19.3. Configuring Microsoft Entra ID federation

Prerequisites

• You have access to the cluster and integration resources within Microsoft Azure.

Prerequisites

• You have a public OpenID Connect (OIDC) configuration bucket with the OpenShift Container Platform service account signer key.

  For more information, see "Manual mode with short-term credentials for components" in OpenShift Container Platform documentation.

• You have a Microsoft Entra ID user-assigned managed identity.
• You have access to a Microsoft Azure subscription with the permission to assign role assignments.

Procedure

• To add the federated identity credentials to a user-assigned managed identity, run the following command, for example:

  중요

  When setting up the delegated scanning, set the subject to system:serviceaccount:stackrox:sensor.

  $ az identity federated-credential create \
      --name "${FEDERATED_CREDENTIAL_NAME}" \
      --identity-name "${MANAGED_IDENTITY_NAME}" \
      --resource-group "${RESOURCE_GROUP}" \
      --issuer "${OIDC_ISSUER_URL}" \
      --subject system:serviceaccount:stackrox:central \
      --audience openshift

  where:

  --identity-name

  Specifies the identity name. The managed identity must have all the permissions for federation.

  --issuer

  Specifies the issuer. The issuer must match the service account token issuer of the OpenShift Container Platform cluster.

  For more information about how to configure short-lived tokens by using Microsoft Entra ID managed identities, see Configure a user-assigned managed identity to trust an external identity provider (Microsoft Azure documentation).