Azure Active Directory Integration

Azure Active Directory Integration

TigerTrust integrates with Azure Active Directory (Microsoft Entra ID) for comprehensive enterprise identity management.

Application Registration

Register TigerTrust in Azure AD:

text
11. Navigate to Azure Portal > Azure Active Directory > App registrations
22. Click "New registration"
33. Name: TigerTrust
44. Redirect URI: https://api.tigertrust.io/auth/callback
55. Configure permissions and certificates

SAML SSO Configuration

Configure SAML 2.0 SSO:

xml
1<!-- SAML Configuration -->
2<EntityDescriptor entityID="https://tigertrust.io/saml/metadata">
3  <SPSSODescriptor>
4    <AssertionConsumerService
5      Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
6      Location="https://api.tigertrust.io/auth/saml/callback"/>
7  </SPSSODescriptor>
8</EntityDescriptor>

OIDC Configuration

Alternative OIDC setup:

yaml
1oidc:
2  authority: https://login.microsoftonline.com/{tenant-id}/v2.0
3  client_id: your-client-id
4  client_secret: $AZURE_CLIENT_SECRET
5  scopes:
6    - openid
7    - profile
8    - email
9    - User.Read

Conditional Access

Configure conditional access for TigerTrust:

text
1Policy: Require MFA for Certificate Operations
2---
3Assignments:
4  - Users: All users
5  - Cloud apps: TigerTrust
6  - Conditions:
7    - Device platforms: All
8    - Client apps: Browser, Mobile apps
9
10Access controls:
11  - Grant: Require multi-factor authentication
12  - Session: Sign-in frequency = 1 hour

SCIM Provisioning

Enable automatic user provisioning:

yaml
1scim:
2  endpoint: https://api.tigertrust.io/scim/v2
3  token: $SCIM_TOKEN
4
5  mapping:
6    users:
7      userName: userPrincipalName
8      displayName: displayName
9      emails: mail
10      active: accountEnabled
11
12    groups:
13      displayName: displayName
14      members: members

Group-Based Roles

Map Azure AD groups to TigerTrust roles:

App Roles

Define app roles in Azure AD:

json
1{
2  "appRoles": [
3    {
4      "displayName": "Certificate Administrator",
5      "value": "CertAdmin",
6      "description": "Full certificate management access"
7    },
8    {
9      "displayName": "Certificate Operator",
10      "value": "CertOperator",
11      "description": "Certificate operations access"
12    }
13  ]
14}

MFA Enforcement

Require MFA for sensitive operations:

• Certificate revocation
• Private key export
• Policy modifications
• User role changes

Secure your certificate management with Azure AD and TigerTrust.