Skip to main content

​
SAML AZURE SSO

Follow the sections in this guide to set up Azure SSO using SAML.
Security requirements for your production environment:
  • DELETE the admin default account shipped by OM.
  • UPDATE the Private / Public keys used for the JWT Tokens in case it is enabled.

​
Create OpenMetadata application

​
Step 1: Configure a new Application in Microsoft Entra ID

  • Login to Azure Portal as an administrator and search for Microsoft Entra ID.
EnterpriseApplications
  • Click on Enterprise Applications and then + New Application .
new-application
  • After that a new window will appear with different applications, click on Create your own application.
create-own-application
  • Give your application a name and select Integrate any other application you don't find in the gallery and then click Create.
name-application-create
  • Once you have the application created, open the app from list , and then click on Single Sign-On and then SAML.
saml-create-single-sign-On
  • Edit Basic SAML Configuration and populate the values as shown below for EntityId and Assertion Consumer Service Url. These value should match the one configured with Openmetadata Server side for samlConfiguration.sp.entityId and samlConfiguration.sp.acs respectively. After this click Save.
edit-basic-saml-configuration
  • Click on Attributes and Claims and click on the Required Claim (NameId).
edit-claims
  • You will see the values as below image, we need to set the value Source Attribute to a user mail value claim from the IDP. Click on Edit and then select the Source Attribute as user.mail or user.userprincipalname (in some cases this is also a mail) and then click Save.
edit-claim-value
  • To Confirm the claim value we can navigate to user page and check the value of the user. In my case as you can see User Princpal Name is a my mail which i want to use for Openmetadata , so for me user.userprincipalname would be correct claim.
user-claim-value
Security requirements for your production environment:
  • You must always communicate via signed Request for both request from SP to IDP and response from IDP to SP.
  • To do so we need to add SP certificate to IDP , so that IDP can validate the signed Auth Request coming from SP.
  • Generate the certificate using below command and then upload the certificate to IDP. 
openssl req -new -x509 -days 365 -nodes -sha256 -out saml.crt -keyout saml.pem
openssl x509 -in saml.crt -out samlCER.cer -outform DER
  • Under Single Sign-On you will see SAML Certificates, click on Verification Certificates.
verification-certificate
  • You can then check the Require Verification Certificates and import the certification with .cer format we generated previously.
Send the Collate team the above information to configure the server.