Chapter 9. Configuring Microsoft Entra ID as an OpenID Connect provider for Trusted Profile Analyzer

Procedure

1. Create an API application registration.

   1. Go to the Azure portal and navigate to Microsoft Entra ID > App registrations > New registration.

   2. Fill out the following fields for your application registration:

      • Name : Add a descriptive name for your application registration, such as RHTPA API.
      • Supported account types : Choose the appropriate option, Single tenant or Multi-tenant, based on your requirements.
      • Redirect URI : Leave blank, as this is not required for the API.
   3. Click Register to create the application registration.
   4. After the application registration is created, make note of the Application (client) ID and Directory (tenant) ID values from the application overview page. You will need these values later.

2. Configure the application registration to expose an API.

   1. In the application registration overview page, navigate to Expose an API.
   2. Click Add next to Application ID URI, accept the default value, and click Save.

3. Define the scopes for client requests.

   1. In the Expose an API section, click Add a scope.

   2. Create a scope for creating documents using the following values:

      • Scope name : create:document
      • Who can consent? : Admins and users
      • Admin consent display name : Create documents in RHTPA
      • Admin consent description : Allows the application to create documents in RHTPA
      • User consent display name : Create documents in RHTPA
      • User consent description : Allows the application to create documents in RHTPA
      • State : Enabled
   3. Click Add scope to save the scope.

   4. Create a scope for reading documents using the following values:

      • Scope name : read:document
      • Who can consent? : Admins and users
      • Admin consent display name : Read documents in RHTPA
      • Admin consent description : Allows the application to read documents in RHTPA
      • User consent display name : Read documents in RHTPA
      • User consent description : Allows the application to read documents in RHTPA
      • State : Enabled
   5. Click Add scope to save the scope.

   6. Create a scope for updating documents using the following values:

      • Scope name : update:document
      • Who can consent? : Admins and users
      • Admin consent display name : Update documents in RHTPA
      • Admin consent description : Allows the application to update documents in RHTPA
      • User consent display name : Update documents in RHTPA
      • User consent description : Allows the application to update documents in RHTPA
      • State : Enabled
   7. Click Add scope to save the scope.

   8. Create a scope for deleting documents using the following values:

      • Scope name : delete:document
      • Who can consent? : Admins and users
      • Admin consent display name : Delete documents in RHTPA
      • Admin consent description : Allows the application to delete documents in RHTPA
      • User consent display name : Delete documents in RHTPA
      • User consent description : Allows the application to delete documents in RHTPA
      • State : Enabled
   9. Click Add scope to save the scope.

   10. Once finished, you should have the following scopes defined for your application registration:

       • api://{API_CLIENT_ID}/create:document
       • api://{API_CLIENT_ID}/read:document
       • api://{API_CLIENT_ID}/update:document
       • api://{API_CLIENT_ID}/delete:document

4. Create a client secret for service-to-service authentication.

   This is useful for making API calls from backend services or command-line tools.

   1. Click Certificates & secrets from the navigation menu.
   2. Click New client secret.
   3. Add a description, such as CLI Access.
   4. Select a expiration period appropriate for your environment.

   5. Click Add to create the client secret.

      Important

      Make sure to copy the client secret value immediately after creation, as it will not be shown again. You will need this value for authentication.

5. Configure the token version.

   1. Click Manifest from the navigation menu.

   2. Find the accessTokenAcceptedVersion property in the JSON file, and set change its value from null`to `2:

      "accessTokenAcceptedVersion": 2

      This ensures that tokens are using the v2.0 format.

   3. Click Save to save the manifest changes.

6. Add application roles with scopeMappings for admin consent.

   1. Click App roles from the navigation menu.
   2. Click Create app role.

   3. Create roles for each permission, as follows:

      • Value: App.Read.Document, Allowed member types: Applications
      • Value: App.Create.Document, Allowed member types: Applications
      • Value: App.Update.Document, Allowed member types: Applications
      • Value: App.Delete.Document, Allowed member types: Applications
   4. Click Apply to save each application role.
   5. Navigate to API permissions > Add a permission > My APIs, and select the API application registration you created earlier.
   6. Check the boxes for the App.Read.Document, App.Create.Document, App.Update.Document, and App.Delete.Document application roles, and click Add permissions to save.
   7. Click Grant admin consent to grant consent for the application roles you just added.

7. Create the front-end application registration.

   1. From the Microsoft Entra ID menu, navigate to App registrations > New registration.

   2. Fill out the following fields for your application registration:

      • Name : Add a descriptive name for your application registration, such as RHTPA UI.
      • Supported account types : Choose the appropriate option, Single tenant or Multi-tenant, based on your requirements.
      • Redirect URI > Platform : Select Single-page application (SPA).
      • Redirect URI > URI : Enter the URL where your front-end application is hosted, such as https://rhtpa.apps.example.com/.

   3. Click Register to create the application registration.

      Note

      Your Application (client) ID is also your Frontend Client ID.

8. Optional. To allow the front-end application to request tokens on behalf of the user.

   1. In the Expose an API section, click Authorized client applications.
   2. Click Add a client application.
   3. Enter the Frontend Client ID.
   4. Check all the boxes for the scopes you want to allow the front-end application to request on behalf of the user.
   5. Click Add application to save the authorized client application.

9. Configure the authentication settings.

   1. Click Authentication from the navigation menu.

   2. Check the following settings:

      • Redirect URIs : Ensure the correct redirect URIs are listed for your front-end application.
      • Implicit grant and hybrid flows : Do not check the boxes for Access tokens or ID tokens.
      • Advanced settings > Allow public client flows : Set to No.
      • Select Single-page application.
   3. Click Save to save the authentication settings changes.

10. Configure the API permissions.

    1. Click API permissions from the navigation menu.

       You can keep Microsoft Graph with User.Read permission.

    2. Click Add a permission.
    3. Click the My APIs tab.
    4. Select the RHTPA API application registration you created earlier.
    5. Click Delegated permissions.
    6. Check all the boxes for the scopes you defined earlier.
    7. Click Add permissions to save the API permissions.
    8. Optional. You can also grant admin consent for pre-approving the API permissions to avoid users having to consent individually when they log in for the first time. You can do this by clicking Grant admin consent, and then clicking Yes.

11. Configure the token version.

    1. Click Manifest from the navigation menu.

    2. Find the accessTokenAcceptedVersion property in the JSON file, and set change its value from null`to `2:

       "accessTokenAcceptedVersion": 2

       This ensures that tokens are using the v2.0 format.

    3. Click Save to save the manifest changes.

12. You now have the Tenant ID, API Client ID, Frontend Client ID, Client Secret, and Scopes values that you need to add Microsoft Entra ID as your OIDC provider in the RHTPA configuration.

    Your Issuer URL will be in the format, https://login.microsoftonline.com/TENANT_ID/v2.0, and the token endpoint will be https://login.microsoftonline.com/TENANT_ID/oauth2/v2.0/token.

13. Create a new configuration map for the scope assignments.

    1. Open a terminal on your workstation.

    2. Create a new auth.yaml file:

       $ touch auth.yaml

    3. Copy this content to the clipboard:

       authentication:
         clients:
           # Microsoft Entra ID Frontend Client (for user sign-in)
           - clientId: FRONTEND_CLIENT_ID
             issuerUrl: https://login.microsoftonline.com/TENANT_ID/v2.0
             requiredAudience: API_CLIENT_ID
       
             scopeMappings:
               "read:document":
                 - "ai"
                 - "read.sbom"
                 - "read.advisory"
                 - "read.importer"
                 - "read.metadata"
                 - "read.sbomGroup"
                 - "read.weakness"
                 - "read.systemInformation"
               "create:document":
                 - "create.sbom"
                 - "create.advisory"
                 - "create.importer"
                 - "create.metadata"
                 - "create.sbomGroup"
                 - "create.weakness"
                 - "update.sbom"
                 - "update.advisory"
                 - "update.importer"
                 - "update.metadata"
                 - "update.sbomGroup"
                 - "update.weakness"
                 - "upload.dataset"
               "update:document":
                 - "update.sbom"
                 - "update.advisory"
                 - "update.importer"
                 - "update.metadata"
                 - "update.sbomGroup"
                 - "update.weakness"
               "delete:document":
                 - "delete.sbom"
                 - "delete.advisory"
                 - "delete.importer"
                 - "delete.metadata"
                 - "delete.sbomGroup"
                 - "delete.vulnerability"
                 - "delete.weakness"
       
           # Microsoft Entra ID CLI/API Client (for client credentials)
           - clientId: API_CLIENT_ID
             issuerUrl: https://login.microsoftonline.com/TENANT_ID/v2.0
             requiredAudience: API_CLIENT_ID
       
             # Extract from 'scope', 'scp', or 'roles' claims
             scopeSelector: "$['scope','scp','roles']"
       
             scopeMappings:
               # App roles from 'roles' claim
               "App.Read.Document":
                 - "ai"
                 - "read.sbom"
                 - "read.advisory"
                 - "read.importer"
                 - "read.metadata"
                 - "read.sbomGroup"
                 - "read.weakness"
                 - "read.systemInformation"
               "App.Create.Document":
                 - "create.sbom"
                 - "create.advisory"
                 - "create.importer"
                 - "create.metadata"
                 - "create.sbomGroup"
                 - "create.weakness"
                 - "update.sbom"
                 - "update.advisory"
                 - "update.importer"
                 - "update.metadata"
                 - "update.sbomGroup"
                 - "update.weakness"
                 - "upload.dataset"
               "App.Update.Document":
                 - "update.sbom"
                 - "update.advisory"
                 - "update.importer"
                 - "update.metadata"
                 - "update.sbomGroup"
                 - "update.weakness"
               "App.Delete.Document":
                 - "delete.sbom"
                 - "delete.advisory"
                 - "delete.importer"
                 - "delete.metadata"
                 - "delete.sbomGroup"
                 - "delete.vulnerability"
                 - "delete.weakness"

    4. Open the auth.yaml file for editing.
    5. Paste the clipboard contents into the auth.yaml file, and replace the TENANT_ID, API_CLIENT_ID, and FRONTEND_CLIENT_ID placeholders with your values.
    6. Save and close the auth.yaml file
    7. Log in to the OpenShift web console.
    8. From the navigation menu, expand Workloads, click ConfigMaps.
    9. Click the Create ConfigMap button.
    10. In the Name field, set the value to server-entra-auth, and leave the Immutable checkbox unchecked.
    11. In the Key field, set the value to auth.yaml.
    12. On the Value field, click the Browse…​ button.
    13. Browse to the newly created auth.yaml file, and select it.
    14. Click the *Create button.

14. Open the values-rhtpa.yaml Helm chart file for editing.

    1. Update the oidc section with the following values:

       ...
       oidc:
         issuerUrl: https://login.microsoftonline.com/TENANT_ID/v2.0
         uiScope: "openid profile email offline_access api://API_CLIENT_ID/create:document api://API_CLIENT_ID/read:document api://API_CLIENT_ID/update:document api://API_CLIENT_ID/delete:document"
         loadUser: false
         clients:
           frontend:
             clientId: FRONTEND_CLIENT_ID
           cli:
             clientId: API_CLIENT_ID
             clientSecret: CLIENT_SECRET
       ...

       Replace the API_CLIENT_ID, FRONTEND_CLIENT_ID, and CLIENT_SECRET placeholders with your values.

       Also, under the oidc section, set the loadUser option to false.

    2. Under the authenticator section, add the new configuration map reference as follows:

       ...
       authenticator:
         configMapRef:
           name: server-entra-auth
           key: auth.yaml
       ...

    3. Save and close the values-rhtpa.yaml Helm chart file.

15. If you are configuring Microsoft Entra ID during the deployment of RHTPA, continue with the installation procedure.

    If you are configuring Microsoft Entra ID after RHTPA is deployed, you need to upgrade your RHTPA Helm release to apply the new OIDC configuration. You can do this by running the following command:

    $ helm upgrade --install redhat-trusted-profile-analyzer openshift-helm-charts/redhat-trusted-profile-analyzer -n $NAMESPACE --values values-rhtpa.yaml --values values-importers.yaml --set-string appDomain=$APP_DOMAIN_URL