Configure the Identity Provider Microsoft Entra ID

Configuring the identity provider (IdP) in the Enterprise Federation workflow in Omnissa Connect includes working in both the provider and Omnissa Connect consoles, and this procedure outlines using Microsoft Entra ID in the SAML (Security Assertion Markup Language) protocol with JIT (Just-in-Time) provisioning.

The Omnissa Access tenant is provisioned automatically to help with this step. Omnissa Access acts a service provider, and self-service federation provides a presentation layer to help simplify connecting your identity provider with your service provider.

General workflow

In general, whether you are configuring Microsoft Entra ID, Okta, or another identity provider, take the listed steps.

Establish trust between your identity provider and the service provider.
Configure how users and groups are identified for authentication.
Configure single sign-on (SSO).

Microsoft documentation

This topic outlines using Microsoft Entra ID as the identity provider, but if you want the latest Microsoft Entra ID documentation, see the Microsoft Entra ID documentation site.
If you want to use group attributes in Microsoft Entra ID, see the topic Configure group claims for application by using Microsoft Entra ID for the current steps to configure them.
Need help finding your Microsoft Entra tenant ID? See How to find your Microsoft Entra tenant ID.
See the full list of attributes for use in the expression builder at Reference for writing expressions for attribute mappings in Microsoft Entra ID.

Requirements

You must complete the Verify Domains step before you can access the Configure identity provider area of the Set up Enterprise Federation widget in Omnissa Connect.

Configuring SAML SSO with Microsoft Entra ID

Work in both the Omnissa Connect console and in the Microsoft Entra admin center. It is best to use two browser instances to facilitate copying and pasting values between the consoles.

Open a browser instance and go to your Omnissa Connect console.
1. Go to Set up Enterprise Federation > Configure identity provider and select Start.
2. On the Select your identity provider tab, select the listed settings and then select Next.
  - Identity Provider: Microsoft Entra ID
  - Provisioning Type: Jit-based
  - Authentication Protocol Type: SAML
Open another browser instance and log in to your Microsoft Entra admin center with admin privileges.
1. In Microsoft Entra ID, go to Identity > Applications > Enterprise Applications and select to add a new application.
2. Select to create your own application.
3. Enter a name in the What's the name of your app? text field, choose Integrate any other application you don’t find in the gallery (Non-gallery), and select Create.
4. Select the app you just created from the All Applications list and then select Assign users and groups. Follow the instructions to assign users and groups that you want to have access to Omnissa Connect through SSO.
5. In the app Overview page, select the Set up single sign on tile and then select SAML as the method.
In Microsoft Entra ID, edit the Basic SAML Configuration. This step requires you to copy values from Omnissa Connect into Microsoft Entra ID.
1. Go to the Omnissa Connect browser instance and select the Set up SAML within your identity provider step.
2. Copy the Identifier and the Reply URL strings.
3. Go back to your Microsoft Entra ID browser instance and paste the Identifier and Reply URL values you copied from Omnissa Connect to Microsoft Entra ID.
4. Ignore optional steps, save your settings, and close the Basic SAML Configuration widget, but do not close the Microsoft Entra ID browser instance. Keep the Microsoft Entra admin center browser session open because you are going to edit Attributes and Claims next.
In Omnissa Connect, move to the User attributes section that comes after the Omnissa Connect step where you were just copied the values in the Set up SAML within your identity provider step. The user attribute information is helpful to access while you edit the attributes and claims in Microsoft Entra ID.
Go to your Microsoft Entra ID instance and edit Attributes and Claims.
1. Required claim
  - For the Unique User Identifier (Name ID), the value user.userprincipalname works as long as you selected UPN (user principal name) in Omnissa Connect.
  - If you select email in Omnissa Connect, you must change the value of the Unique User Identifier to user.mail.
2. Additional claims
  - Remove Attribute Namespace values that were assigned by Entra ID.
  - Add or edit the pre-populated additional claims so that the system recognizes them.
  - These strings are case sensitive.
    - Name: email, Source Attribute: user.mail
    - Name: firstName, Source Attribute: user.givenname
    - Name: lastName, Source Attribute: user.surname
    - Name: userName, Source Attribute: user.userprincipalname
    - Name: userPrincipalName, Source Attribute: user.userprincipalname
  - Optionally, you can add the name domain and map it to the applicable domain.
Back in your Omnissa Connect console, in the User attributes step, select Next to access the Group attribute step.
1. (Optional) Set up the Group attribute section if you plan to provision group memberships.
  - Ensure that the group attributes in Omnissa Connect and in Microsoft Entra ID match.
  - Some menu options in Microsoft Entra ID include the following.
    - If you have many admins, you can use groups to assign roles rather than assigning roles one admin at a time. For example, you may have a security group with many admins in it and all these admins can have the same roles.
    - For the Which groups associated with the user should be returned in the claim? option, select the applicable group. For example, select Security groups.
    - For the Source attribute option, select Group ID.
    - For the Advanced options > Customize the name of the group claim, you can activate this checkbox.
    - For the Name option, you can enter a name that matches what was entered in Omnissa Connect. Do not enter a standard name because the system does not recognize it.
In Omnissa Connect, configure the Configure your identity provider step.
1. Enter a name in the IdP Display Name text field.
2. For the Metadata method of sharing, choose URL because Entra ID supports it.
Go to your Microsoft Entra ID instance, go to the Omnissa app you added, select Manage > Single sign-on, and copy the URL in the SAML Certificates > App Federation Metadata Url area.
Go back to your Omnissa Connect instance and complete the Configure your identity provider step.
1. Paste the copied app federation metadata URL in to the Metadata field.
  - Validation of the metadata starts automatically.
  - When validation finishes, a green check box icon indicates that the file was read and parsed successfully.
  - If the validation returns an error, check that the URL you entered is correct.
2. Select the Name ID Format.
  - The Name ID Format is the value in the SAML response to identify the authenticated user.
  - The Name ID format needs to match the nameID format you have chosen for the Required claim in Entra ID for your SAML application.
3. Select the Name ID Value.
In Omnissa Connect, in the Set user identification preference step, select how users of your enterprise are going to identify themselves when accessing Omnissa Connect from the Omnissa Connect discovery page.
- User identification is different from how the user authenticates against your enterprise identity provider.
- Follow the examples shown on the screen to choose the correct one.
- Consider that for all the options, the chosen value must end with @<DomainName.com> where domainName is the one you registered during the verification step.
In Omnissa Connect, select Configure to complete the self-service federation process.

What to do next

In this step you configured Microsoft Entra ID as the IdP, selected the SAML user and group claims, and selected the value to be used for user identification. Move on to validating and activating your setup.

Questa pagina è stata utile?