Skip Ribbon Commands
Skip to main content

Using Microsoft Azure Active Directory for SharePoint 2013 Authentication

Allow Office 365 and other federated users access to on-premise SharePoint

Brian Jones

17/12/2014


​​​Summary

The blog post explains how to use the Azure access control service to authenticate your on premise SharePoint Server 2013 users with Azure Active directory.

There are several reason why this would be a convenient solution:

  • It integrates with SharePoint 2013 in the same way as any other authentication provider (claims based)
  • Users from active directory can be synced to the Azure Active directory (using DirSync) Users from other membership systems (e.g. Windows Live ID) can also be added to the same directory, so users can use those credentials if required
  • Ad-hoc users can also be added to the directory, this is for users that don't have any existing credentials.
  • Azure Active directory can federate with other directories/membership providers so users from those organizations can use their own credentials to authenticate to SharePoint.

Pre-requisites

There are several steps that need to be completed

  1. Create a new Azure AD tenant and namespace.
  2. Add a WS-Federation identity provider.
  3. Add SharePoint as a relying party application.
  4. Create a rule group for claims-based authentication.
  5. Configure the X.509 certificate.
  6. Create a claim mapping.
  7. Configure SharePoint for the new identity provider.

Step 1: Create a new Azure AD tenant and namespace

Log on to your Azure Management Portal https://manage.windowsazure.com

Click on +New which can be found in the bottom left hand corner

Click on APP SERVICES, select ACTIVE DIRECTORY, select ACCESS CONTROL and click on QUICK CREATE

In NAMESPACE enter a name for your access control namespace, choose a REGION and click CREATE

Open the Access Control Service web page by clicking on ACTIVE DIRECTORY in the left hand menu, click on ACCESS CONTROL NAMESPACES in the top menu, select your name space and click on MANAGE at the bottom of the page.

The following web page will open https://yournamespace.accesscontrol.windows.net/v2/mgmt/web

Open PowerShell as an administrator and run the following commands:

Connect-MsolService

You will be prompted for your Azure credentials, enter them and click OK

Import-Module MSOnlineExtended -Force

This will import the required PowerShell module which you installed as part of the prerequisites.

$replyUrl = New-MsolServicePrincipalAddresses -Address "https://yournamespace.accesscontrol.windows.net/"

Replace the URL with the URL of the access control service web page you opened earlier up to the first /

New-MsolServicePrincipal -ServicePrincipalNames @("https://youradazure.accesscontrol.windows.net/") -DisplayName "Your Namespace" -Addresses $replyUrl

The final output will look like this:

DisplayName           : Your Namespace

ServicePrincipalNames : {https://yournamespace.accesscontrol.windows.net/, e7f11c00-d714-4e36-8428-f7f2e6d219ca}

ObjectId              : ee826535-0e1e-4b01-ac0a-2d62653df85a

AppPrincipalId        : e7f11c00-d714-4e36-8428-f7f2e6d219ca

TrustedForDelegation  : False

AccountEnabled        : True

Addresses             : {Microsoft.Online.Administration.RedirectUri}

KeyType               : Symmetric

KeyId                 : 76e02056-d931-4fcb-bacb-77af2dd73041

StartDate             : 11/12/2014 12:02:52

EndDate               : 11/12/2015 12:02:52

Usage                 : Verify

Step 2: Add a WS-Federation identity provider

Open the access control service web page and click Identity providers and click on Add

Select WS-Federation identity provider and click Next

In Display name enter a name for your identity provider

Under WS-Federation metadata tick URL and enter:

https://accounts.accesscontrol.windows.net/[yourazureurl]/FederationMetadata/2007-06/FederationMetadata.xml

Where [yourazureurl] is the URL of your Azure tenant. To get this log into your Azure portal and the tenant name is after https://manage.windowsazure.com/

e.g. If the URL showing when you log into Azure was https://manage.windowsazure.com/fusecollaboration.com then you would enter fusecollaboration.com as [yourazureurl]

https://accounts.accesscontrol.windows.net/fusecollaboration.com/FederationMetadata/2007-06/FederationMetadata.xml

In Log link text enter the text that you want to show in the drop down list when users select an authentication method and click Save

Step 3: Add SharePoint as a relying party application

Open the access control service web page and click on Relying party applications and click Add

Enter a Name for the relying party application

In Realm enter urn:sharepoint:spvms

In Return URL enter your SharePoint web application URL followed by /_trust/

e.g. https://mywebsite.com/_trust/

In Token format select SAML 1.1

Under Identity providers select your identity provider and click Save

Step 4: Create a rule group for claims-based authentication

Click on Rule Groups and click Add

Enter a name for the rule group and click save

In Used by the following relying party applications select the application you created earlier

Click Add, in the Identity Provider drop down select the provider you created earlier

In the Input claim type section click on Select Type, click the drop down list and select http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

In the Output claim type section click on Select Type and select http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn from the drop down list

Click on Save

Step 5: Configure the X.509 certificate

Under Development click on Application integration

Locate WS-Federation Metadata and copy the URL to the right of it and open this address in a new browser tab/window

In the XML file that is displayed locate the line <X509Certificate>

Copy the string between <X509Certificate> and </X509Certificate>

Open a new notepad file on your SharePoint server and paste the string into the file

Save the file as c:\certificates\AcsTokenSigning.cer

Step 6: Create a claim mapping

Log onto your SharePoint WFE Server with a farm administrators account and open PowerShell

Enter the following commands:

$cert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2("C:\Certificates\AcsTokenSigning.cer")

 

New-SPTrustedRootAuthority -Name "Token Signing" -Certificate $cert

$map = New-SPClaimTypeMapping -IncomingClaimType "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn" -IncomingClaimTypeDisplayName "UPN" -SameAsIncoming

 

$map2 = New-SPClaimTypeMapping -IncomingClaimType "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname" -IncomingClaimTypeDisplayName "GivenName" -SameAsIncoming

 

$map3 = New-SPClaimTypeMapping -IncomingClaimType "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname" -IncomingClaimTypeDisplayName "SurName" -SameAsIncoming

 

$realm = "urn:sharepoint:spvms"

 

$ap = New-SPTrustedIdentityTokenIssuer -Name "Provider" -Description "SharePoint secured by SAML in ACS" -realm $realm -ImportTrustCertificate $cert

 -ClaimsMappings $map,$map2,$map3 -SignInUrl "https://fuseadazure.accesscontrol.windows.net/v2/wsfederation" -IdentifierClaim "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn"

​​

Step 7: Configure SharePoint for the new identity provider

Log onto your SharePoint WFE Server with a farm administrators account and open Central Administration.

Click on Application Management and click on Manage web applications

Select your web facing web application and click on Authentication Providers

Under Zone click the name of the web facing zone i.e. default

Scroll down to the Claims Authentication Types section, select Trusted identity provider, select the provider and click OK

 

Using the Solution

Once you have completed these steps you will see a new screen when you log onto SharePoint. This screen will show a drop down list for selecting the authentication type you want to use. Your provider will show in the list.


Top Blog Posts From Fuse

 

 

Simple Incoming Email with On Premises SharePoint and Exchangehttps://www.fusecollaboration.com/blog/simple-incoming-email-with-on-premises-sharepoint-and-exchangeSimple Incoming Email with On Premises SharePoint and Exchange
Recovering Workflow History after 60 dayshttps://www.fusecollaboration.com/blog/recovering-workflow-history-after-60-daysRecovering Workflow History after 60 days
SharePoint Web Application - Empty Virtual Directoryhttps://www.fusecollaboration.com/blog/sharepoint-web-application-empty-virtual-directorySharePoint Web Application - Empty Virtual Directory
Dynamic Page Layouts in SharePoint 2013 - Part 1https://www.fusecollaboration.com/blog/dynamic-page-layouts-in-sharepoint-2013-part-1Dynamic Page Layouts in SharePoint 2013 - Part 1
Dynamic Page Layouts in SharePoint 2013 - Part 3https://www.fusecollaboration.com/blog/dynamic-page-layouts-in-sharepoint-2013-part-3Dynamic Page Layouts in SharePoint 2013 - Part 3

Recommended Pages

 

 

Privacy Policyhttps://www.fusecollaboration.com/fuse-home/privacy-policyPrivacy Policy
Skype for Businesshttps://www.fusecollaboration.com/technologies/skype-for-businessSkype for Business
Hosted Skype for Businesshttps://www.fusecollaboration.com/technologies/skype-for-business/hosted-skype-for-businessHosted Skype for Business
All Companies Deserve Great IThttps://www.fusecollaboration.com/all-companies-deserve-great-itAll Companies Deserve Great IT
About Fuse Collaboration Serviceshttps://www.fusecollaboration.com/fuse-home/aboutAbout Fuse Collaboration Services

 About us

Fuse Collaboration Services is a Cloud Solution Provider and Microsoft Gold Partner specialising in delivering SharePoint, Skype for Business, and Azure cloud-based solutions. Based in Northampton, UK.

Microsoft Gold Partner Logo showing 5 competencies

Read more

 Latest Tweets

 Latest Blog

 

 

SharePoint - The Production Hub of Every Efficient Modern Office923<p class="lead">Monty Python's quest for the holy grail took King Arthur up hill and down dale, through woods and across rivers, and past challenges a-plenty.</p><p class="lead">Every business has its own quest for as high a level of productivity as possible, and fortunately you don't have to overcome the Black Knight to reach your ultimate goal.</p><p>But it is a journey worth taking, as according to some research undertaken by Nucleus Research in 2016 nearly 5 percent of GDP in the United States was lost in productivity costs as employees searched for content within their company's systems, with a further 3.6 percent of GDP spent on re-creating content that had already been lost.</p><p>For a company that turns over £10 million per annum this is equivalent to £460,000 of needless productivity costs simply searching through archives and £360,000 of content re-creation costs.</p><p>This has been recognised by some of the world's most outstanding businesses, with 85 percent of Fortune 500 companies already using SharePoint, Microsoft's collaboration software, to underpin their continued success.</p><p>But you don't have to have turnover in the billions of pounds to reap the benefits of a relatively small investment in SharePoint.</p><p>SharePoint gives you a clear and concise entry point both into your archives and current content, and allows you to share and work on many types of documents within your working groups in real time. No waiting for one person to finish editing before you make amendments, no laborious wading through folders upon folders of content from times past, just simple and easy processes wherever you are in the world and whatever device you are using.</p><p>SharePoint is an integral part of our operations here at Fuse, which means that we know just how to make the most of its impressive capabilities. We also know that there is no such thing as an 'off the shelf' solution to any organisation, and we take the time to work with you to find out exactly what you want and how we can help you achieve it.</p><p>Proactive businesses are successful businesses, so get ahead of the curve with <a href="/_layouts/15/FIXUPREDIRECT.ASPX?WebId=4fc45909-2b6d-48b9-bcf9-a446e9d472d6&amp;TermSetId=c98895cd-d37f-4406-9cff-5480b4f829b6&amp;TermId=5abcf6c4-2a4a-45fa-af70-4468462b3732">SharePoint​​</a>.</p><hr /><div class="well"><p> <strong>Jargon busting</strong><br><em>SharePoint</em>&#58; Microsoft's collaboration software that lets your working groups share documents, information, news and apps in a secure and easily accessible place. SharePoint is available both as a stand-alone product and as part of Office 365, and is the hub of any successful modern office</p><p> <strong>How it works</strong><br>SQL databases (configuration, services and content) deliver content to web clients through both a web browser as well as tightly-integrated Office applications and the Windows operating system</p><p>The base platform provides authentication, workflow, content, search and data processing services</p><p>APIs and service end points allow the platform to be extended through development, while the interface look-and-feel can be customised through common web development tools.​</p></div>​ | Chris Wearmouth | 693A30232E777C6675736563735C632E776561726D6F757468 i:0#.w|fusecs\c.wearmouth04/04/2018 23:00:002018-04-04T23:00:00ZSharePoint reduces time spent searching for and duplicating content24/04/2018 02:36:241286htmlFalseaspx

 Contact us

Our address
12 Brookfield, Duncan Close
Moulton Park, Northampton
NN3 6WL
P: +44(0)1604 797979
Contact Us