Skip Ribbon Commands
Skip to main content

Using Microsoft Azure Active Directory for SharePoint 2013 Authentication

Allow Office 365 and other federated users access to on-premise SharePoint

Brian Jones

17/12/2014


​​​Summary

The blog post explains how to use the Azure access control service to authenticate your on premise SharePoint Server 2013 users with Azure Active directory.

There are several reason why this would be a convenient solution:

  • It integrates with SharePoint 2013 in the same way as any other authentication provider (claims based)
  • Users from active directory can be synced to the Azure Active directory (using DirSync) Users from other membership systems (e.g. Windows Live ID) can also be added to the same directory, so users can use those credentials if required
  • Ad-hoc users can also be added to the directory, this is for users that don't have any existing credentials.
  • Azure Active directory can federate with other directories/membership providers so users from those organizations can use their own credentials to authenticate to SharePoint.

Pre-requisites

There are several steps that need to be completed

  1. Create a new Azure AD tenant and namespace.
  2. Add a WS-Federation identity provider.
  3. Add SharePoint as a relying party application.
  4. Create a rule group for claims-based authentication.
  5. Configure the X.509 certificate.
  6. Create a claim mapping.
  7. Configure SharePoint for the new identity provider.

Step 1: Create a new Azure AD tenant and namespace

Log on to your Azure Management Portal https://manage.windowsazure.com

Click on +New which can be found in the bottom left hand corner

Click on APP SERVICES, select ACTIVE DIRECTORY, select ACCESS CONTROL and click on QUICK CREATE

In NAMESPACE enter a name for your access control namespace, choose a REGION and click CREATE

Open the Access Control Service web page by clicking on ACTIVE DIRECTORY in the left hand menu, click on ACCESS CONTROL NAMESPACES in the top menu, select your name space and click on MANAGE at the bottom of the page.

The following web page will open https://yournamespace.accesscontrol.windows.net/v2/mgmt/web

Open PowerShell as an administrator and run the following commands:

Connect-MsolService

You will be prompted for your Azure credentials, enter them and click OK

Import-Module MSOnlineExtended -Force

This will import the required PowerShell module which you installed as part of the prerequisites.

$replyUrl = New-MsolServicePrincipalAddresses -Address "https://yournamespace.accesscontrol.windows.net/"

Replace the URL with the URL of the access control service web page you opened earlier up to the first /

New-MsolServicePrincipal -ServicePrincipalNames @("https://youradazure.accesscontrol.windows.net/") -DisplayName "Your Namespace" -Addresses $replyUrl

The final output will look like this:

DisplayName           : Your Namespace

ServicePrincipalNames : {https://yournamespace.accesscontrol.windows.net/, e7f11c00-d714-4e36-8428-f7f2e6d219ca}

ObjectId              : ee826535-0e1e-4b01-ac0a-2d62653df85a

AppPrincipalId        : e7f11c00-d714-4e36-8428-f7f2e6d219ca

TrustedForDelegation  : False

AccountEnabled        : True

Addresses             : {Microsoft.Online.Administration.RedirectUri}

KeyType               : Symmetric

KeyId                 : 76e02056-d931-4fcb-bacb-77af2dd73041

StartDate             : 11/12/2014 12:02:52

EndDate               : 11/12/2015 12:02:52

Usage                 : Verify

Step 2: Add a WS-Federation identity provider

Open the access control service web page and click Identity providers and click on Add

Select WS-Federation identity provider and click Next

In Display name enter a name for your identity provider

Under WS-Federation metadata tick URL and enter:

https://accounts.accesscontrol.windows.net/[yourazureurl]/FederationMetadata/2007-06/FederationMetadata.xml

Where [yourazureurl] is the URL of your Azure tenant. To get this log into your Azure portal and the tenant name is after https://manage.windowsazure.com/

e.g. If the URL showing when you log into Azure was https://manage.windowsazure.com/fusecollaboration.com then you would enter fusecollaboration.com as [yourazureurl]

https://accounts.accesscontrol.windows.net/fusecollaboration.com/FederationMetadata/2007-06/FederationMetadata.xml

In Log link text enter the text that you want to show in the drop down list when users select an authentication method and click Save

Step 3: Add SharePoint as a relying party application

Open the access control service web page and click on Relying party applications and click Add

Enter a Name for the relying party application

In Realm enter urn:sharepoint:spvms

In Return URL enter your SharePoint web application URL followed by /_trust/

e.g. https://mywebsite.com/_trust/

In Token format select SAML 1.1

Under Identity providers select your identity provider and click Save

Step 4: Create a rule group for claims-based authentication

Click on Rule Groups and click Add

Enter a name for the rule group and click save

In Used by the following relying party applications select the application you created earlier

Click Add, in the Identity Provider drop down select the provider you created earlier

In the Input claim type section click on Select Type, click the drop down list and select http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

In the Output claim type section click on Select Type and select http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn from the drop down list

Click on Save

Step 5: Configure the X.509 certificate

Under Development click on Application integration

Locate WS-Federation Metadata and copy the URL to the right of it and open this address in a new browser tab/window

In the XML file that is displayed locate the line <X509Certificate>

Copy the string between <X509Certificate> and </X509Certificate>

Open a new notepad file on your SharePoint server and paste the string into the file

Save the file as c:\certificates\AcsTokenSigning.cer

Step 6: Create a claim mapping

Log onto your SharePoint WFE Server with a farm administrators account and open PowerShell

Enter the following commands:

$cert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2("C:\Certificates\AcsTokenSigning.cer")

 

New-SPTrustedRootAuthority -Name "Token Signing" -Certificate $cert

$map = New-SPClaimTypeMapping -IncomingClaimType "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn" -IncomingClaimTypeDisplayName "UPN" -SameAsIncoming

 

$map2 = New-SPClaimTypeMapping -IncomingClaimType "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname" -IncomingClaimTypeDisplayName "GivenName" -SameAsIncoming

 

$map3 = New-SPClaimTypeMapping -IncomingClaimType "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname" -IncomingClaimTypeDisplayName "SurName" -SameAsIncoming

 

$realm = "urn:sharepoint:spvms"

 

$ap = New-SPTrustedIdentityTokenIssuer -Name "Provider" -Description "SharePoint secured by SAML in ACS" -realm $realm -ImportTrustCertificate $cert

 -ClaimsMappings $map,$map2,$map3 -SignInUrl "https://fuseadazure.accesscontrol.windows.net/v2/wsfederation" -IdentifierClaim "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn"

​​

Step 7: Configure SharePoint for the new identity provider

Log onto your SharePoint WFE Server with a farm administrators account and open Central Administration.

Click on Application Management and click on Manage web applications

Select your web facing web application and click on Authentication Providers

Under Zone click the name of the web facing zone i.e. default

Scroll down to the Claims Authentication Types section, select Trusted identity provider, select the provider and click OK

 

Using the Solution

Once you have completed these steps you will see a new screen when you log onto SharePoint. This screen will show a drop down list for selecting the authentication type you want to use. Your provider will show in the list.


Top Blog Posts From Fuse

 

 

Simple Incoming Email with On Premises SharePoint and Exchangehttps://www.fusecollaboration.com/blog/simple-incoming-email-with-on-premises-sharepoint-and-exchangeSimple Incoming Email with On Premises SharePoint and Exchange
Recovering Workflow History after 60 dayshttps://www.fusecollaboration.com/blog/recovering-workflow-history-after-60-daysRecovering Workflow History after 60 days
Using Google to Authenticate with SharePoint 2013https://www.fusecollaboration.com/blog/using-google-to-authenticate-with-sharepoint-2013Using Google to Authenticate with SharePoint 2013
Migrating SharePoint to Azurehttps://www.fusecollaboration.com/blog/migrating-sharepoint-to-azureMigrating SharePoint to Azure
SharePoint Web Application - Empty Virtual Directoryhttps://www.fusecollaboration.com/blog/sharepoint-web-application-empty-virtual-directorySharePoint Web Application - Empty Virtual Directory

Recommended Pages

 

 

Skype for Businesshttps://www.fusecollaboration.com/technologies/skype-for-businessSkype for Business
Privacy Policyhttps://www.fusecollaboration.com/fuse-home/privacy-policyPrivacy Policy
SharePoint Consulting, Design and Developmenthttps://www.fusecollaboration.com/technologies/sharepointSharePoint Consulting, Design and Development
About Fuse Collaboration Serviceshttps://www.fusecollaboration.com/fuse-home/aboutAbout Fuse Collaboration Services
Azure Active Directory Integration with SharePoint On Premisehttps://www.fusecollaboration.com/customer-stories/azure-active-directory-integration-with-sharepoint-on-premiseAzure Active Directory Integration with SharePoint On Premise

 About us

Fuse Collaboration Services is a Cloud Solution Provider and Microsoft Gold Partner specialising in delivering SharePoint, Skype for Business, and Azure cloud-based solutions. Based in Northampton, UK.

Microsoft Gold Partner Logo showing 5 competencies

Read more

 Latest Tweets

 Latest Blog

 

 

Better Mobile 4G and the Portable Office3089<p class="lead">​​<img class="img-responsive float-right" src="/ourblog/Blog%20Site%20Images/OneDrive-for-Business-App.png" alt="OneDrive for Business App" style="max-width&#58;300px;margin&#58;5px;" />Transport for London’s (TfL) plans to roll out 4G across the London Undergound network are continuing apace, with the <a href="http&#58;//www.cityam.com/287267/tfl-moves-step-closer-offering-4g-mobile-coverage-tube-2019" target="_blank">recent news</a> that this will likely include the new Elizabeth Line (aka CrossRail) and the planned C​rossRail 2 and Northern Line extension projects.</p><p>Suppliers and interested parties have had until July 6th to submit a selection questionnaire, which will then be evaluated before a more thorough tender goes out in early August.</p><p>City AM reports that companies will be competing to construct a commercial fibre optic network and the provision of a public WiFi service in specified TfL stations. The plan Is for the first stations to get connected during 2019, taking the capital one step closer to being a fully mobile working environment.​</p><p>WiFi already exists in some Tube stations, as it does on large parts of the train network across the country – even if the actual internet speeds vary widely depending on whereabouts you are!</p><p>Both TfL and the train companies will be heavily promoting the virtues of this type of connectivity for both leisure and work use, and it is popular here in the East Midlands, where we have a mixture of commuters heading into either London or Birmingham and companies who have to travel to see their clients.</p><p>But in the same way as nothing can beat the quality of a film that is already downloaded to your device, you need to make sure you have the processes and protocols in place for your mobile working to make sure you do not lose​ work unnecessarily. After all, there is nothing more frustrating than concentrating hard for an hour, only to see your work disappear because the saving process has not worked properly!</p><div class="well well-lg bg-color4 lead"><p>Here are Fuse’s top tips for your mobile working&#58;</p><ol><li>Make sure you have OneDrive syncing in place, so that when you save your document to your device it will automatically update onto your online OneDrive folder as soon as you are back online, thereby ensuring that your company work remains up-to-date<br></li><li>Do not get too reliant on having internet connectivity when you are on the move. Access to online resources may not be available for the duration of your whole journey, and even if your device is connected to the on-train WiFi the actual internet speeds will vary depending on whereabouts you are, or if you are in a tunnel<br></li><li>Have processes and checklists in place – even if they are just your own individual way of working, not official company policy – to ensure that you always download what you need onto your machine before you travel<br></li></ol></div>​ <p class="lead">Here at Fuse we believe that having the wherewithal to work effectively on the move is an integral part of the modern office. This includes OneDrive syncing being set up on all your machines, working with you to develop robust working practices for all your staff, and proactively making sure that your IT provision works to meet your needs, not the other way around.</p><div class="well well-lg"><p class="lead">Get in touch to find out how we can make sure that you have the great IT provision your organisation deserves! Call 01604 797979 or <a href="/_layouts/15/FIXUPREDIRECT.ASPX?WebId=4fc45909-2b6d-48b9-bcf9-a446e9d472d6&amp;TermSetId=c98895cd-d37f-4406-9cff-5480b4f829b6&amp;TermId=218eb0be-10f6-490a-82a7-a7fd47c8de90">send us an enquiry​​​</a></p>​ </div> | Chris Wearmouth | 693A30232E777C6675736563735C632E776561726D6F757468 i:0#.w|fusecs\c.wearmouth18/07/2018 23:00:002018-07-18T23:00:00ZAs better 4G rolls out across the nation how are you going to make your office truly mobile?As better 4G rolls out across the nation how are you going to make your office truly mobile?16/10/2018 23:15:466261htmlFalseaspx

 Contact us

Our address
12 Brookfield, Duncan Close
Moulton Park, Northampton
NN3 6WL
P: +44(0)1604 797979
Contact Us