mirror of
https://github.com/open-metadata/OpenMetadata.git
synced 2025-10-31 10:39:30 +00:00
210 lines
6.8 KiB
Markdown
210 lines
6.8 KiB
Markdown
---
|
||
title: Azure SSO
|
||
slug: /deployment/security/azure
|
||
---
|
||
|
||
# Azure SSO
|
||
|
||
Follow the sections in this guide to set up Azure SSO.
|
||
|
||
## Create Server Credentials
|
||
|
||
### Step 1: Login to Azure Active Directory
|
||
|
||
- Login to [Microsoft Azure Portal](https://azure.microsoft.com/en-in/services/active-directory/external-identities/)
|
||
- Navigate to the Azure Active Directory.
|
||
|
||
<Note>
|
||
|
||
Admin permissions are required to register the application on the Azure portal.
|
||
|
||
</Note>
|
||
|
||
### Step 2: Create a New Application
|
||
|
||
- From the Azure Active Directory, navigate to the `App Registrations` section from the left nav bar.
|
||
|
||
<Image src="/images/deployment/security/azure/create-app-1.png" alt="create-app"/>
|
||
|
||
- Click on `New Registration`. This step is for registering the OpenMetadata UI.
|
||
|
||
<Image src="/images/deployment/security/azure/create-app-2.png" alt="create-app"/>
|
||
|
||
- Provide an Application Name for registration.
|
||
- Provide a redirect URL as a `Single Page Application`.
|
||
- Click on `Register`.
|
||
|
||
<Image src="/images/deployment/security/azure/create-app-3.png" alt="create-app"/>
|
||
|
||
### Step 3: Where to Find the Credentials
|
||
|
||
- The `Client ID` and the `Tenant ID` are displayed in the Overview section of the registered application.
|
||
|
||
<Image src="/images/deployment/security/azure/where-to-find-credentials.png" alt="create-app"/>
|
||
|
||
- When passing the details for `authority`, the `Tenant ID` is added to the URL as shown in the example
|
||
below. `https://login.microsoftonline.com/TenantID`
|
||
|
||
```commandline
|
||
"authority": "https://login.microsoftonline.com/c11234b7c-b1b2-9854-0mn1-56abh3dea295"
|
||
```
|
||
|
||
## Create Service Application
|
||
|
||
### Step 1: Access Tokens and ID Tokens
|
||
|
||
- Navigate to the newly registered application.
|
||
- Click on the `Authentication` section.
|
||
- Select the checkboxes for` Access Token` and `ID Tokens`.
|
||
- Click `Save`.
|
||
|
||
<Image src="/images/deployment/security/azure/access-tokens.png" alt="access-tokens"/>
|
||
|
||
### Step 2: Expose an API
|
||
|
||
- Navigate to the section `Expose an API`.
|
||
|
||
<Image src="/images/deployment/security/azure/expose-api-1.png" alt="expose-api"/>
|
||
|
||
- Set the `App ID URI`. If it has not been set, the default value is `api://<client_id>`.
|
||
- Click Save.
|
||
|
||
<Image src="/images/deployment/security/azure/expose-api-2.png" alt="expose-api"/>
|
||
|
||
### Step 3: Add a Scope
|
||
|
||
- Click on `Add a Scope`.
|
||
- Enter the details with a custom scope name to expose.
|
||
- Once completed, click on Add Scope.
|
||
|
||
<Image src="/images/deployment/security/azure/add-scope.png" alt="add-scope"/>
|
||
|
||
### Step 4: Register Another Azure Application
|
||
|
||
Another Azure Application must be registered for Service ingestion.
|
||
-
|
||
- Provide an application name.
|
||
- Create a `public client redirect URI`.
|
||
- Click on Register.
|
||
|
||
<Image src="/images/deployment/security/azure/register-another-app.png" alt="add-app"/>
|
||
|
||
### Step 5: API Permissions
|
||
|
||
- Navigate to the Ingestion Application created in step 4.
|
||
- Navigate to the section on API Permissions.
|
||
- Click on Add a Permission.
|
||
|
||
<Image src="/images/deployment/security/azure/api-permissions-1.png" alt="api-permissions"/>
|
||
|
||
- Click on Add a Permission.
|
||
|
||
<Image src="/images/deployment/security/azure/api-permissions-2.png" alt="api-permissions"/>
|
||
|
||
- Select the custom scope created in Step 3.
|
||
- Click on Add Permissions.
|
||
|
||
<Image src="/images/deployment/security/azure/api-permissions-3.png" alt="api-permissions"/>
|
||
|
||
### Step 6: Grant Admin Consent for Default Directory
|
||
|
||
Open Metadata Ingestion authenticates and authorizes workflow connectivity with OpenMetadata API using OAuth2
|
||
Client Credentials grant. In the Client Credentials flow, there is no GUI to consent application permissions
|
||
since it’s a machine to machine communication. So OpenMetadata Ingestion Azure Application will need to be
|
||
pre-consented by Azure Active Directory to use the scope request to connect to OpenMetadata Azure Application via
|
||
the application access scope.
|
||
|
||
- Navigate to the Azure Active Directory >> Enterprise Application.
|
||
- Navigate to the ingestion application created in step 4. This is also called the Service Principal.
|
||
- Click on Permissions.
|
||
- Click on `Grant Admin Consent for Default Directory`.
|
||
|
||
<Image src="/images/deployment/security/azure/admin-consent.png" alt="admin-consent"/>
|
||
|
||
### Step 7: Set the App ID URI
|
||
|
||
- Navigate to the `Azure Active Directory >> App Registrations >> [OpenMetadata Ingestion Application] >> Expose an API`.
|
||
- Click on Set in Application ID URI
|
||
|
||
<Image src="/images/deployment/security/azure/set-app-id-1.png" alt="app-id"/>
|
||
|
||
- Click on Save to set the App ID URI which is required for scopes while connecting from manual ingestion.
|
||
|
||
<Image src="/images/deployment/security/azure/set-app-id-2.png" alt="app-id"/>
|
||
|
||
### Step 8: Create a Client Secret
|
||
|
||
- Navigate to `Certificates & Secrets` to generate the clientSecret.
|
||
- Click on New Client Secret.
|
||
|
||
<Image src="/images/deployment/security/azure/client-secret-1.png" alt="client-secret"/>
|
||
|
||
- Enter a description and an expiry period.
|
||
|
||
<Image src="/images/deployment/security/azure/client-secret-2.png" alt="client-secret"/>
|
||
|
||
- The `secret_key` is required for ingestion.
|
||
|
||
### Step 9: Note down the clientId and Authority
|
||
|
||
- `clientID`: The Application (Client) ID is displayed in the Overview section of the registered application.
|
||
- `authority`: When passing the details for authority, the Tenant ID is added to the URL as shown
|
||
below. `https://login.microsoftonline.com/TenantID`
|
||
- `clientSecret`: The clientSecret can be accessed from the Certificates & secret section of the application.
|
||
|
||
This information is required to configure Airflow.
|
||
|
||
<Image src="/images/deployment/security/azure/client-id-and-authority.png" alt="client-id-authority"/>
|
||
|
||
After the applying these steps, you can update the configuration of your deployment:
|
||
|
||
<InlineCalloutContainer>
|
||
<InlineCallout
|
||
color="violet-70"
|
||
icon="celebration"
|
||
bold="Docker Security"
|
||
href="/deployment/security/azure/docker"
|
||
>
|
||
Configure Azure SSO for your Docker Deployment.
|
||
</InlineCallout>
|
||
<InlineCallout
|
||
color="violet-70"
|
||
icon="storage"
|
||
bold="Bare Metal Security"
|
||
href="/deployment/security/azure/bare-metal"
|
||
>
|
||
Configure Azure SSO for your Bare Metal Deployment.
|
||
</InlineCallout>
|
||
<InlineCallout
|
||
color="violet-70"
|
||
icon="fit_screen"
|
||
bold="Kubernetes Security"
|
||
href="/deployment/security/azure/kubernetes"
|
||
>
|
||
Configure Azure SSO for your Kubernetes Deployment.
|
||
</InlineCallout>
|
||
</InlineCalloutContainer>
|
||
|
||
## Configure Ingestion
|
||
|
||
After everything has been set up, you will need to configure your workflows if you are running them via the
|
||
`metadata` CLI or with any custom scheduler.
|
||
|
||
When setting up the YAML config for the connector, update the `workflowConfig` as follows:
|
||
|
||
```yaml
|
||
workflowConfig:
|
||
openMetadataServerConfig:
|
||
hostPort: 'http://localhost:8585/api'
|
||
authProvider: azure
|
||
securityConfig:
|
||
clientSecret: '{your_client_secret}'
|
||
authority: '{your_authority_url}'
|
||
clientId: '{your_client_id}'
|
||
scopes:
|
||
- your_scopes
|
||
|
||
```
|
||
|
||
|