SSO with Azure AD
Prerequisite
Set up OIDC configuration within Azure by selecting the type as Web and with the redirect URI pointing to your deployment, as seen in the image below.
Redirect URL - {base_url}/api/sso/azuread/callback
![](https://docs.fiddler.ai/~gitbook/image?url=https%3A%2F%2F2341805124-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FNEyFKGwv2eAllsWbuafo%252Fuploads%252Fgit-blob-70f44f9d24731a100367504b8d7cccfcdbb45b52%252Fce5d081-Azure_SSO_registration.png%3Falt%3Dmedia&width=768&dpr=4&quality=100&sign=64c2e995&sv=1)
Once the registration is successful, create a new client secret and copy the secret value immediately after it is created without refreshing the page.
![](https://docs.fiddler.ai/~gitbook/image?url=https%3A%2F%2F2341805124-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FNEyFKGwv2eAllsWbuafo%252Fuploads%252Fgit-blob-52afb1a75c66332779c4c5d7307fb815273aa9eb%252F96042ac-Azure_add_new_client_secret.png%3Falt%3Dmedia&width=768&dpr=4&quality=100&sign=88d36417&sv=1)
🚧 Be careful
You will not be able to access the
client secret
later because it is shown ONCE and not repeated
Creating a new client secret
![](https://docs.fiddler.ai/~gitbook/image?url=https%3A%2F%2F2341805124-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FNEyFKGwv2eAllsWbuafo%252Fuploads%252Fgit-blob-348971f0282445b0f072513c5c233fbdb9add1ce%252F1f8d791-Azure_Client_Secret.png%3Falt%3Dmedia&width=768&dpr=4&quality=100&sign=176259bc&sv=1)
Masked client secret value
Setting up token permissions to the application
![](https://docs.fiddler.ai/~gitbook/image?url=https%3A%2F%2F2341805124-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FNEyFKGwv2eAllsWbuafo%252Fuploads%252Fgit-blob-295e79de63da7f0ccd426260d4d7944f0a41c002%252Fe40da63-Screenshot_2024-04-15_at_12.21.03_PM.png%3Falt%3Dmedia&width=768&dpr=4&quality=100&sign=63901861&sv=1)
Token Permissions
Setting up API permissions to the application
![](https://docs.fiddler.ai/~gitbook/image?url=https%3A%2F%2F2341805124-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FNEyFKGwv2eAllsWbuafo%252Fuploads%252Fgit-blob-d3b5b76205d60e1bd5aa4900208558bc9b370b1a%252F5e2f00e-Screenshot_2024-04-15_at_12.22.12_PM.png%3Falt%3Dmedia&width=768&dpr=4&quality=100&sign=63405d60&sv=1)
Application Permissions
In Authentication
, fill the details as shown below
![](https://docs.fiddler.ai/~gitbook/image?url=https%3A%2F%2F2341805124-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FNEyFKGwv2eAllsWbuafo%252Fuploads%252Fgit-blob-8fb22aeb3aa30711ce409d61cd028dd0c54b76d6%252F00e5989-Screenshot_2024-04-15_at_12.24.07_PM.png%3Falt%3Dmedia&width=768&dpr=4&quality=100&sign=953774be&sv=1)
Application Page Updates
Up until this point, our application configuration is complete. The following section now deals with Fiddler side of changes.
Configure Azure SSO with Fiddler
The following details are required to configure Azure SSO with Fiddler:
OpenID Connect metadata document
sso-azuread-identity-metadata
Application (client) ID
sso-azuread-client-id
Newly created client secret
sso-azuread-client-secret
![](https://docs.fiddler.ai/~gitbook/image?url=https%3A%2F%2F2341805124-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FNEyFKGwv2eAllsWbuafo%252Fuploads%252Fgit-blob-f85aad7125bdbc57df639c00ad886058828e573c%252F1d18e08-Azure_SSO_config_details.png%3Falt%3Dmedia&width=768&dpr=4&quality=100&sign=b6d9e9d6&sv=1)
OpenID Connect metadata Document can be found under Endpoints under the overview section.
The following details can be obtained from the OpenID Connect metadata document
URI.
Response Types Supported
sso-azuread-response-type
Response Modes Supported
sso-azuread-response-mode
Issuer
sso-azuread-issuer
Scopes Supported
sso-azuread-scope
Deployment instructions
Step 1 Create a <secret-filename>.yaml
file with the following template
📘 All the values must be base64 encoded
In mac you can run
echo -n "string to be encoded" | base64
to get the encoded value
📘 Do not use doubles quotes
Don’t use doubles quotes anywhere in values in above yaml. In above example, it is written set to “true” - the value is true and not “true”.
Step 2 Update the k8s secret in the namespace of that cluster using the above file.
Step 3 Update the Helm variable fiddler.auth.sso.provider
and fiddler.auth.sso.azuread.secretName
with azuread
and fiddler-sso-azuread-credentials
value. If you are using the helm values file, use the following settings.
📘 Once the deployments are updated, the new SSO settings will be applied.
\
Last updated