How do I set up Single Sign-On (SSO) for Chef Automate deployment using SAML protocol and Azure Entra ID (formerly known as Azure AD) as Identity Provider?

The process is mainly divided in to 3 sections as below. This article only addresses the first section. For rest of the sections, please refer to: https://community.progress.com/s/article/Automate-Single-Sign-On-with-Entra-ID-Automate-configuration-Part-2

• Setup Entra ID
• Setup Automate with Entra ID as Identity Provider
• Entra ID SSO Verification process

Setup Entra ID

STEP 1 - Create Automate Enterprise Application.

a. Select Entra ID service

b. Create New Enterprise Application

c. Select Create new enterprise application

d. Select a non-gallery application

STEP 2 - Assign Users and Groups.

a. Once in the new application overview page click on the respective button to add users and groups:

b. Add the desired group to the application.

STEP 3 - Setup Single Sign-on for the Entra ID Application.

Click on button Setup single sign on and follow the next steps to complete the configuration of the 5 SSO sections.

SECTION 1 - Basic SAML configuration. 

Fill-in the following details as displayed below. then click Save.

Identifier (Entity ID): https://<automate-fqdn>/dex/callback

Reply URL: https://<automate-fqdn>/dex/callback

Leave the rest empty.

SECTION 2 - Attributes and Claims.

There is a default set of attributes and claims that will be present in the SAML assertion that needs to be modified for Automate.

Remove user.mail attribute and add emailaddress attribute as follows.

Add username attribute as follows.

Add a group claim by clicking on: Add a group claim. Ideally you can select: Groups assigned to the application or Security Groups. And as the source attribute choose: sAMAccountName or Cloud-only group display names (Group ID is also possible but will require to use group IDs within Automate too).

1. The resulting state of Attributes & Claims will be similar to the following.

SECTION 3 -  SAML Certificates.

Here you can download the Certificate Base64 encoded which will be used to configure Automate in a later section.

SECTION 4 - Set up Automate.

The values in this section will be required for setting up Automate in a later step. It will look as follows:

SECTION 5 - Test Single Sign-On.

The following browser extensions should aid with testing and troubleshooting:

My Apps Secure Sign-in

Optionally the SAML Chrome Panel

Then click Test to open a side panel with subsequent instructions. Once you hit the Test Sign In button in the side panel that just opened, you will be able to verify the flow is working and download the SAML request and response (assertion)  of the authentication flow. That allows ypu to check the actual fields and values within the SAML assertion.

Check out  the SAML response verifying that it includes all the desired claims:

For next steps, refer to: https://community.progress.com/s/article/Automate-Single-Sign-On-with-Entra-ID-Automate-configuration-Part-2