Configuring OpenID for Azure environments for use in WhatsUp Gold

Step by Step guide to setting up OpenId in Azure for Whats Up Gold external Authentication.

Mar 19, 2024
Knowledge

Title

URL Name

Configuring-OpenID-for-Azure-environments-for-use-in-WhatsUp-Gold

Article Number

000214905

Environment

Product: WhatsUp Gold Version: All Supported Versions beginning with 2021

Question/Problem Description

How do I set up OpenID for Azure, to be used with WhatsUp Gold?

Secure Token Server config
STS config

Steps to Reproduce

Clarifying Information

Error Message

Defect Number

Enhancement Number

Cause

Resolution

Configuring OpenID for Azure environments:

IMPORTANT: PLEASE LOGIN AS THE "Admin" ACCOUNT WHEN DOING THESE STEP IF YOU COME ACROSS SAVE ING ERROR.

Step 1. Create OpenID application in Azure:

In Microsoft Entra ID > Click add > app registrations. In the Register an application. Give it an appropriate Name, Select "Accounts in this organizational directory only (Single tenant). In Redirect URI (optional) select Single-page application (SPA) and in e.g. https://example.com/auth paste https://localhost/NmConsole/Content/Wug/silent-callback.html Then click Register.
Click Expose an API > Add a scope. A Application ID URI will be created for you and then click Save and continue. Scope name must be WhatsUpGold, Who can consent should be set to Admins and users. Admin consent display name, Admin consent description, User consent display name, User consent description should all have 'WhatsUpGold'. State should be set to 'Enabled' and then click 'Add scope'.
Click on Authentication and Add URI in Single-page application redirect URIs, There will always be at least 3 of them. Important you will need URI to match how your user logs into WUG. For Example:

Sign-in redirect URIs
https://localhost/NmConsole/?signin-callback
https://localhost/NmConsole/Content/Wug/silent-callback.html
https://localhost/NmConsole/?signout-callback
Front-channel logout URL will match the signout-callback, in this example it was https://localhost/NmConsole/?signout-callback. Check box Access tokens (used for implicit flows) and ID tokens (used for implicit and hybrid flows). Supported account types select 'Accounts in this organizational directory only (Progress Software Corporation only - Single tenant)' and click save.
Click on Token configuration > Add groups claim > Check box 'Groups assigned to the application (recommended for large enterprise companies to avoid exceeding the limit on the number of groups a token can emit)' and Group ID under ID, Access and SMAL and click Add. NOTE In some environments it is necessary to Add the optional claim > Access > check email. If you log on using your email address and are failing you may need to add this.
Click on API permissions > Add a permission > My APIs and select the name you chose in step 1., on the next screen check box WhatsUpGold and click 'Add permissions'
Return to Home > Microsoft Entra ID > Groups and add or the select the group you want to associate with the new application. This group should be group type security. Click on this group and go to applications > type the name of your application you registered and add it to the group.

***********************************

In the web console go to: Settings / System Settings / External Authentication / OpenID Authentication Setup

Graphical user interface, text, application, email Description automatically generated

Click Edit link in the OpenID Authentication dialog (OpenID server)

In the Edit OpenID Server Settings dialog, do the following:
1. Add Client ID and the Identity Provider URL.
2. You can find the client Id on your application's overview page.
3. The Identity Provider URL by clicking on Endpoints on the same page and copy and pasting the OpenID Connect metadata document into another tab, the "issuer" value here is the Identity Provider URL.
4. Then click auto config to bring in the Metadata endpoints.
5. The Groups Claim Key will be set to “groups” (without the quotation marks)
6. Click the Test button at the lower right of the dialog to confirm that the settings (so far) are correct.
In the OpenID Authentication Setup dialog click to add a WhatsUp Gold Group. The groupID can be found back in your Azure dialog click Groups under Manage. Select the group “WhatsUp Gold Administrators” Copy the object ID and add it to your new group in the OpenID Authentication Setup dialog and select the appropriate group in WhatsUp group, click Update. USERS in the Azure group will be able to log into WUG with the rights defined in the associated WhatsUp Gold group.
Click Save
Users in the Azure group should now be able to log into the WUG web console interface

Workaround

Notes

If you are using both OpenID and Active Directory you may have a conflict due to how WUG reads the user in the database. This can result in "Authentication Failed" error for OpenID and cause the AD account to get locked out.

To avoid this conflict, when logging into WhatsUp Gold using AD use the format domain\username but for OpenID make sure to use the full email address format of username@domain.xxx.

Also If after using this article you are still failing to login please review these settings in your Azure application:

In Authentication > make sure you have all 3 redirect URI; make sure Access tokens and ID tokens are checked.

Expose API > Edit WhatsUpGold scope, set who can consent to Admins and users. Add User consent display name to WhatsUpGold.

API permissions > click Add a permission > select your application (client) id here and find the WhatsUpGold. Select it and check box Permissions.

Keyword Phrase

Last Modified Date

12/16/2024 2:50 PM

Configuring OpenID for Azure environments for use in WhatsUp Gold

Files(0)

Was this article helpful?

Was this article helpful?

Configuring OpenID for Azure environments for use in WhatsUp Gold

Information

Related Articles