Using Microsoft Azure Active Directory for SharePoint 2013 Authentication

​​​Summary

The blog post explains how to use the Azure access control service to authenticate your on premise SharePoint Server 2013 users with Azure Active directory.

There are several reason why this would be a convenient solution:

• It integrates with SharePoint 2013 in the same way as any other authentication provider (claims based)
• Users from active directory can be synced to the Azure Active directory (using DirSync) Users from other membership systems (e.g. Windows Live ID) can also be added to the same directory, so users can use those credentials if required
• Ad-hoc users can also be added to the directory, this is for users that don't have any existing credentials.
• Azure Active directory can federate with other directories/membership providers so users from those organizations can use their own credentials to authenticate to SharePoint.

Pre-requisites

• Ensure you have PowerShell 2.0 or higher installed.
• You have the Azure Rights Management Administration Tool installed http://www.microsoft.com/en-us/download/details.aspx?id=30339.
• You already have a web facing SharePoint publishing site which uses HTTPS.

There are several steps that need to be completed

1. Create a new Azure AD tenant and namespace.
2. Add a WS-Federation identity provider.
3. Add SharePoint as a relying party application.
4. Create a rule group for claims-based authentication.
5. Configure the X.509 certificate.
6. Create a claim mapping.
7. Configure SharePoint for the new identity provider.

Step 1: Create a new Azure AD tenant and namespace

Log on to your Azure Management Portal https://manage.windowsazure.com

Click on +New which can be found in the bottom left hand corner

Click on APP SERVICES, select ACTIVE DIRECTORY, select ACCESS CONTROL and click on QUICK CREATE

In NAMESPACE enter a name for your access control namespace, choose a REGION and click CREATE

Open the Access Control Service web page by clicking on ACTIVE DIRECTORY in the left hand menu, click on ACCESS CONTROL NAMESPACES in the top menu, select your name space and click on MANAGE at the bottom of the page.

The following web page will open https://yournamespace.accesscontrol.windows.net/v2/mgmt/web

Open PowerShell as an administrator and run the following commands:

Connect-MsolService

You will be prompted for your Azure credentials, enter them and click OK

Import-Module MSOnlineExtended -Force

This will import the required PowerShell module which you installed as part of the prerequisites.

$replyUrl = New-MsolServicePrincipalAddresses -Address "https://yournamespace.accesscontrol.windows.net/"

Replace the URL with the URL of the access control service web page you opened earlier up to the first /

New-MsolServicePrincipal -ServicePrincipalNames @("https://youradazure.accesscontrol.windows.net/") -DisplayName "Your Namespace" -Addresses $replyUrl ​

The final output will look like this:

​

Step 2: Add a WS-Federation identity provider

Open the access control service web page and click Identity providers and click on Add

Select WS-Federation identity provider and click Next

In Display name enter a name for your identity provider

Under WS-Federation metadata tick URL and enter:

https://accounts.accesscontrol.windows.net/[yourazureurl]/FederationMetadata/2007-06/FederationMetadata.xml

Where [yourazureurl] is the URL of your Azure tenant. To get this log into your Azure portal and the tenant name is after https://manage.windowsazure.com/

e.g. If the URL showing when you log into Azure was https://manage.windowsazure.com/fusecollaboration.com then you would enter fusecollaboration.com as [yourazureurl]

https://accounts.accesscontrol.windows.net/fusecollaboration.com/FederationMetadata/2007-06/FederationMetadata.xml

In Log link text enter the text that you want to show in the drop down list when users select an authentication method and click Save

Step 3: Add SharePoint as a relying party application

Open the access control service web page and click on Relying party applications and click Add

Enter a Name for the relying party application

In Realm enter urn:sharepoint:spvms

In Return URL enter your SharePoint web application URL followed by /_trust/

e.g. https://mywebsite.com/_trust/

In Token format select SAML 1.1

Under Identity providers select your identity provider and click Save

Step 4: Create a rule group for claims-based authentication

Click on Rule Groups and click Add

Enter a name for the rule group and click save

In Used by the following relying party applications select the application you created earlier

Click Add, in the Identity Provider drop down select the provider you created earlier

In the Input claim type section click on Select Type, click the drop down list and select http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

In the Output claim type section click on Select Type and select http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn from the drop down list

Click on Save

Step 5: Configure the X.509 certificate

Under Development click on Application integration

Locate WS-Federation Metadata and copy the URL to the right of it and open this address in a new browser tab/window

In the XML file that is displayed locate the line <X509Certificate>

Copy the string between <X509Certificate> and </X509Certificate>

Open a new notepad file on your SharePoint server and paste the string into the file

Save the file as c:\certificates\AcsTokenSigning.cer

Step 6: Create a claim mapping

Log onto your SharePoint WFE Server with a farm administrators account and open PowerShell

Enter the following commands:

​

Step 7: Configure SharePoint for the new identity provider

Log onto your SharePoint WFE Server with a farm administrators account and open Central Administration.

Click on Application Management and click on Manage web applications

Select your web facing web application and click on Authentication Providers

Under Zone click the name of the web facing zone i.e. default

Scroll down to the Claims Authentication Types section, select Trusted identity provider, select the provider and click OK

 

Using the Solution

Once you have completed these steps you will see a new screen when you log onto SharePoint. This screen will show a drop down list for selecting the authentication type you want to use. Your provider will show in the list.