Activate Web Portal Azure OAuth authentication

6 min

Introduction

The Activate Portal can be configured to allow authentication using OAuth via Azure instead of the standard Windows authentication via IIS. When users browse to Activate they will be prompted to login to Microsoft Entra ID using their organisation credentials.

Prerequisites

Introduction - Azure connection

Note: users who wish to logon to Activate Web with this authentication method will need to have an Account/Object in Microsoft Azure/Entra.

Disable Windows Auth in IIS settings for the Site

1. On the Activate Web Server, open IIS Manager

2. Select the Web Site

3. Select Authentication

4. Disable Windows Authentication

5. Check that Anonymous Authentication is Enabled.

Register the Activate and Record Identifiers

Create a new Azure Application for the connection. This must be a seperate Application from the main Activate Azure Application because it has different settings and requirements to allow users to authenticate.

The following steps show you how to register your app in the Microsoft Entra admin center:

On the sidebar menu select Applications, then select App Registrations.

Select + New registration.

In the Register an application page that appears;

Enter a meaningful application Name that is displayed to users of the app, for example Activate-Client-App.

Under Supported account types, select Accounts in this organizational directory only.

Select Register.

The application's Overview pane displays upon successful registration. Record the Application (client) ID to be used in your application source code.

Add a Platform Redirect URL

To specify your app type to your app registration, follow these steps:

Under Manage, select Authentication.

On the Platform configurations page, select Add a platform, and then select the SPA option.

For the Redirect URIs enter your redirect URL. Test - https://localhost:3000/ or Production - https://yourcompany.com

Select Configure to save your changes.

On the Platform configurations page, in the new Single-page application that has appeared, select Add URI, then enter https://localhost:3000/ or https://yourcompany.com

Select Save to save your changes, and ensure that both URIs are listed.

Users will need to individually consent unless the following is done.

1. Click on API Permissions

2. Grant Admin content for [Application Name]

3. Click Ok

Change Activate Configuration to use OAuth

1. Open Activate Studio that manages the site you wish to configure.

2. Navigate to //Resources/Configuration/Web

3. Open parameter Web.Config

4. The standard configuration is this

<authSchemes>Windows,Anywhere</authSchemes>

Change this to

<authSchemes>Azure</authSchemes>

5. Update the the following information to match the application and redirect URI from above.

<azure> <applicationID>[APPLICATION ID]</applicationID> <tenantID>=//Resources/ActiveDirectory/External Directories/Azure/TenantID</tenantID> <tenantName>=//Resources/ActiveDirectory/External Directories/Azure/TenantName</tenantName> <redirectURI>https://localhost</redirectURI> <postLogoutRedirectUri>/</postLogoutRedirectUri> </azure>

6. Restart the Activate App Pool and when you connect you will either get signed in automatically if Windows integrated Azure is working, or redirected to the Azure login screen to login.

Troubleshooting

Sometimes the serverPrincipalName hasn't been registered against the Active directory server computer object. After logging in with Azure/Entra OAuth and after being redirected the user is challenged for Windows Authentication.