Configuring Azure AD (Microsoft Entra ID) Authentication for SMARTS WebSwing Portal

Products

• Network Observability

Issue/Introduction

Overview

Starting with SMARTS 25.4.9, the OpenID Connect (OIDC) security module is included as part of the WebSwing distribution. This enables integration with Microsoft Entra ID (Azure AD) to provide Single Sign-On (SSO) authentication for SMARTS WebConsole users.

With this integration, users are redirected to Azure AD for authentication before accessing the SMARTS console through the WebSwing portal.

 

Environment

Smarts 25.4.9 and later releases.

Resolution

Prerequisites:

Before configuring Azure AD authentication, ensure the following information is available from your Microsoft Entra ID (Azure AD) administrator:

• • Tenant ID
  • Client ID
  • Client Secret
  • Redirect URI
  • OIDC Discovery URL (Issuer URL)
  • Required user accounts for validation

Additionally, an Azure AD Application Registration must be created and configured to support OIDC authentication.

Browser Compatibility:

WebSwing is supported on all major web browsers that implement the HTML5 standard.

Engineering validation has been completed on the latest supported versions of:

• • Google Chrome
  • Microsoft Edge

Configure OpenID Connect Security Module:

1. 1. Launch the WebSwing Admin Console.
   2. Navigate to: Security → OpenID Connect Security Module
   3. Configure the Azure AD specific settings.

The integration follows a two-level authentication model:

User → Azure AD Authentication → WebSwing Session → SMARTS Console

Azure AD validates the user credentials and, upon successful authentication, WebSwing establishes the user session and launches the SMARTS console.

Required Configuration Parameters:

Parameter	Description
importDiscoveryJson	Azure AD OIDC discovery endpoint
callbackUrl	SMARTS Web Console callback URL
usernameAttributeName	User attribute used for login mapping
scopes	OIDC scopes
clientId	Azure AD Application Client ID
clientSecret	Azure AD Application Client Secret

 

Example Configuration:

{
  "importDiscoveryJson": "https://login.microsoftonline.com/<Tenant-id>/v2.0/.well-known/openid-configuration",
  "callbackUrl": "https://<SmartsHostname>:9443/smarts/webconsole",
  "usernameAttributeName": "preferred_username",
  "scopes": "openid profile email",
  "trustedAudiences": "",
  "forceUrlEncodeCallbackUrl": false,
  "logUserAttributes": false,
  "clientId": "<Client-id>",
  "clientSecret": "<Client-secret>"
}

Save Configuration

After entering the required values:

1. 1. Save the configuration from the WebSwing Admin Console.
   2. Restart the WebSwing service if required.
   3. Verify that no configuration errors are reported in the WebSwing logs.

The settings are automatically persisted in:

<BASEDIR>/InCharge/CONSOLE/smarts/tomcat/webswing-console/webswing/webswing-server.config

Validation Procedure:

Authentication Validation

1. 1. Open the SMARTS WebConsole URL.
   2. Verify that the browser redirects to the Microsoft Entra ID login page.
   3. Log in using a valid Azure AD user account.
   4. Verify successful authentication.
   5. Confirm that the SMARTS Console launches successfully.

Negative Validation

1. 1. Attempt login using invalid credentials.
   2. Verify that authentication is rejected by Azure AD.
   3. Confirm that access to the SMARTS Console is denied.

Multi-User Validation

1. 1. Create multiple Azure AD test users.
   2. Validate login using each account.
   3. Confirm successful console launch for all authorized users.

Expected Outcome:

After successful configuration:

• • Users are redirected to Azure AD for authentication.
  • Azure AD validates user credentials.
  • WebSwing establishes an authenticated session.
  • SMARTS WebConsole launches successfully.
  • No local WebSwing credentials are required.

Troubleshooting:

Symptom	Possible Cause
Azure login page not displayed	Incorrect Discovery URL or Client ID
Authentication fails	Invalid Client Secret or Azure AD configuration
Redirect loop	Incorrect Callback URL configuration
Console launch fails after login	WebSwing session initialization issue
SSL certificate errors	Certificate trust configuration issue

 

Module Specifications:

Component	Value
Security Module Class	org.webswing.security.modules.openidconnect.OpenIDConnectSecurityModule
Supported Protocols	OIDC, OAuth 2.0
Required Scopes	openid, profile, email

 

Supported Releases:

This functionality (security module) is available starting from SMARTS 25.4.9.

WebSwing service was introduced as part of SMARTS 25.4.4.

 

Additional Information

Please note that the Azure AD integration steps are for references and any assistance with the implementation and troubleshooting the same would require to engage the Professional Solutions Engineering team.