Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Original file line number Diff line number Diff line change
Expand Up @@ -4,11 +4,11 @@ Asgardeo is an identity-as-a-service (IDaaS) solution designed to create seamles

## Prerequisites

Before you proceed, be sure to complete the following:
Before you proceed, make sure to complete the following prerequisites:

- Create an Asgardeo application. You can follow the Asgardeo guide to [register a standard-based application](https://wso2.com/asgardeo/docs/guides/applications/register-standard-based-app/#register-an-application).

- Find the well-known URL:
- Find the Well-Known URL:
Go to the **info** tab of the Asgardeo application to view the endpoints and copy the **Discovery** endpoint.

- Find the Client ID:
Expand Down
Original file line number Diff line number Diff line change
@@ -1,12 +1,12 @@
# Configure Azure Active Directory (Azure AD) as an External Identity Provider (IdP)

In organizations leveraging Microsoft Azure Active Directory (Azure AD) for identity and access management (IAM), integrating it with {{ product_name }} offers powerful API access control. This control hinges on the use of API scopes. That is, it enables the restriction of access to a designated group of users. This document guide you step-by-step to configure Azure AD as your external IdP.
In organizations leveraging Microsoft Azure Active Directory (Azure AD) for identity and access management (IAM), integrating it with {{ product_name }} offers powerful API access control. This control hinges on the use of API scopes. That is, it enables the restriction of access to a designated group of users. This document guides you through the steps to configure Azure AD as your external IdP.

## Prerequisites

Before you try out this guide, be sure you have the following:

- An Azure Active Directory account: If you don’t already have one, setup an Azure Active Directory account at [https://azure.microsoft.com/en-gb/](https://azure.microsoft.com/en-gb/).
- An Azure Active Directory account: If you don’t already have one, set up an Azure Active Directory account at [https://azure.microsoft.com/en-gb/](https://azure.microsoft.com/en-gb/).
- Administrator rights to your {{ product_name }} organization: You need this to configure the Azure AD account in your organization.

## Add Azure Active Directory as an external IdP in {{ product_name }}
Expand All @@ -15,14 +15,14 @@ Follow the steps below to add Azure AD as an IdP in {{ product_name }}:

1. Sign in to the [{{ product_name }} Console](https://console.choreo.dev).
2. In the left navigation menu, click **Settings**.
3. In the header, click the **Organization** list. This will open the organization level settings page.
3. In the header, click the **Organization** list. This opens the organization-level settings page.
4. On the **Application Security** tab, click **Identity Providers** and then click **+ Identity Provider**.
5. Select **Microsoft Entra ID (Azure AD)** as the Identity Provider.
6. Provide a name and a description for the IdP.
7. To obtain the `Well-Known URL` of your Azure AD instance, on your Azure account, under **Azure Active Directory** go to **App registrations**, and then **Endpoints**. Copy the URI under`OpenID Connect metadata document`.
7. To obtain the `Well-Known URL` of your Azure AD instance, on your Azure account, under **Azure Active Directory** go to **App registrations**, and then **Endpoints**. Copy the URI under `OpenID Connect metadata document`

!!! info
- In azure, there are two versions of access tokens available. By default, the IDP applications you create use the v1 access token. Therefore, if you intend to use the v1 access token, when providing the `Well-Known URL`, omit the v2.0 path segment from the URL. [Learn more](https://learn.microsoft.com/en-us/azure/active-directory/develop/access-tokens#token-formats)
- In Azure, there are two versions of access tokens available. By default, the IDP applications you create use the v1 access token. Therefore, if you intend to use the v1 access token, when providing the `Well-Known URL`, omit the v2.0 path segment from the URL. [Learn more](https://learn.microsoft.com/en-us/azure/active-directory/develop/access-tokens#token-formats)
For example, convert `https://login.microsoftonline.com/<tenant-id>/v2.0/.well-known/openid-configuration`-> `https://login.microsoftonline.com/<tenant-id>/.well-known/openid-configuration`
- If you intend to work with v2.0, then the IDP application's manifest should be changed as explained in the [access token documentation](https://learn.microsoft.com/en-us/azure/active-directory/develop/access-tokens#token-formats).

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -2,9 +2,9 @@

{{ product_name }} allows you to configure approval processes for specific workflows within the platform. An approval process for a workflow ensures that critical or sensitive changes are properly managed and controlled.

{{ product_name }} currently allows you to configure approvals for environment promotion, API subscription and URL customization workflows.
{{ product_name }} currently allows you to configure approvals for environment promotion, API subscription, and URL customization workflows.

Configuring approvals for environment promotion allows authorized users to control components being promoted to a critical/production environment.
Configuring approvals for environment promotion allows authorized users to control the promotion of components to critical or production environments.

Configuring approvals for the API subscription workflow allows you to create subscription plans that require approval before being activated. This feature allows you to control access to APIs by requiring administrative review and authorization of subscriptions before they become active.

Expand Down Expand Up @@ -63,7 +63,7 @@ To set up an approval process for a workflow, follow these steps:
Both Roles and Assignees are optional configuration fields. If neither is specified, the system will not dispatch any notifications. However, users with the necessary permissions can still log in to the system and review approval requests through the interface.

!!! info "Important"
Only roles having [relevant approval permission](#permissions-to-review-and-respond-to-approval-requests) can be selected to receive notifications, so that respective users can always review and respond to requests. However, users in Assignees field are there for notification purpose only, they may not have required priviledges to review and approve requests.
Only roles having [relevant approval permission](#permissions-to-review-and-respond-to-approval-requests) can be selected to receive notifications, so that respective users can always review and respond to requests. However, users in the Assignees field are there for notification purposes only, and they may not have the required privileges to review and approve requests.


7. Click **Save**. This configures notifications and enables the approval process for the workflow.
Expand Down