External Authentication

  1. After SCIM configuration you can configure your external authentication setup. By enabling external authentication, you’ll empower your users to experience the convenience of one-click sign-ins, enhancing their access to your hybrid application’s features. KloudHybrid offers robust support for major SSO providers such as OKTA and Microsoft, along with comprehensive compatibility with OpenID Connect and SAML v2.0 protocols.

  2. To find the External Authentication page, navigate to the Advanced Settings Page, then go to Configuration -> Integrations -> External Authentication.

Mentor Meeting

Table of content

Subsections of External Authentication

Configure Open ID connect with OKTA

  1. Following the steps below to set up Okta and OpenID connect.
  2. Check OKTA for the Provider option and for the Protocol click on OpenID Connect.
Mentor Meeting
  1. Log in to your OKTA account.
Mentor Meeting
  1. Click on Applications and from the drop-down select Applications.
Mentor Meeting
  1. Click on Create App Integration.
Mentor Meeting
  1. As shown in the figure below, Check OIDC- OpenID Connect as the Sign-in Method and Web Application as the Application type and click on Next.
Mentor Meeting

  1. On the next page perform the following steps:

    • Enter an App Name in the App Integration Name section.
Mentor Meeting 
- Copy the Sign-in redirect URLs from OKTA, and paste that URL into the Redirect URL field in KloudHybrid.
Mentor Meeting 
- Assignments: Scroll down the page to Assignments and click on Limited access to selected groups from the Controlled Access options.

-  Selected group(s): Enter the name of the group to grant Admin access to the application created.

-  Click on Save to save the configurations.
Mentor Meeting

  1. Once the Application is created successfully, the following window appears. It has detailed information for the Application.

    **a. General:**

    - Client Credentials: Copy the Client Id and Client Secret information and enter the same information in Insights as shown in the figure below. Also, enter the name for ROLE ADMIN as shown in the figure below.

    NOTE: This ROLE ADMIN name is the group of users in the Okta portal, which will be assigned the ADMIN role once logged into the Hybrid App.

Mentor Meeting Mentor Meeting

    - General Settings: Enter the same Okta domain name in the Okta domain section on the “External Authentication” page in Insights as shown in the figure above.

Mentor Meeting Mentor Meeting

    - User Consent: The Require Consent option is checked by default, deselect if you don’t wish to require user consent to data sharing with the KloudHybrid application.

b. Sign-on: Click on Sign-on

Mentor Meeting 
    - OpenID Connect ID Token: Scroll down and click on Edit.
Mentor Meeting 
    - In the Groups claim filter section, select the Start with option. Then type the prefix of the group to be added (Eg.Ks-). Click on Save.
Mentor Meeting

  1. Finally. Open KloudManage. In the role mapping section, add the same name as in the OKTA group (Eg. Ks-admin). Additionally, you can set the following settings in the “Role Mapping” section.

    • Default Role: This is the role/permission set that SSO users will be assigned to by default the first time they login (unless other role mappings apply). The default system configuration for this is ROLE_USER, which will give all SSO users user permissions by default.
    • ROLE_MANAGER: If you have configured a specific group in OKTA that you would like to assign manager permissions, set this field. See the User & Permission Management section for additional details
    • ROLE_ADMIN: If you have configured a specific group in OKTA that you would like to assign admin permissions, set this field. See the User & Permission Management section for additional details.
    • ROLE_USER: If you have configured a specific group in OKTA that you would like to assign user permissions, set this field. See the User & Permission Management section for additional details.
    • ROLE_CUSTOM: If you have configured a specific group in OKTA that you would like to assign a custom role, set this field. See the User & Permission Management section for additional details.
    • ROLE_XXXX: If you have configured a specific group in OKTA that you would like to assign a specific role, set this fields. See the User & Permission Management section for additional details. XXXX represents the role name to be added.
Mentor Meeting
  1. Click on save. This allows you to login into KloudHybrid with OKTA OpenID Connect with a single click.
Mentor Meeting

Configure SAML with OKTA

  1. Check OKTA from the Provider option and for the Protocol select SAML V2.0 as shown in the figure below.
image
  1. Log in to your OKTA account.
image
  1. Click on Applications and from the drop-down select Applications.
image
  1. Click on Applications and select Browse App Catalog.
image

  1. Search for KloudHybrid in the Browse app integration catalog window that opens.

  2. Select the KloudHybrid option with SAML, provisioning.

image
  1. The KloudHybrid window will open. Then click on Add.
image
  1. In the Add KloudHybrid window, type the Application label (Eg. KloudHybrid) under General Settings. Also, copy and paste the Base URL from the KloudHybrid application. This will look something like “https://xxxx.yyyy.kloudspot.com”.

image image

  1. Click on Done in OKTA.

  2. In the next window, click on the Assign button at the bottom of the Assignments tab. Select Assign to groups from the drop-down menu that appears.

image

  1. A popup window will open. From there, assign the groups that will have access to the KloudHybrid Application.

  2. Click on Done.

image
  1. Then select the sign-on tab. In it, scroll down and click on the View Setup Instructions button.

image image

  1. Then a new tab will open. You will be able to complete the configuration by following the instructions given in it.
image
  1. Copy the Identity Provider single sign-on-URL, Identity provider Issuer and X.509 verification certificate and paste them into KloudHybrid, respectively.
image
  1. Click on the Edit button in the sign-on tab to configure SAML 2.0.
image

  1. In the Groups drop-down menu, select the Start with option. Then type the prefix of the group to be added (Eg.Ks-)

  2. Click on Save.

image

  1. To map permissions, see step #9 in the Configure Open ID connect with OKTA section.

  2. Click on save. image

  3. This allows you to login into KloudHybrid with OKTA SAML with a single click.

image

Configure Open-ID connect with Microsoft Azure AD

Following the steps below to set up Open-ID connect with Microsoft Azure AD

  1. Check Microsoft from the Provider option and for the Protocol select OpenID Connect as shown in the figure below.
Mentor Meeting

  1. Log in to your Microsoft Azure portal on https://portal.azure.com/

  2. Click on Azure Activity Directory from the Azure services options as shown below.

Mentor Meeting
  1. Locate and click on the App registrations on the Window.
Mentor Meeting
  1. Click on New registration on the page.
Mentor Meeting

  1. Enter the information in the blanks to create a new registration.

    • Name: enter a name for the application.
    • Supported account types: Select, Accounts in this organizational directory only
    Mentor Meeting
    • Redirect URL (optional): Choose Web copy the Redirect URL from the Properties to cut/paste to Identity Provider section in Hybrid. Paste this URL into the Redirect URL in Azure.
    Mentor Meeting

  2. Go back to the home page and click on Overview for login information on the new application created. Pick information from the Essentials section as mentioned in the figure below and place that information in KloudHybrid.

Mentor Meeting

  1. Assigning IDs in Insights

    • The Tenant ID and Client Id in KloudHybrid will be the same as that on the Azure portal (map Application (Client) ID and Directory (tenant) ID in Azure to Client ID and Tenant ID in KloudHybrid, respectively). Click on Save to save the configuration.
    Mentor Meeting
    • To create a Client Secret, go to Azure portal, click on Certificates & secrets and then click on + New client secret. Click on Add.
    Mentor Meeting
    • Copy the Client secret and paste it in the Client secret section in External Authentication in KloudHybrid.
    Mentor Meeting

  2. Token Configuration: Click on Token configuration, click on +Add groups claim and Select Security groups. Click on Add.

Mentor Meeting
  1. Copy the Object ID and paste it in the ADMIN ROLE KloudHybrid Role Mapping section as shown in the figure below. The Object ID for the group of Users specified in KloudHybrid will have an ADMIN Role assigned to them when logged in Hybrid App.

Mentor Meeting Mentor Meeting

  1. Logout of the KloudHybrid portal. This allows you to log in with a single click, as shown in the figure below.
Mentor Meeting

Configure SAML with Microsoft Azure AD

  1. Check Microsoft from the Provider option and for the Protocol select SAML V2.0 as shown in the figure below.
Mentor Meeting

  1. Log in to your Microsoft Azure portal on https://portal.azure.com/

  2. Click on Azure Activity Directory from the Azure services options as shown below.

Mentor Meeting
  1. Locate and click on the Enterprise Applications on the Window.
Mentor Meeting
  1. Click on +New Application.
Mentor Meeting
  1. Click on Create your own application and enter a name for the new application. Click on Create.
Mentor Meeting
  1. On successfully creating the application, in this case KH-Demo, the following page is displayed. Click on Assign users and groups to provide specific users access to the application.
Mentor Meeting
  1. Click on Users and groups and select Users or groups from the list and click on Select as shown in the figure below.
Mentor Meeting
  1. On selecting the users and groups, click on Assign.
Mentor Meeting
  1. Refresh the page and the newly created application i.e KH-Demo will be added to the list of All applications.
Mentor Meeting

  1. Click on the newly created application (in this case KH-Demo), hover over Set up single sign on and click on Get started. Mentor Meeting

  2. Click on SAML to set up a single sign on.

Mentor Meeting 
a. Basic SAML Configuration: Click on Edit from the Basic SAML Configuration section and fill in the information on the following page.
Mentor Meeting 
- Fill in the details to configure SAML as explained below and click on Save. Once it’s saved click ‘X’ on the top right corner of the page to close.
Mentor Meeting 
- The information such as Identifier (Entity ID), Reply URL, Sign-On URL is the same as it’s available in the KloudHybrid portal as shown in the figure below.
Mentor Meeting 
b. User Attributes and claims: Click on edit.
Mentor Meeting 
- As shown in the figure below, click on + Add a group claim and select Groups assigned to the application, click on Save and close the window by clicking on ‘X’ on the top right.
Mentor Meeting 
c. SAML Signing certificate: Click on Download the ‘Certificate (Base64)’.
Mentor Meeting 
- Upload the downloaded certificate in Insights as shown in the figure below.
Mentor Meeting 
d. Set up KH-Demo (the application name):
Mentor Meeting 
- From this section, copy the URLs for Login URL and Azure AD Identifier and paste it in Insights as shown in the figure below.
Mentor Meeting
  1. Click on Users and groups to assign Admin role in Hybrid Application. Select a group of users from the list.
Mentor Meeting

  1. Copy the Object ID and paste it in the ADMIN ROLE hybrid Role Mapping section as shown in the figure below. The Object ID for Group of Users specified in hybrid will have an ADMIN Role assigned to them when logged in Hybrid App. Mentor Meeting Mentor Meeting

  2. After filling in all the details, click on Save on the top right to save the configurations. And log out of KloudHybrid.

Mentor Meeting
  1. Login with a single click on Sign in with Microsoft SAML (SAML) as shown in the figure below.
Mentor Meeting