Is there a way to secure a Horizon app (with RethinkDB) using Windows Authentication (SSO) with an internal Active Directory?
I would like to be able to restrict access based on the Windows/Domain user and also load the AD profile info somehow in my single page web app?
The catch: Everything needs to run on premise. So no cloud or any external providers. Just the local company Active Directory and Windows environment.
Cheers
There's no built-in way to do that right now, but you could embed Horizon into a node app and handle the authentication yourself.
Related
We installed an enterprise application through the Azure AD App Gallery. But when we try to config the Single Sign-on, it keeps saying:
The single sign-on configuration is not available for this application
in the Enterprise applications experience. HubSpot is a multi-tenant
application and the application is owned by another tenant.
Do we need to change some settings to allow the setup of Single sign-on?
We followed this tutorial but are now stuck on "Configure Azure AD SSO".
When added the hubspot application from Azure AD Enterprise application gallery like below ,you should be able to see if SSO setting is available or not and the ways it can be supported for sso.(Here i can be able to use SAML based SSO, or linked SSO)
Then you should be able to edit the saml configuration
For me when I search the hubspot app created in app registrations, its under supported account type of my organization only.
Please check if the App is registered and added as Multi-Tenant App in your case and users have to use login for particular tenant instead of common to avoid error.
Also user accounts need to be pre-provisioned into HubSpot prior to
sign-in .
Reference:
Sign in with My Apps portal and Azure AD SSO in multi tenants application - Stack Overflow
I have a windows application and a web application. Both are having a different login screen. Is there a way to implement SSO with the help of windows credential so that user don't need to login again for accessing the applications.
Note : I am new to ADFS , Domain Controller and SSO so don't have much idea on how that works.
Any leads is appreciated.
you can implement SSO for your corporate/internal/on-premises application using Windows Active Directory and Windows Authentication. A Domain Controller stores the Windows Active Directory database. ADFS will help you extend your Identity and SSO capabilities trusting 3ra party Identity providers. E.g. Azure AD. With this you will be able to access applications in both networks with a single set of credentials.
I'm working on an application that has an angular 6 front end and a .net core 2.0 back-end and am trying to set it up so that my application authenticates users via Azure active directory. The issue is that I want the .net core back-end to do all the authentication programmatically when I have the front end pass an email and password. Everything that I've seen so far online suggests to have the front end redirect to the Microsoft login page but we are using our application as a boiler plate project and want to be able to change the type of authentication easily in the back-end without having to change the angular front-end. Does anyone know how I could go about this?
You can use Resource Owner Password Credentials Grant .The process will like that you collect the user credentials in Angular app and post to .net core back end , then finish the authentication in back-end app with user's credential. But that is not recommended because The ROPC flow requires a high degree of trust and user exposure and you should only use this flow when other, more secure, flows can't be used.
Also :
The Microsoft identity platform endpoint only supports ROPC for Azure AD tenants, not personal accounts. This means that you must use a tenant-specific endpoint (https://login.microsoftonline.com/{TenantId_or_Name}) or the organizations endpoint.
Personal accounts that are invited to an Azure AD tenant can't use ROPC.
Accounts that don't have passwords can't sign in through ROPC. For this scenario, we recommend that you use a different flow for your app instead.
If users need to use multi-factor authentication (MFA) to log in to the application, they will be blocked instead.
Reference : https://learn.microsoft.com/en-us/azure/active-directory/develop/v2-oauth-ropc
I am developing a office add-in.
This office Add-In is supposed to retrieve the term store from SharePoint.
By following this tutorial:
https://learn.microsoft.com/en-us/office/dev/add-ins/develop/create-sso-office-add-ins-aspnet
I managed to get an access token to be used for Graph api. However the Graph does not expose any way of getting the term store. Is there a way we can generate an access token to be used with SharePoint and maintain the SSO?
It might be possible by registering an Azure AD v1 app but I could not find any documentation describing that.
I have a similar requirement, but in my research I wasn't able to find a good solution for this scenario.
I think it is probably possible to use a provider hosted SharePoint add-in. And then use the Authorization Code flow for obtaining an access token. Since the SharePoint add-in is trusted it will not require user login.
Of course this does mean the add-in needs to be deployed in SharePoint. If your Office add-in is distributed through the store this isn't really a great solution.
Hopefully there are other ways of achieving the same.
You could call SharePoint Online APIs (via REST or CSOM) with Azure Active Directory Apps. To call APIs secured by Azure AD, your app must acquire an access token from Azure Active Directory.
Please first refer to this document for integrating applications with Azure Active Directory. Then use Azure Active Directory Authentication Library (ADAL) to easily authenticate users to cloud or on-premises Active Directory (AD), and obtain access tokens for securing API calls.
Is it possible to execute Windows PowerShell command to register an application to ADFS using ClickOnce deployment?
I am working on a WPF rich client application. The application using REST API to authenticate and get data. The authentication will be performed by Active Directory Federation Services. As to authenticated and to get token, I have to register the client application with ADFS, can I execute PowerShell command through clickOnce setup to register application to ADFS?
You can register the client in ADFS using powershell, but that is something that is done only once in the ADFS server itself. So I don't see the benefit of including that registration through clickOnce. This document describes your scenario (WPF client + OAuth + ADFS), you can find more information there: Developing Modern Applications using OAuth and Active Directory Federation Services