Chapter 9. Tutorial: Configure Microsoft Entra ID as an identity provider

Procedure

1. Create the cluster’s OAuth callback URL by changing the specified variables and running the following command:

   $ domain=$(rosa describe cluster -c <cluster_name> | grep "DNS" | grep -oE '\S+.openshiftapps.com')
   echo "OAuth callback URL: https://oauth.${domain}/oauth2callback/AAD"

   The AAD directory at the end of the OAuth callback URL must match the OAuth identity provider name that you will set up later in this process.

   Note

   Remember to save this callback URL; it will be required later in the process.

2. Create the Entra ID application by logging in to the Azure portal, and select the App registrations blade. Then, select New registration to create a new application.

   

3. Name the application, for example openshift-auth.
4. Select Web from the Redirect URI dropdown and enter the value of the OAuth callback URL you retrieved in the previous step.

5. After providing the required information, click Register to create the application.

   

6. Select the Certificates & secrets sub-blade and select New client secret.

   

7. Complete the requested details and store the generated client secret value. This secret is required later in this process.

   Important

   After initial setup, you cannot see the client secret. If you did not record the client secret, you must generate a new one.

   

8. Select the Overview sub-blade and note the Application (client) ID and Directory (tenant) ID. You will need these values in a future step.

   

Procedure

1. Create the variables necessary for the identity provider configuration by running the following command:

   $ CLUSTER_NAME=example-cluster
   $ IDP_NAME=AAD
   $ APP_ID=yyyyyyyy-yyyy-yyyy-yyyy-yyyyyyyyyyyy
   $ CLIENT_SECRET=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
   $ TENANT_ID=zzzzzzzz-zzzz-zzzz-zzzz-zzzzzzzzzzzz

   where:

   example-cluster

   Replace this with the name of your cluster.

   AAD

   Replace this value with the name you used in the OAuth callback URL that you generated earlier in this process.

   yyyyyyyy-yyyy-yyyy-yyyy-yyyyyyyyyyyy

   Replace this with the Application (client) ID.

   xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx

   Replace this with the Client Secret.

   zzzzzzzz-zzzz-zzzz-zzzz-zzzzzzzzzzzz

   Replace this with the Directory (tenant) ID.

2. Configure the cluster’s OAuth provider by running the following command. If you enabled group claims, ensure that you use the --group-claims groups argument.

   • If you enabled group claims, run the following command:

     $ rosa create idp \
     --cluster ${CLUSTER_NAME} \
     --type openid \
     --name ${IDP_NAME} \
     --client-id ${APP_ID} \
     --client-secret ${CLIENT_SECRET} \
     --issuer-url https://login.microsoftonline.com/${TENANT_ID}/v2.0 \
     --email-claims email \
     --name-claims name \
     --username-claims preferred_username \
     --extra-scopes email,profile \
     --groups-claims groups

   • If you did not enable group claims, run the following command:

     $ rosa create idp \
     --cluster ${CLUSTER_NAME} \
     --type openid \
     --name ${IDP_NAME} \
     --client-id ${APP_ID} \
     --client-secret ${CLIENT_SECRET} \
     --issuer-url https://login.microsoftonline.com/${TENANT_ID}/v2.0 \
     --email-claims email \
     --name-claims name \
     --username-claims preferred_username \
     --extra-scopes email,profile

     After a few minutes, the cluster authentication Operator reconciles your changes, and you can log in to the cluster by using Entra ID.