This message was deleted.
# citrix-netscalers
Slackbot
03/08/2021, 1:18 PMThis message was deleted.
m
Mads Petersen
03/08/2021, 2:27 PMHi Kari,
I've done it before, i have saved a CLI that helps me fill it out correct.
Because as you wrote the tenantID is a little strange, i've used this page to find the correct one.
https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-v2-protocols#endpoints
You should be able to find the tenant ID directly under The Azure AD overview
This one is also good: https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-auth-code-flow
add authentication OAuthAction auth_oauth_azure -authorizationEndpoint "<https://login.microsoftonline.com/TenantID/oauth2/v2.0/authorize>\?response_type=code&scope=openid%20profile&client_id=ClientID" -tokenEndpoint "<https://login.microsoftonline.com/TenantID/oauth2/v2.0/token>" -clientID ClientID -clientSecret Secret -GraphEndpoint "<https://graph.windows.net/>" -CertEndpoint "<https://login.microsoftonline.com/TenantID/discovery/v2.0/keys>" -userNameField preferred_username -issuer "<https://login.microsoftonline.com/TenantID/v2.0>"k
Kari Ruissalo (WyW)
03/09/2021, 6:35 AMHi @Mads Petersen and thanks. I'm aware of this "basic" setup where we enter the TenantID in the OAuth SP config, but if we use the "common" endpoint (see the article I linked), is that even possible to configure?
Kari Ruissalo (WyW)
03/09/2021, 7:21 AM... also, once again I'm facing the issue, where the StoreFront log throws the event Id 7
CitrixAGBasic single sign-on failed because the credentials failed verification with reason: Failed.The credentials supplied were;user: <mailto:kari.ruissalo@comping.fi|kari.ruissalo@comping.fi>domain:A CitrixAGBasic Login request has failed.<http://Citrix.DeliveryServicesClients.Authentication.AG|Citrix.DeliveryServicesClients.Authentication.AG>.AGAuthenticatorException, Citrix.DeliveryServicesClients.Authentication, Version=3.22.0.0, Culture=neutral, PublicKeyToken=nullAuthenticate encountered an exception.at <http://Citrix.DeliveryServicesClients.Authentication.AG|Citrix.DeliveryServicesClients.Authentication.AG>.AGAuthenticator.Authenticate(HttpRequestBase clientRequest, Boolean& passwordSupplied)at Citrix.Web.AuthControllers.Controllers.GatewayAuthController.Login()<http://System.Net|System.Net>.WebException, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089The remote server returned an error: (403) Forbidden.Url: <https://127.0.0.1/Citrix/CompingAuth/CitrixAGBasic/Authenticate>ExceptionStatus: ProtocolErrorResponseStatus: Forbiddenat <http://System.Net|System.Net>.HttpWebRequest.GetResponse()at Citrix.DeliveryServicesClients.Utilities.HttpHelpers.ReceiveResponse(HttpWebRequest req)at <http://Citrix.DeliveryServicesClients.Authentication.AG|Citrix.DeliveryServicesClients.Authentication.AG>.AGAuthenticator.Authenticate(HttpRequestBase clientRequest, Boolean& passwordSupplied)m
Mads Petersen
03/09/2021, 8:05 AMI haven't done it with SF behind, but looking at the error it seems the ADC passes the traffic correctly, so the oauth configuration on it is correct? Else the traffic wouldn't reach the SF.
Sorry i'm not much help here, my exposoure to oauth/openid connect have mostly being around verifying JWT for API access.
k
Kari Ruissalo (WyW)
03/09/2021, 8:08 AMok... I've done this also with a custom in-house SaaS app for one customer (ADC as Idp), but it was quite simple to setup as the openid configuration and tracing was super-simple on the SP side
Kari Ruissalo (WyW)
03/09/2021, 8:09 AMI agree that ADC passes the traffic ok, but if I log in using a different tenant user the username in StoreFront is shown as "Anynomous"
Kari Ruissalo (WyW)
03/09/2021, 8:10 AMbut allowing users to log in with their own organizations username and password would greatly help these SaaS -providers that publish applications from CVAD, they would be able to drop the password management completely and just import user lists to create the necessary shadow accounts
2 Views