Magento Azure AD (Microsoft Entra ID) Single Sign-On (SSO) | SSO into Magento using Azure AD Credentials

Overview

Integration of Azure AD (Microsoft Entra ID) Login (Azure Active Directory OAuth Single Sign-On) with Magento using OAuth 2.0 Protocol. The Magento OAuth / OpenID Connect Single Sign-On (SSO) extension allows the users to log in to the Magento store using the Azure AD Credentials (Azure AD Single Sign on). Magento 2 SSO using Azure AD as OAuth Provider. Advanced Single Sign-On features such as user profile Attribute Mapping, Role Mapping, and so on are supported. In this guide, we'll go over how to set up SSO between Magento and Azure AD. At the end of this article, users should be able to login with Azure AD in Magento.

The Magento Azure AD Single Sign-On (SSO) extension by miniOrange allows you to connect your Magento store with Microsoft Azure Active Directory for seamless and secure user authentication. Users can log in using their existing Azure AD credentials, eliminating the need for separate usernames or passwords. The Magento Azure AD SSO extension is ideal for enterprises that use Azure AD to manage employees, partners, or customers across multiple platforms. The extension also fully supports multi-store and multi-site Magento environments, making it scalable for global businesses. With quick setup and enterprise-grade support, the Magento Azure AD SSO solution ensures a smooth and centralized login experience.

Click here to read more about the Magento OAuth Single Sign-On (OAuth & OpenID Connect Client) extensions extra features.

Installation Steps

• Using Composer
• Manual Installation

• Purchase the miniOrange Magento OAuth Single Sign-On (SSO) extension from Magento Marketplace (Adobe Commerce Marketplace).
• Go to My profile -> My Purchases
• Please ensure you are using correct access keys (My Profile - Access Keys)
• Paste the access keys in your auth.json file inside your project
• Use the below command to add the extension to your project.

  "composer require {module_name}:{version}"

• You can see the module name and list of versions in the selector below the extension module name.
• Run the following commands on command prompt to enable the extension.

php bin/magento setup:upgrade

• Download the miniOrange Magento OAuth Single Sign-On (SSO) extension.
• Unzip all contents of the zip inside the MiniOrange/IDPSaml directory.

{Root Directory of Magento} app code MiniOrange OAuth

• Run the following commands on command prompt to enable the extension

php bin/magento setup:upgrade

Configuration Steps

1. Configure miniOrange SSO Extension

• In the miniOrange Magento SSO extension, navigate to the Application tab, select OAuth/Openid, and click on Azure AD application.

• Copy the Callback URL from the extension. You’ll need this for Azure AD (Entra ID) configuration.

2. Setup Microsoft Entra ID (Azure AD) as OAuth Provider for Magento Azure AD SSO Login

• Sign in to Microsoft Entra ID (Azure AD) portal.
• Select Microsoft Entra ID (Azure AD).

• In the left-hand navigation panel, click the App registrations service, and click New registration.

• Configure the following options to create a new application.

• Enter a name for your application under the Name text field.
• In supported account types, select 3rd option ‘Accounts in any organizational directory (for authenticating user with user flows).
• Click on the Register button to create your application in Azure AD (Entra ID).

• Microsoft Entra ID (Azure AD) assigns a unique Application ID to your application. The Application ID is your Client ID and the Directory ID is your Tenant ID, keep these values handy as you will need them to configure the miniOrange Magento SSO OAuth Client extension.

• Go to Certificates and Secrets from the left navigaton panel and click on New Client Secret in Azure AD. Enter description and expiration time and click on ADD option.

• Copy the secret key "value" from Azure AD and keep the value handy it will be required later to configure Client Secret under the miniOrange Magento SSO OAuth Client extension.

In conclusion , by successfully configuring Azure AD as OAuth Provider, you have enabled Magento Azure AD SSO Login and authorization for your end users into Magento.

3. Setup Magento as OAuth Client

• Now, Enter the OAuth Provider Name, Client ID, Client Secret, Scope and provided endpoints.
• Please refer the Endpoints table provided below to authorize Single Sign-On (SSO) with Azure AD single-tenant environment to your Magento site.

Scope:	openid
Authorize Endpoint:	https://login.microsoftonline.com/<tenant-id>/oauth2/v2.0/authorize
Access Token Endpoint:	https://login.microsoftonline.com/<tenant-id>/oauth2/v2.0/token
Get User Info Endpoint:	https://login.windows.net/<tenant-id>/openid/userinfo
Custom redirect URL after logout:[optional]	https://login.microsoftonline.com/<tenant-id>/oauth2/logout?post_logout_redirect_uri=<your URL>

• Please refer the Scope and endpoints table provided below to authorize Single Sign-On (SSO) with any Azure AD tenant environment to your Magento site.

Scope:	openid
Authorize Endpoint:	https://login.microsoftonline.com/common/oauth2/v2.0/authorize
Access Token Endpoint:	https://login.microsoftonline.com/common/oauth2/v2.0/token
Get User Info Endpoint:	https://login.windows.net/common/openid/userinfo
Custom redirect URL after logout:[optional]	https://login.microsoftonline.com/common/oauth2/logout?post_logout_redirect_uri=<your URL>

• Click on the Save button to save the settings.
• Click on the Test Configuration button.

• You will see all the values returned by your OAuth Provider (Azure AD) to Magento in a table. If you don't see value for First Name, Last Name, Email or Username, make the required settings in your OAuth Provider to return this information.

4. Multisite Settings (*Available in the Enterprise versions)

• Find your Azure AD application and click Edit in the Actions menu.

• Click on Store Configuration from the left-hand menu.
• In the Store Configuration, select the website where you want to activate SSO, and check the Enable SSO for this site option.

 Login Settings

• Show SSO Button on Login Page: Displays the SSO button on the selected website’s customer login page.
• Auto-create Users: You have the option to automatically create customer users during the SSO process if they do not already exist. Enabling the corresponding checkbox activates this feature.
• Auto Redirect Feature: Automatically redirects users to the OAuth Provider login page, either from the Magento login page or from any page on the website.

• Go to customer login page and you will see the SSO button on your frontend. Click on the button and test the SSO.

• You will be sucessfully logged in into Magento.

5. Admin SSO

• Enable SSO for Admins: Displays the SSO button on the Admin login Page.
• Admin SSO Button Text: Sets the label displayed on the SSO button on the admin login page (e.g., Login via Azure AD).
• Auto-create Admin Users: Automatically creates admin user in Magento when they log in via SSO for the first time.
• Auto-Redirect from Admin: Automatically redirects admin users to the OAuth Provider login page from the admin login page.
• Backdoor URL: A backdoor URL allows you to log in to your Admin dashboard using default Admin credentials in case you get locked out.

• Visit your admin login page and you will see the SSO button on your admin page. Click on the button to initate SSO as an admin.

• After sucessfully logged into magento as admin you will be redirect to magento backend dashboard.

6. Headless SSO Settings (*Available in the premium versions)

• Enable for Customers: This option allows you to activate Headless SSO for customers.
• Customer SSO URL: This URL is used to initiate customer SSO from headless applications. Append this SSO URL within your headless application.
  • Example Format:
    https://<your-magento-domain>/mosso/actions/SendSSORequest?relayState={Store_URL}/headless_store_url/{Headless_URL}&app_name=Azure AD
  • {Store_URL}: Enter your Magento store URL.
  • {Headless_URL}: Enter the URL of your headless application where the customer token should be sent.
  • After successful SSO, a customer token is sent to the headless URL.
    For example: {Headless_URL}?customer_token=...
• OAuth Token:Enable this option to send the OAuth provider’s (Azure AD) JWT token along with the customer token.
• Customer Token Expiry: You can set the expiration time (in minutes) for the customer token.
• Whitelist Frontend URLs: Here, you can add URLs that are allowed to receive the customer token. The customer token will only be sent to the URL(s) that are whitelisted here.

• Enable for Admins: Similar to customers, this option activates Headless SSO for admins.
• Admin SSO URL: This URL initiates admin SSO from headless applications.
• Admin Token Expiry: Set the expiration time (in minutes) for the admin token.
• Whitelist Frontend URLs: Admin tokens are only sent to the whitelisted URLs here. You must ensure that any URL receiving an admin token is listed.

7. Attribute / Custom Mapping(Optional). *This is Premium feature.

 Customer Attribute Mapping

• Go to the Attribute Mapping section to configure Customer Attribute Mapping.
• Enable Customer Attribute Mapping and select checkbox the option to Update Customer Attributes.

• You will see fields like Email, First Name, and Last Name under Customer Attributes Mapping.
• Map these fields by selecting the appropriate options from the dropdown.
• If you need to add more attributes, click the + Add Customer Attributes button and select the appropriate attribute from the dropdown.

 Customer Address Mapping

• In the Customer Attribute section, enable Address Attribute Mapping and select the checkbox to update Customer Address attributes.

• You will see fields such as Street Address, Zip Code, City, State, and others under Customer Address Mapping.
• Map these fields by selecting the appropriate options from the dropdown.
• If you need to add additional address attributes, click the + Add Address Attributes button and choose the appropriate attribute from the dropdown.

 Admin Attribute Mapping

• In the Admin Attribute Mapping section, enable Admin Attribute Mapping and select the checkbox to update Admin attribute.

• You will see fields like Email, Username First Name, and Last Name under Admin Attributes Mapping.
• Map these fields by selecting the appropriate options from the dropdown.
• If you need to add more attributes, click the + Add Admin Attributes button and select the appropriate attribute from the dropdown.

8. Group/Role Mapping (Optional). *This is Premium feature.

 Customer Group Mapping

• Magento uses a concept of Roles, designed to give the site owner the ability to control what users can and cannot do within the site. Role mapping helps you to assign specific roles to users of a certain group in your OAuth Provider.
• While auto registering, the users are assigned roles based on the group they are mapped to.
• You can specify a default role in the POC extension that will be allocated to all non-admin users when they conduct SSO.
• Select the Default Role which you want to assign to all the non-admin users and click on the Save button.

 Admin Role Mapping

• You also have the ability to Update the Backend Roles on SSO in the premium extension.
• You can also specify a default role that will be allocated to all admin users when they conduct SSO in the premium extension.
• Select the Default Role which you want to assign to all the admin users and click on the Save button.

Additional Resources

• Magento Security Solutions
• What is Single Sign-On (SSO) Login?
• Azure AD SSO | Azure Single Sign-On (SSO) Login
• Azure AD - Overview
• Configure Azure AD as Identity Provider (IdP) for SSO Login
• Magento OAuth Single Sign On (SSO) Plugin.

Get in Touch

Please reach out to us at magentosupport@xecurify.com, and our team will assist you with setting up the Magento 2 SSO (OAuth/OIDC) Extension. Our team will help you to select the best suitable solution/plan as per your requirement.