| title | excerpt | updated |
|---|---|---|
Enabling Entra ID SSO connections with your OVHcloud account |
Find out how to associate your Entra ID (formerly Azure Active Directory) to your OVHcloud account using SAML 2.0 |
2024-07-05 |
You can use Single Sign-On (SSO) to connect to your OVHcloud account. To enable these connections, your account and your Entra ID (formerly Azure Active Directory) have to be configured using SAML (Security Assertion Markup Language) authentications.
This guide explains how to associate your OVHcloud account with an external Entra ID.
- Belong to the Application Administrator and User Administrator roles of an Entra ID service
- An OVHcloud account
- Access to the OVHcloud Control Panel
[!primary]
In order for a service provider (i.e. your OVHcloud account) to establish an SSO connection with an identity provider (i.e. your Entra ID), the essential part is to establish a mutual trust relationship by registering the SSO connection in both services.
Your Entra ID acts as your identity provider. Authentication requests by your OVHcloud account will only be accepted if it is declared as a trusted party first.
Let's focus for a moment on the identities on the identity provider side.
To start, go to your Entra ID dashboard.
{.thumbnail}
Then click on Users{.action} from the left-hand menu.
{.thumbnail}
Create as many users as you need, or you can just check your users clicking on them.
For this example, the user John Smith will be used.
{.thumbnail}
When an SSO authentication is performed, John Smith's identity will be provided by Entra ID to the OVHcloud account. However, it is necessary that this identity contains at least one group. If no group exists, let's look at how to create one to add John Smith to it.
Click on Groups{.action} from the left-hand menu.
{.thumbnail}
Click on New group{.action} in the top menu, and fill in all the necessary information.
For this example, the group manager@ovhcloudsaml will be used.
{.thumbnail}
Click on the Create{.action} button to display all information about this group.
{.thumbnail}
Now, users who will be used for SSO authentication must be added to a group.
In this example, let's link the user John Smith with the group manager@ovhcloudsaml.
In the selected group interface, click on Members{.action} from the left-hand menu, then click Add members{.action} in the top menu.
{.thumbnail}
Select the user to be added to this group, then click on the Select{.action} button.
{.thumbnail}
Now we have a user assigned to a group.
In order to perform SSO authentications, an Entra ID application must be created.
SSO must be configured on this application.
First of all, it is necessary to create an application if one does not yet exist.
Click on Enterprise applications{.action} from the left-hand menu.
{.thumbnail}
Click on New application{.action} in the top menu.
{.thumbnail}
Click on Create your own application{.action} in the top menu.
{.thumbnail}
Select the Non-gallery{.action} from the left-hand menu, and click on the Create{.action} button.
{.thumbnail}
The details of the application will then be displayed.
{.thumbnail}
The Entra ID application is now created. Users who want to perform SSO authentications via this application must now be added to it.
[!primary]
In order for a user to perform an SSO authentication from an Entra ID application, it must be added to that application. It is therefore shown here how to add a user to an Entra ID application.
However, it is better to add a user group instead of users if you have Entra ID Premium.
Click on Users and groups{.action} from the left-hand menu, then click Add user/group{.action} in the top menu.
Click then on the Users{.action} section, select the user to add to the application, and click on the Select{.action} button.
{.thumbnail}
{.thumbnail}
The application is created, a user has been assigned, all that remains is to set up the SSO via SAML.
Get back to the overview via the Overview{.action} button from the left-hand menu, then click on the Set up single sign on{.action} section.
{.thumbnail}
Click on the SAML{.action} section.
{.thumbnail}
Click on Upload metadata file{.action} in the top menu.
{.thumbnail}
Click on the Select a file{.action} icon button, select the OVHcloud Service Provider metadata file and click on the Add{.action} button.
You can obtain the appropriate metadata file via the following links:
Download the metadata file, it will be necessary later.
{.thumbnail}
The SAML configuration will be displayed.
{.thumbnail}
In the Attributes & Claims{.action} section, click on the Edit{.action} button.
{.thumbnail}
You now need to add a UPN (User Principal Name) attribute to SAML infos, in order to inform OVHcloud about the user's email. This step is mandatory.
Click on Add a new claim{.action} in the top menu.
Fill in the Name{.action} field with http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn.
Fill in the Source attribute{.action} field with user.mail{.action}.
Your interface should look like the following:
{.thumbnail}
Click on Save{.action}.
Let's now declare the attribute for the user group.
Click on Add a group claim{.action} in the top menu.
{.thumbnail}
Select Security groups{.action}, and Group ID from the Source attribute{.action} and click on the Save{.action} button.
{.thumbnail}
The groups claim should now appear in the list.
Copy and save the Claim name value somewhere (i.e a notepad), it will be necessary later.
{.thumbnail}
In the SAML certificates{.action} section, copy the App Federation Metadata Url{.action} field value.
Use this link to download the Entra ID application metadata file in order to use it later in the OVHcloud account.
{.thumbnail}
Adding your Entra ID application as a trusted identity provider is done in the OVHcloud Control Panel where you can provide the identity provider metadata.
Click your account name in the top-right corner, then on your name again in the sidebar.
{.thumbnail}
You can access the IAM menu via the dedicated entry in your Control Panel.
{.thumbnail}
Then click on the Identities{.action} tab to access local users management.
{.thumbnail}
Click on the SSO connection{.action} button.
{.thumbnail}
Fill in the field User Attribute Name with the Entra ID application UPN claim name and enter the groups claim name value saved before into the field Group Attribute Name.
Fill in the XML metadata of your Entra ID application from the file saved before.
You can keep local users by ticking the Keep active OVHcloud users box.
Click on the Confirm{.action} button.
{.thumbnail}
The trust of your Entra ID application as identity provider is thus established but you still have to add groups to your OVHcloud account.
Warning
If you try to connect at this stage via SSO, you will probably receive a Not in valid groups error message.
That is because your OVHcloud account checks if the authenticating user belongs to a group that actually exists on the account.
To resolve this, check the "Group" attribute that your Entra ID application returns: the Object Id field.
{.thumbnail}
Add it by clicking on the Declare a group{.action}.
{.thumbnail}
Fill in the fields, then click on the Confirm{.action} button.
{.thumbnail}
The created group should appear on the list.
{.thumbnail}
Warning: if you give the NONE privilege, you will need to assign permissions to this group via the IAM policies.
On the OVHcloud login page, enter your NIC handle followed by /idp without entering a password, and click the Login{.action} button.
{.thumbnail}
You are then redirected to your Entra ID application login page. Select Use another account{.action}.
{.thumbnail}
Enter the Entra ID application user email and click on the Next{.action} button.
{.thumbnail}
Enter the Entra ID application user password and click on the Sign In{.action} button.
{.thumbnail}
You are now logged in with the same NIC handle, but via your Active Directory user and using your Entra ID application SSO.
{.thumbnail}
If your email does not appear below Connected via SSO, this means you have not configured the UPN attribute properly, and some of the features will not work in a correct manner.
How to use IAM policies using the OVHcloud Control Panel.
Join our community of users.