Azure AD SAML implementation : workflow

[sampadajoshi8]

Hi All,

Has anyone implemented SAML with AzureAD in Apigee?

I went through the azure documentation and found few points like there are 2 endpoints, the first for signin, the second for signout.

SAML is purely xml based.

I am new to apigee.any references/guidelines are appreciated.

[dchiesa1]

implemented SAML with AzureAD in Apigee?

You'll have to be more specific.

Do you want to authenticate operators and administrators? API users? Users of the developer portal? Something else? Maybe describe in a little more detail.

[sampadajoshi8]

Hi Dino,

My requirement is to implement an authentication for organization(application)users.We have angular UI and Micro-services backend

Login :

Application UI(login page that accepts user credetials) -> Apigee ->azuread (User authentication based on SAML token)

On Successful login flow be like :

UI ->apigee(authorization based on SAML token passed as header) ->able to access microservice endpoints.

Like in JWT we have /authorize & /token endpoint I am not getting exact idea on how saml can be implemented specific to this requirement.

[mayukh]

@sampadajoshi8 how did you implement it finally?

[dchiesa1 · Accepted solution]

For login, The UI can just connect directly to the login experience presented by Azure AD. I believe you want the Apigee proxy to act as the ACS. See this document. https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/configure-saml-single-sign-on

After login, The UI passes in a SAML token. I am supposing it is a token signed by Azure AD, and you have the ability to independently verify the signature on that token. This means You have the certificate, or you have the ability to trust the certificate that is passed in, within the assertion.

ValidateSAMLAssertion will let you do this.

There is no need for the Apigee proxy to connect with Azure AD to validate the token that has been issued by Azure AD. Validation can be done with the certificate alone. Apigee trusts the certificate; the assertion is signed by the certificate; if the signature is valid, then Apigee can trust the assertion.

An alternative is that in thr first step, login, if Apigee is the ACS.... Apigee can validate the sAML Assertion right then, and can issue an opaque oauth token (using password grant) and send that back to the calling system. Then the calling system can present the opaque token when requesting service. Apigee can validate that with OAhtV2/VerifyAccessToken.

----

Your first step should be setting up the Azure AD signon with Apigee as the ACS. See if you can get that to work. Then you will have the SAML assertion and you can go from there.

[mayukh]

@dchiesa1 I am in a similar situation, where we have the following:

• Web client (already authenticated with Azure AD) making an API call to a proxy on Apigee
• I need to make sure that the request coming to the proxy is an authenticated user with our Organizations Azure AD

You mentioned, that

"The UI passes in a SAML token. I am supposing it is a token signed by Azure AD, and you have the ability to independently verify the signature on that token. This means You have the certificate, or you have the ability to trust the certificate that is passed in, within the assertion."

Could you elaborate on that or at least provide some samples or steps on how I can implement it?