Help Please - How to use Azure EntraID Enterprise App to setup SSO with Tomcat running on an Azure VM ?

[coffeebeantraining]

Select Topic Area

Question

Body

Hello,
I am struggling with figuring out how to setup Tomcat and SSO with Azure EntraID.
Use Case:

1. I have an existing java web application that is going to run in Azure on a VM that is running Tomcat as the web container.
2. Currently, the web app uses the traditional username / password for authentication.
3. I need to change the authentication to leverage Azure EntraID SSO / SAML
4. I created an enterprise application, but it's very unclear what the next steps are and how things are supposed to work.
5. Are there any step by step documents or tutorials that anywhere can share to help me implement this feature?

[DarrenChochian]

To set up Single Sign-On (SSO) with Azure AD for your Java web application running on Tomcat, register your application in Azure AD, configure SAML authentication, integrate a SAML library like Spring Security SAML Extension into your application, update code for login/logout flows, user information retrieval, and authorization checks, and finally, test the SSO flow. Refer to Microsoft's Azure AD documentation for SSO integration and the Spring Security SAML Extension documentation for detailed guidance on configuring SAML for your Java web application.

[coffeebeantraining]

Hello and Thank You Darren.
You mention to use Spring Security SAML Extension. What if the Java application is an existing application that is not using Spring?
For example, it's a java app that was hosted in weblogic and the goal is to move it to Tomcat running in Azure.
Questions:

1. Do i still need to add some sort of SAML library to the pom.xml and/or pull it from Maven Central and drop the .jar into the Lib folder?
2. Do i need to uncomment the valve in system.xml? https://tomcat.apache.org/tomcat-10.0-doc/config/host.html#Single_Sign_On
   I assume I will need to enable the valve
3. As for the Azure Portal if I am using SAML do i still need to add Users from AD in the Users and Groups?
   
4. Which one of these options would i use if if just setting up SAML ?
   
5. If the Java webapp login authentication uses user / password which option do i choose?
   SSO:
   What values i put in Identifier ID and Reply URL?
   
   USER/PASS:
   

Thank you very much for any help. This stuff is really confusing and I appreciate your help.

[DarrenChochian]

1. Adding SAML library to pom.xml:
   If your existing Java application is not using Spring, and you want to add SAML support, you'll need to choose a SAML library suitable for your needs. You can add the necessary dependencies to your pom.xml file and let Maven fetch them from the Maven Central Repository. The exact dependencies will depend on the SAML library you choose.

2. Uncommenting the valve in server.xml:
   The Valve configuration in Tomcat's server.xml is typically used for Single Sign-On (SSO) functionality. If you're implementing SAML-based SSO, you might need to configure the appropriate Valve. However, the exact steps depend on the SAML library and configuration you choose.

3. Azure Portal and Users from AD:
   Yes, even when using SAML for authentication, you may still need to configure users and groups in the Azure portal, especially if your application relies on Azure AD for identity management. The specifics will depend on the integration details and the chosen SAML library.

4. Options for setting up SAML:
   For setting up SAML, you may want to explore Azure AD's SAML-based Single Sign-On (SSO) configuration. Azure AD can act as the identity provider (IdP), and your Java application will act as the service provider (SP). You'll typically need to configure the Azure AD application with the appropriate SAML settings.

5. Java web app login authentication using username/password:
   If your Java web application uses username/password for authentication, you can still use SAML for single sign-on. In this case, Azure AD will handle the user authentication, and your application will receive a SAML assertion containing the user's identity.

SSO: Identifier ID and Reply URL:
When setting up SSO with Azure AD, you'll typically define the Reply URL in Azure AD, which is the endpoint where Azure AD sends the SAML assertion after successful authentication. The Identifier ID is usually associated with your application and is provided during the application registration process in Azure AD.

[coffeebeantraining]

Hello and Thank You for the information.
Do you happen to know of any sample Client Java Web apps that I could reference that use SAML for SSO that uses EntraID users/groups as well as running in a Tomcat container? I am struggling with finding sample java web app code.
Thank you for any help.
Mark

[github-actions[bot]]

🕒 Discussion Activity Reminder 🕒

This Discussion has been labeled as dormant by an automated system for having no activity in the last 60 days. Please consider one the following actions:

1️⃣ Close as Out of Date: If the topic is no longer relevant, close the Discussion as out of date at the bottom of the page.

2️⃣ Provide More Information: Share additional details or context — or let the community know if you've found a solution on your own.

3️⃣ Mark a Reply as Answer: If your question has been answered by a reply, mark the most helpful reply as the solution.

Note: This dormant notification will only apply to Discussions with the Question label. To learn more, see our recent announcement.

Thank you for helping bring this Discussion to a resolution! 💬