth

4. Upon completion, the user is logged into the Kasm app.

Group Mapping

The previous configurations will instruct the identity provider to send a list of Security Group ID the user belongs to during the OpenID auth workflow. We can configure Kasm Groups with the Security Group IDs from Azure AD so that users are automatically added/removed based on their Azure AD group Membership.

1. Log into the Kasm UI as an administrator.
2. Select Access Management -> Groups -> Add Group.
3. Name the Group Group Test, and define a priority.
4. Click Save to create the group.

Add Group

1. On the groups screen, using the arrow menu select Edit on the group that was just created.
2. Navigate to the SSO Group Mappings tab and select Add SSO Mapping.
3. Select the OpenID IDP that was created above "OpenID - Continue with Microsoft" for the SSO Provider.
4. Then enter the Azure AD security group ID desired in the Group Attributes field.

Add SSO Group Mapping

1. Click Submit
2. Logout, then login via the Microsoft Open ID login with a user that is a member of the specified group.
3. View the users group membership to ensure they are added to the newly created group.