Microsoft Entra ID as a User Directory via LDAPS

This document provides instructions for adding users from Microsoft Entra ID (Entra AD) as PrivX users. By following these instructions, you can allow users from your Entra ID to log into PrivX. Such users may then be granted SSH/RDP access similarly to regular AD users.

This version of the instructions is suitable for Azure environments with LDAPS. For Azure environments without LDAPS support, consider setting up Microsoft Entra ID as a User Directory via Microsoft Graph API instead.

Disclaimers

This document includes instructions regarding third-party products by Microsoft. These instructions are provided for general guidance only.

Documentation involving third-party products include configuring applications in Microsoft Azure. The instructions in this manual were verified against the Microsoft Azure version that was current in January 2024. These instructions will need to be adapted when using other versions of Microsoft Azure.

SSH Communications Security Corporation does not make any warranties as to the accuracy, reliability, or usefulness of these instructions, or guarantee that the content related to third-party products is up to date.

SSH Communications Security Corporation does not provide any warranties regarding third-party products, such as Microsoft Azure, nor provide any support or other services for third- party products.

For instructions about setting up and operating Microsoft products, we always recommend that you consult the official Microsoft documentation intended for the specific version(s) of Microsoft products in your use and/or directly contact Microsoft representatives or support.

It is always your responsibility to define the final production setup for the Microsoft products that you use.

Prerequisites

Check and ensure the following before performing the procedures in this document:

  • Your Entra ID must contain the users that are to access PrivX.
  • Enable LDAPS for your Entra domain. For more information about doing this, see Microsoft documentation at:
    https://learn.microsoft.com/en-us/entra/identity/domain-services/tutorial-configure-ldaps
  • To allow PrivX to detect users on Entra ID, obtain the following bind data from your Entra ID:
    • Bind-user credentials (distinguished name and password).
    • Base DN for searching users.
    • Name of the LDAP field containing the users' login names (typically userPrincipalName).
  • For configuring PrivX servers, obtain the following data regarding your Entra deployment:
    • Root-CA certificate of your Entra domain (in PEM or DER format).
    • Your Entra-ID public URL.
    • The Directory ID of your Entra ID.
  • You will need access to your Azure Portal with sufficient permissions for registering new apps.
  • You must be able to perform terminal commands as root on your PrivX servers.
  • You will need access to the PrivX GUI as a privx-admin.

Integration Steps

The high-level workflow for allowing Entra ID users to log into PrivX involves:

  1. Registering PrivX as an application in Entra ID.
  2. Adding Entra-ID Users to PrivX.

These steps are described in more detail in the following sections.

Registering PrivX in Entra ID

Entra-ID users use Microsoft login for authenticating to PrivX. To enable this functionality, you must first register PrivX as an app in Azure:

  1. Log into Azure Portal at https://portal.azure.com/

  2. In the Azure Portal, navigate to Microsoft Entra ID→App registrations, then click New registration.1. Log into Azure Portal at https://portal.azure.com/
    Ensure you are logged into the correct directory.

  3. To create a new app, navigate to Microsoft Entra ID→App registrations, then click New registration.

  4. Provide the required information regarding the PrivX app.

    After providing the PrivX-app data, click Register.

    The Redirect URIs must contain a Web address with the format https://privx.example.com/auth/api/v1/oidc-cb (replace privx.example.com with the address of your PrivX server.)

You should now see the details of your app. Make note of the Application ID and the Directory ID, which are later required for configuring PrivX.

  1. Next, create an authentication key for the PrivX app. To do this, click Certificates & Secrets, then click New Client Secret.

    Enter the details for your key, then click Save.

    Copy the Value of the key, which is later required for PrivX configuration.

The PrivX app is now set up.

Adding Entra ID Users to PrivX

To allow LDAPS connections to Entra ID, the root-CA certificate of your Entra domain must be added as a trusted Certificate Authority (trusted CA). To do this, perform the following on each PrivX server:

  1. Gain root-terminal access to your PrivX server.
  2. Copy the root-CA certificate

After you have set up the root-CA certificate, configure PrivX to import users from Entra ID, and to authenticate Entra-ID users using Microsoft login:

  1. Access the PrivX GUI.

  2. On the Administration→Directories page, click Add Directory.

    Add a directory of type Active Directory. Also set the connection protocol to LDAPS. Provide the rest of the required Active Directory Settings similarly to the following.

    To enable Microsoft login (using the OpenID Connect standard), also provide the OpenID Connect Settings:

    • OpenID Connect: Set to Enabled.
    • Issuer: OIDC Issuer URL, typically of the syntax (Replace <Directory ID> with your Entra ID's Directory ID):
      https://sts.windows.net/<Directory ID>/
    • Login Button Title: An arbitrary name for the login button displayed on the PrivX login page.
    • Client ID: The Application ID of the PrivX app.
    • Client Secret: The value of a key in the PrivX app.

  3. Click Save to apply your changes. You should verify the directory back on the Administration→Directories page.

    It will take a while for PrivX to fetch and display the directory status. You should ensure that the directory status displays one or more users.

Verifying integration

You may verify integration by testing login with one of the Entra ID users:

  1. Log out from PrivX (if logged in). Navigate to the PrivX login page.

  2. Click the login button for your Entra ID. In this example, Microsoft Login.

    500

  3. Sign in with your Entra ID credentials.

    370

    After successful sign in you will be logged into the PrivX GUI. Integration is now complete.

Was this page helpful?

On this page