{"id":14874,"date":"2020-05-19T15:48:54","date_gmt":"2020-05-19T19:48:54","guid":{"rendered":"https:\/\/evolphin.com\/help\/?p=14874"},"modified":"2020-05-19T19:06:14","modified_gmt":"2020-05-19T23:06:14","slug":"configuring-openid-connect-oidc-integration-with-azure-ad","status":"publish","type":"post","link":"https:\/\/evolphin.com\/help\/administration-server\/security\/openid-connect\/configuring-openid-connect-oidc-integration-with-azure-ad\/","title":{"rendered":"Configuring OpenID Connect (OIDC) Integration with Azure AD"},"content":{"rendered":"\n

OpenID Connect (OIDC) is an authentication protocol built on the OAuth 2.0 standard that a Zoom user (desktop or web) can use to securely sign in. By configuring the app integration in Microsoft Azure AD endpoint’s implementation of OpenID Connect, you can add sign-in to Zoom via your AzureAD credentials, or, federated credentials if Azure AD is setup to federate with other identity platforms.<\/p>\n\n\n\n

The OpenID Connect standard uses the concept of an\u00a0ID token<\/em>, which is a security token that allows a client app to verify the identity of the user. The ID token also gets basic profile information about the user. Currently, the Zoom OIDC connector requires a custom claim to be sent to Zoom service in the ID token<\/em>. This will be covered in the configuration steps below. <\/p>\n\n\n\n

Note: If Azure AD DS is not configured, please stop here and configure it <\/a>first before proceeding further.<\/p>\n\n\n\n

Prerequisites<\/h4>\n\n\n\n
  1. Knowledge of your organization’s Azure AD setup<\/li>
  2. Administrator access to your Azure Account<\/li>
  3. Azure AD DS already configured<\/li><\/ol>\n\n\n\n

    Azure AD configuration changes using the Web UI*<\/h3>\n\n\n\n

    First you will complete the changes in Azure AD needed for OIDC to work before proceeding to Evolphin Zoom OIDC connector setup.<\/p>\n\n\n\n

    *Note: If the Web UI driven configuration doesn’t work, you may need to contact the Microsoft Azure AD support team or perform the more complex Windows PowerShell based setup documented at the end of this article.<\/p>\n\n\n\n

    Step 1: Register the Zoom service as an OIDC app<\/h4>\n\n\n\n

    Click Azure AD console > App Registrations > New Registration<\/p>\n\n\n\n

    \"\"<\/figure>\n\n\n\n

    In the form specify the Redirect URL as: https:\/\/<your-zoom-server<\/em>>:9443\/auth\/openid\/login<\/strong>. <\/p>\n\n\n\n

    Select appropriate account type for your organization.<\/p>\n\n\n\n

    \"\"<\/figure>\n\n\n\n

    Step 2: Open the App dashboard<\/h4>\n\n\n\n

    Click on the app you just registered:<\/p>\n\n\n\n

    \"\"<\/figure>\n\n\n\n
    \"\"<\/figure>\n\n\n\n

    Step 3: Update Authentication settings<\/h4>\n\n\n\n

    Click Authentication from the left navigation menu, update the Logout URL as following:<\/p>\n\n\n\n

    https:\/\/<your-zoom-server<\/em>>:9443\/auth\/openid\/logout.ping<\/strong><\/p>\n\n\n\n

    \"\"<\/figure>\n\n\n\n

    Step 4: Save a New Client Secret<\/h4>\n\n\n\n
    \"\"<\/figure>\n\n\n\n

    Please save this secret value into a file client.secret<\/em> file that will be needed when configuring the Zoom side of OIDC integration. You will need this file in the final step<\/a>.<\/p>\n\n\n\n

    Note: Please don’t setup a certificate as that will conflict with the client secret mode we support with our OIDC connector. We do not support the certificate mode for this step.<\/p>\n\n\n\n

    Step 5: Add optional upn<\/em> claim<\/h4>\n\n\n\n
    \"\"<\/figure>\n\n\n\n

    Open the Token configuration > Add optional claim dialog:<\/p>\n\n\n\n

    \"\"<\/figure>\n\n\n\n

    Choose Token Type: ID<\/em><\/strong> and select checkbox upn<\/em><\/strong>. <\/p>\n\n\n\n

    Click on the edit icon and confirm the settings are as shown below:<\/p>\n\n\n\n

    \"\"<\/figure>\n\n\n\n

    Step 6: Download, encrypt and send the manifest to Evolphin<\/h4>\n\n\n\n
    \"\"<\/figure>\n\n\n\n

    Now that the configuration via the Azure AD Web UI is finished, download the app registration manifest. Add the manifest and the client secret file you created in above step<\/a> to a ZIP file and encrypt it with a password. Send this secure password protected ZIP file to your Evolphin Cloud support contact. The password can be securely sent via a 1Password<\/em> password manager link or via an SMS to the Evolphin support contact. They will be able to use the manifest to configure the rest of the settings on the Evolphin side of the OIDC setup. <\/p>\n\n\n\n

    Note: After reviewing the manifest, if any information is missing or incorrect, the support team may ask you to iterate over the above steps.<\/p>\n\n\n\n

    Azure AD configuration changes using Windows PowerShell<\/h3>\n\n\n\n

    Additional Prerequisites<\/strong><\/p>\n\n\n\n