Configuring Azure as an SSO

Products

• CA Privileged Access Manager (PAM)

Issue/Introduction

CA PAM documentation provides means of using Azure  as an IdP under several constraints:

• Users are provisioned JIT.
• PAM is configured to either manage devices (Web) or devices and users (Public Client), meaning a connection to Azure is required and the application registered in Azure must be able to manage it, to be able to establish the necessary connection.

The procedure requires as well to create an application in Azure, provide PAM Assertion consumer services URL to Azure, include Azure Metadata in PAM and get a secret to be used with the Azure registration.

However, there may be situations where JIT is not necessary and there is no need to manage devices or users in Azure from PAM. As such, no Azure Client is really necessary, no Azure application and target account must be defined. 

In this case Azure is just used for SSO: that it, there must be a local user  (imported for instance through LDAP) already defined in Azure and Azure sole function is to authenticate it and allow login to PAM.

This configuration is simpler than the Azure as an IdP with PAM acting as a Public Client. This article provides what steps must be followed for this type of configuration.

Resolution

To be able to use Azure just as a SSO IdP, with no device or user management, you need to do the following:

• Create an AzureSAMLUsers local group in CA PAM and assign to it SAML authentication. This group is needed because PAM will look for all Azure Authenticated users in this specific group. If the user you are trying to log in as is not in this group, authentication will fail with an error indicating the user cannot be mapped.
• Import all the users which will be authenticated via Azure in PAM. For instance you can do that by importing a group in AD containing them or any other method. However, the userid must match the same one as exists in Azure (for instance, if in Azure one has [email protected], there should be a [email protected] in PAM and it should be a member of AzureSAMLUsers).
• Follow the documentation for creating an Application registration in Azure and for subsequently importing the metadata in CA PAM. Also assign users and roles to the application like you would do in a regular Azure as an IdP configuration.
• Configure as well the different CA PAM cluster servers for SSO. Remember that an IP address and certificate (may be the default) is required for every node in the SAML Configuration, 
• Import Azure Metadata into PAM in the Configured Remote SAML IdP under SAML. Then edit it and do not mark the JIT checkbox. Click on the Download Metadata so that the XsuiteMetadataFor_<application_name>.xml file is downloaded and edit it to retrieve the AssertionConsumerService (ACS) entries therein specified.
• The corresponding ACS will have to be entered in Azure in the application defined previously. To do so, access  Application Registration and add the ACS URL under the Redirect Uri Configuration (either as Mobile or desktop applications, or as Web).

With this it should be able to do SSO to PAM with any of the users specified in AzureSAMLUsers without needing to have an Azure management subscription. However, note that users and machines in Azure won't be discovered by default with this configuration. There will be no JIT and the users must be managed manually.